1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
From: Reinhard Tartler <siretart@tauware.de>, Simon Josefsson <simon@josefsson.org>
Last-Updated: 2025-12-09
Subject: avoid-boulder
Forwarded: not-needed
Drop dependency on boulder, disable RSA checks
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1122275
diff --git a/pkg/cryptoutils/goodkey/publickey.go b/pkg/cryptoutils/goodkey/publickey.go
index 8c23157..a8240ac 100644
--- a/pkg/cryptoutils/goodkey/publickey.go
+++ b/pkg/cryptoutils/goodkey/publickey.go
@@ -17,57 +17,15 @@
package goodkey
import (
- "context"
"crypto"
- "crypto/ecdsa"
"crypto/ed25519"
- "crypto/rsa" // nolint:gosec
- "errors"
"fmt"
-
- "github.com/letsencrypt/boulder/goodkey"
)
// ValidatePubKey validates the parameters of an RSA, ECDSA, or ED25519 public key.
func ValidatePubKey(pub crypto.PublicKey) error {
- // goodkey policy enforces:
- // * RSA
- // * Size of key: 2048 <= size <= 4096, size % 8 = 0
- // * Exponent E = 65537 (Default exponent for OpenSSL and Golang)
- // * Small primes check for modulus
- // * Weak keys generated by Infineon hardware (see https://crocs.fi.muni.cz/public/papers/rsa_ccs17)
- // * Key is easily factored with Fermat's factorization method
- // * EC
- // * Public key Q is not the identity element (Ø)
- // * Public key Q's x and y are within [0, p-1]
- // * Public key Q is on the curve
- // * Public key Q's order matches the subgroups (nQ = Ø)
- allowedKeys := &goodkey.AllowedKeys{
- RSA2048: true,
- RSA3072: true,
- RSA4096: true,
- ECDSAP256: true,
- ECDSAP384: true,
- ECDSAP521: true,
- }
- cfg := &goodkey.Config{
- FermatRounds: 100,
- AllowedKeys: allowedKeys,
- }
- p, err := goodkey.NewPolicy(cfg, nil)
- if err != nil {
- // Should not occur, only chances to return errors are if fermat rounds
- // are <0 or when loading blocked/weak keys from disk (not used here)
- return errors.New("unable to initialize key policy")
- }
-
+ // Avoid dependency on Goodkey for Debian
switch pk := pub.(type) {
- case *rsa.PublicKey:
- // ctx is unused
- return p.GoodKey(context.Background(), pub)
- case *ecdsa.PublicKey:
- // ctx is unused
- return p.GoodKey(context.Background(), pub)
case ed25519.PublicKey:
return validateEd25519Key(pk)
}
diff --git a/pkg/cryptoutils/goodkey/publickey_test.go b/pkg/cryptoutils/goodkey/publickey_test.go
index 7c992ae..d4dafc5 100644
--- a/pkg/cryptoutils/goodkey/publickey_test.go
+++ b/pkg/cryptoutils/goodkey/publickey_test.go
@@ -20,10 +20,7 @@ import (
"crypto/elliptic"
"crypto/rand"
"crypto/rsa"
- "errors"
"testing"
-
- "github.com/letsencrypt/boulder/goodkey"
)
func TestValidatePubKeyUnsupported(t *testing.T) {
@@ -36,6 +33,8 @@ func TestValidatePubKeyUnsupported(t *testing.T) {
}
func TestValidatePubKeyRsa(t *testing.T) {
+ t.Skip("Validations disabled for Debian")
+
// Validate common RSA key sizes
for _, bits := range []int{2048, 3072, 4096} {
priv, err := rsa.GenerateKey(rand.Reader, bits)
@@ -81,6 +80,7 @@ func (t testCurve) Params() *elliptic.CurveParams {
}
func TestValidatePubKeyEcdsa(t *testing.T) {
+ t.Skip("Validations disabled for Debian")
for _, curve := range []elliptic.Curve{elliptic.P256(), elliptic.P384(), elliptic.P521()} {
priv, err := ecdsa.GenerateKey(curve, rand.Reader)
if err != nil {
@@ -96,20 +96,14 @@ func TestValidatePubKeyEcdsa(t *testing.T) {
}
}
// Fails with smaller curve
- priv, err := ecdsa.GenerateKey(elliptic.P224(), rand.Reader)
+ _, err := ecdsa.GenerateKey(elliptic.P224(), rand.Reader)
if err != nil {
t.Fatalf("ecdsa.GenerateKey failed: %v", err)
}
- if err := ValidatePubKey(priv.Public()); err == nil || !errors.Is(err, goodkey.ErrBadKey) {
- t.Errorf("expected unsupported curve, got %v", err)
- }
// Fails with unknown curve
err = ValidatePubKey(&ecdsa.PublicKey{
Curve: testCurve{},
})
- if err == nil || !errors.Is(err, goodkey.ErrBadKey) {
- t.Errorf("expected unexpected curve, got %v", err)
- }
}
func TestValidatePubKeyEd25519(t *testing.T) {
|
