tsai
/
openiddict-core
mirror of https://github.com/openiddict/openiddict-core.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

Bump the key size of RSA keys used to generate ephemeral keys and development certificates

dev
Kévin Chalet 3 days ago
parent
5c1cda0ac5
commit
b28f31891f
2 changed files with 9 additions and 10 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 8
      src/OpenIddict.Client/OpenIddictClientBuilder.cs
  2. 11
      src/OpenIddict.Server/OpenIddictServerBuilder.cs

8
src/OpenIddict.Client/OpenIddictClientBuilder.cs
View File

@ -207,7 +207,7 @@ public sealed class OpenIddictClientBuilder
if (!certificates.Exists(certificate => certificate.NotBefore < now.LocalDateTime && certificate.NotAfter > now.LocalDateTime))
{
#if SUPPORTS_CERTIFICATE_GENERATION
using var algorithm = OpenIddictHelpers.CreateRsaKey(size: 2048);
using var algorithm = OpenIddictHelpers.CreateRsaKey(size: 4096);
var request = new CertificateRequest(subject, algorithm, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
request.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.KeyEncipherment, critical: true));
@ -299,7 +299,7 @@ public sealed class OpenIddictClientBuilder
SecurityAlgorithms.RsaOAEP or
SecurityAlgorithms.RsaOaepKeyWrap
=> AddEncryptionCredentials(new EncryptingCredentials(
new RsaSecurityKey(OpenIddictHelpers.CreateRsaKey(size: 2048)),
new RsaSecurityKey(OpenIddictHelpers.CreateRsaKey(size: 4096)),
algorithm, SecurityAlgorithms.Aes256CbcHmacSha512)),
_ => throw new InvalidOperationException(SR.GetResourceString(SR.ID0058))
@ -585,7 +585,7 @@ public sealed class OpenIddictClientBuilder
if (!certificates.Exists(certificate => certificate.NotBefore < now.LocalDateTime && certificate.NotAfter > now.LocalDateTime))
{
#if SUPPORTS_CERTIFICATE_GENERATION
using var algorithm = OpenIddictHelpers.CreateRsaKey(size: 2048);
using var algorithm = OpenIddictHelpers.CreateRsaKey(size: 4096);
var request = new CertificateRequest(subject, algorithm, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
request.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature, critical: true));
@ -681,7 +681,7 @@ public sealed class OpenIddictClientBuilder
SecurityAlgorithms.RsaSsaPssSha384Signature or
SecurityAlgorithms.RsaSsaPssSha512Signature
=> AddSigningCredentials(new SigningCredentials(new RsaSecurityKey(
OpenIddictHelpers.CreateRsaKey(size: 2048)), algorithm)),
OpenIddictHelpers.CreateRsaKey(size: 4096)), algorithm)),
#if SUPPORTS_ECDSA
SecurityAlgorithms.EcdsaSha256 or

11
src/OpenIddict.Server/OpenIddictServerBuilder.cs
View File

@ -218,7 +218,7 @@ public sealed class OpenIddictServerBuilder
if (!certificates.Exists(certificate => certificate.NotBefore < now.LocalDateTime && certificate.NotAfter > now.LocalDateTime))
{
#if SUPPORTS_CERTIFICATE_GENERATION
using var algorithm = OpenIddictHelpers.CreateRsaKey(size: 2048);
using var algorithm = OpenIddictHelpers.CreateRsaKey(size: 4096);
var request = new CertificateRequest(subject, algorithm, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
request.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.KeyEncipherment, critical: true));
@ -310,7 +310,7 @@ public sealed class OpenIddictServerBuilder
SecurityAlgorithms.RsaOAEP or
SecurityAlgorithms.RsaOaepKeyWrap
=> AddEncryptionCredentials(new EncryptingCredentials(
new RsaSecurityKey(OpenIddictHelpers.CreateRsaKey(size: 2048)),
new RsaSecurityKey(OpenIddictHelpers.CreateRsaKey(size: 4096)),
algorithm, SecurityAlgorithms.Aes256CbcHmacSha512)),
_ => throw new InvalidOperationException(SR.GetResourceString(SR.ID0058))
@ -593,11 +593,10 @@ public sealed class OpenIddictServerBuilder
.Cast<X509Certificate2>()
.ToList();
if (!certificates.Exists(certificate =>
certificate.NotBefore < now.LocalDateTime && certificate.NotAfter > now.LocalDateTime))
if (!certificates.Exists(certificate => certificate.NotBefore < now.LocalDateTime && certificate.NotAfter > now.LocalDateTime))
{
#if SUPPORTS_CERTIFICATE_GENERATION
using var algorithm = OpenIddictHelpers.CreateRsaKey(size: 2048);
using var algorithm = OpenIddictHelpers.CreateRsaKey(size: 4096);
var request = new CertificateRequest(subject, algorithm, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
request.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature, critical: true));
@ -693,7 +692,7 @@ public sealed class OpenIddictServerBuilder
SecurityAlgorithms.RsaSsaPssSha384Signature or
SecurityAlgorithms.RsaSsaPssSha512Signature
=> AddSigningCredentials(new SigningCredentials(new RsaSecurityKey(
OpenIddictHelpers.CreateRsaKey(size: 2048)), algorithm)),
OpenIddictHelpers.CreateRsaKey(size: 4096)), algorithm)),
#if SUPPORTS_ECDSA
SecurityAlgorithms.EcdsaSha256 or

Write Preview
Loading…
Cancel
Save