NIST: increase RSA key length to 2048 bit

[Qin Zhao]

According to NIST 800-131A, RSA key lenght for digital signature must >= 2048 bit.

In crypto.py, we use 1024 bit as the default key length to generate cert file, and does not specify any larger number to override the default value when utilizing it.

def generate_x509_cert(user_id, project_id, bits=1024):

Need to increase the default key length to 2048 bit.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/121497

[Jeremy Stanley (fungi)]

I think this is the classic definition of a security hardening improvement, not a security vulnerability, and so not a fix for which the vulnerability management team would coordinate a security advisory unless:

a) there are now reliable attacks you can demonstrate which are enabled by the old default key length

b) the documentation claims nova generates longer keys by default than it actually does

c) configuration to force longer key lengths is documented but ignored by the software

It seems like none of the above are the case, so I propose the VMT treat this as a hardening fix unless you can provide evidence to the contrary.

[Thierry Carrez (ttx)]

Agreed, will open on Thursday if nobody complains.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/121497
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=3957d3bed8f2ee2bbb9e54dd67d4f3ab25fc3a13
Submitter: Jenkins
Branch: master

commit 3957d3bed8f2ee2bbb9e54dd67d4f3ab25fc3a13
Author: Qin Zhao <email address hidden>
Date: Mon Sep 15 18:08:51 2014 +0800

    NIST: increase RSA key length to 2048 bit

    According to NIST 800-131A, RSA key lenght for digital signature
    must >= 2048 bit. Now we use 1024 bit key to generate x509 cert
    file. Need to increase the key length to 2048 bit.

    Change-Id: I59f614b5d8a79f9e0a96503867cfca176be5c757
    Closes-Bug: 1369487