From 7c666de3bd078a4b93c1e4d64544c87d503b2750 Mon Sep 17 00:00:00 2001 From: mainboarder Date: Mon, 28 Aug 2023 02:53:16 +0200 Subject: [PATCH] Expanded minimum RSA Keylength to 3072 (#26604) German Federal Office for Information Security requests in its technical guideline BSI TR-02102-1 RSA Keylength not shorter than 3000bits starting 2024, in the year 2023 3000bits as a recommendation. Gitea should request longer RSA Keys by default in favor of security and drop old clients which do not support longer keys. https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102.pdf?__blob=publicationFile&v=9 - Page 19, Table 1.2 --------- Co-authored-by: wxiaoguang --- administration/command-line.en-us.md | 2 +- administration/command-line.zh-cn.md | 2 +- administration/config-cheat-sheet.en-us.md | 2 +- administration/config-cheat-sheet.zh-cn.md | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/administration/command-line.en-us.md b/administration/command-line.en-us.md index 91c6c1e6..05caff90 100644 --- a/administration/command-line.en-us.md +++ b/administration/command-line.en-us.md @@ -313,7 +313,7 @@ directory and will overwrite any existing files. - `--ecdsa-curve value`: ECDSA curve to use to generate a key. Optional. Valid options are P224, P256, P384, P521. - `--rsa-bits value`: Size of RSA key to generate. Optional. Ignored if --ecdsa-curve is - set. (default: 2048). + set. (default: 3072). - `--start-date value`: Creation date. Optional. (format: `Jan 1 15:04:05 2011`). - `--duration value`: Duration which the certificate is valid for. Optional. (default: 8760h0m0s) - `--ca`: If provided, this cert generates it's own certificate authority. Optional. diff --git a/administration/command-line.zh-cn.md b/administration/command-line.zh-cn.md index bd3d0c72..6e6bcb60 100644 --- a/administration/command-line.zh-cn.md +++ b/administration/command-line.zh-cn.md @@ -295,7 +295,7 @@ menu: - 选项： - `--host value`：逗号分隔的主机名和IP地址列表，此证书适用于这些主机。支持使用通配符。必填。 - `--ecdsa-curve value`：用于生成密钥的ECDSA曲线。可选。有效选项为P224、P256、P384、P521。 - - `--rsa-bits value`：要生成的RSA密钥的大小。可选。如果设置了--ecdsa-curve，则忽略此选项。（默认值：2048）。 + - `--rsa-bits value`：要生成的RSA密钥的大小。可选。如果设置了--ecdsa-curve，则忽略此选项。（默认值：3072）。 - `--start-date value`：证书的创建日期。可选。（格式：`Jan 1 15:04:05 2011`）。 - `--duration value`：证书有效期。可选。（默认值：8760h0m0s） - `--ca`：如果提供此选项，则证书将生成自己的证书颁发机构。可选。 diff --git a/administration/config-cheat-sheet.en-us.md b/administration/config-cheat-sheet.en-us.md index 968b47c2..311a2b2b 100644 --- a/administration/config-cheat-sheet.en-us.md +++ b/administration/config-cheat-sheet.en-us.md @@ -681,7 +681,7 @@ Define allowed algorithms and their minimum key length (use -1 to disable a type - `ED25519`: **256** - `ECDSA`: **256** -- `RSA`: **2047**: We set 2047 here because an otherwise valid 2048 RSA key can be reported as 2047 length. +- `RSA`: **3071**: We set 3071 here because an otherwise valid 3072 RSA key can be reported as 3071 length. - `DSA`: **-1**: DSA is now disabled by default. Set to **1024** to re-enable but ensure you may need to reconfigure your SSHD provider ## Webhook (`webhook`) diff --git a/administration/config-cheat-sheet.zh-cn.md b/administration/config-cheat-sheet.zh-cn.md index 87e45aa6..39121908 100644 --- a/administration/config-cheat-sheet.zh-cn.md +++ b/administration/config-cheat-sheet.zh-cn.md @@ -648,7 +648,7 @@ Gitea 创建以下非唯一队列： - `ED25519`：**256** - `ECDSA`：**256** -- `RSA`：**2047**：我们在这里设置为2047，因为一个其他方面有效的2048 RSA密钥可能被报告为2047长度。 +- `RSA`：**3071**：我们在这里设置为2047，因为一个其他方面有效的3072 RSA密钥可能被报告为3071长度。 - `DSA`：**-1**：默认情况下禁用DSA。设置为**1024**以重新启用，但请注意可能需要重新配置您的SSHD提供者 ## Webhook (`webhook`)