1493744 - Please back out the 1024 bit RSA key of [e-mail]

Status: RESOLVED FIXED

(Taskcluster :: Workers, enhancement)

Description

[Darkspirit]

Please never use 1024 bit RSA, regardless where. Thanks.
https://github.com/mozilla-releng/OpenCloudConfig/pull/186

https://infosec.mozilla.org/guidelines/openssh#key-generation

> echo; ssh-keygen -lf /dev/stdin <<< "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDnV2fGMnRyLBM0qmCw3Q/hIZ7kCNxX4SNLnj66hBssptQIGqtuFesCzlwbNY0nVn/uZVRX9p5dYxuMQVuHF9gp1hHHae90EULwGUxCMjU3UvoeOmUN4lebecpZVaihzqqqdb7oEXqNKxqU4FWwWx/+W0BLOFIyM1ILjkx13pmJrw== [e-mail]";
> 
> 1024 SHA256:8QaVnZxpthSVFBq0N4vR90185/YamicbzGBYOeUaPFc [e-mail] (RSA)

Comment 1

[Rob Thijssen [:grenade (EET/UTC+0300)]]

Attachment: GitHub Pull Request

i've backed out the key and added a validation to occ ci to flag future prs where a key with a bit length less than 2048 is added.

Comment 2

[Darkspirit]

I've never reviewed a patch for Mozilla and do not feel competent/authorized for that. Could someone else take the responsibility? Thanks. ;)
But it would be good if you could increase the minimum RSA key size to 4096 bits as reasonably recommended by the infosec guidelines.

Comment 3

[Rob Thijssen [:grenade (EET/UTC+0300)]]

Comment on attachment 9011698 [details] [review]
GitHub Pull Request

sure. pmoore: are you ok to take this one?

Comment 4

[Pete Moore [:pmoore][:pete]]

Comment on attachment 9011698 [details] [review]
GitHub Pull Request

Looks great, I think just needs to change to 4096 instead of 2048. Thanks Rob!

Comment 5

[Rob Thijssen [:grenade (EET/UTC+0300)]]

https://github.com/mozilla-releng/OpenCloudConfig/commit/52667ba5aee1ba33e03aa83c45eccdb64ffb08de

Comment 6

[Pete Moore [:pmoore][:pete]]

(In reply to Jan Andre Ikenmeyer [:darkspirit] from comment #0)
> Please never use 1024 bit RSA, regardless where. Thanks.
> https://github.com/mozilla-releng/OpenCloudConfig/pull/186

Superseded with https://github.com/mozilla-releng/OpenCloudConfig/pull/189