Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Default to 4096 bit for OEM factory reset (fixes #831) #906

Merged
merged 1 commit into from
Dec 2, 2020

Conversation

techge
Copy link
Contributor

@techge techge commented Nov 24, 2020

Fixes #831

@tlaurion
Copy link
Collaborator

tlaurion commented Dec 2, 2020

@techge @flammit
This is exactly what i'm talking about. Should we ask contributors to think about space constraints of smaller boards when they propose good changes like this one?

@flammit should I merge? this forces gpg2 module (required for 4096 key generation) usage and implies that all boards will use gpg2 module in the future.

Precedently of our discussion, I would merge. Now I just can't.

@flammit your input welcome.

@techge : some context: for the time being, and considering space constaints of xx20 and xx30 and other boards needing gpg but not necessarily gpg2 which was introduced to be able to generate 4096 keys, this changeset would need to depend on GPG2 binary module presence exclusively to be mergeable with that consideration.

So a test could be added to check the version output of gpg binary, and only force 4096 bits when gpg v2+, while putting it to 2048 if not.

@flammit
Copy link
Collaborator

flammit commented Dec 2, 2020

I don't understand why there would be an issue merging this. Heads currently already assumes that the gpg installed is gpg2, so there's no harm in committing this.

In the future if it is possible to have either gpg1 or gpg2 be an included module on a board, then that PR that introduces gpg1 should also update the logic here so that the additions of this PR (or any other feature that requires gpg2) are only run when the gpg2 module is used.

@tlaurion
Copy link
Collaborator

tlaurion commented Dec 2, 2020

Allright! Merging! Happy merge day!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Have the GPG factory reset functions propose/default to RSA 4096 bits keys, not 2048
4 participants