diff options
| author | Daniel Kahn Gillmor <[email protected]> | 2014-10-09 20:54:15 +0000 |
|---|---|---|
| committer | Werner Koch <[email protected]> | 2014-10-10 11:40:38 +0000 |
| commit | 6cabb7a2a18f871b8c3d5de58bcdc5aaa5b201af (patch) | |
| tree | 14299bcebf1e30e3b69e8f53adfe08afabdb0f65 /doc | |
| parent | gpg: Skip overlong keys and a print a warning. (diff) | |
| download | gnupg-6cabb7a2a18f871b8c3d5de58bcdc5aaa5b201af.tar.gz gnupg-6cabb7a2a18f871b8c3d5de58bcdc5aaa5b201af.zip | |
gpg: Add build and runtime support for larger RSA keys
* configure.ac: Added --enable-large-secmem option.
* g10/options.h: Add opt.flags.large_rsa.
* g10/gpg.c: Contingent on configure option: adjust secmem size,
add gpg --enable-large-rsa, bound to opt.flags.large_rsa.
* g10/keygen.c: Adjust max RSA size based on opt.flags.large_rsa
* doc/gpg.texi: Document --enable-large-rsa.
--
This is a cherry-pick of 534e2876acc05f9f8d9b54c18511fe768d77dfb5 from
STABLE-BRANCH-1-4 against master
Some older implementations built and used RSA keys up to 16Kib, but
the larger secret keys now fail when used by more recent GnuPG, due to
secure memory limitations.
Building with ./configure --enable-large-secmem will make gpg
capable of working with those secret keys, as well as permitting the
use of a new gpg option --enable-large-rsa, which let gpg generate RSA
keys up to 8Kib when used with --batch --gen-key.
Debian-bug-id: 739424
Minor edits by wk.
GnuPG-bug-id: 1732
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/gpg.texi | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/doc/gpg.texi b/doc/gpg.texi index 002e888ce..e7360e913 100644 --- a/doc/gpg.texi +++ b/doc/gpg.texi @@ -1181,6 +1181,15 @@ the opposite meaning. The options are: validation. This option is only meaningful if pka-lookups is set. @end table +@item --enable-large-rsa +@itemx --disable-large-rsa +@opindex enable-large-rsa +@opindex disable-large-rsa +With --gen-key and --batch, enable the creation of larger RSA secret +keys than is generally recommended (up to 8192 bits). These large +keys are more expensive to use, and their signatures and +certifications are also larger. + @item --enable-dsa2 @itemx --disable-dsa2 @opindex enable-dsa2 |