Most of cryptographic systems require a sufficient key size to be robust against brute-force attacks.
NIST recommendations will be checked for these use-cases:
Digital Signature Generation and Verification:
p is key length and q the modulus length) n is the key length) Key Agreement:
secp192r1 is a non-compliant curve (n < 224) but secp224k1 is
compliant (n >= 224)) Symmetric keys:
This rule will not raise issues for ciphers that are considered weak (no matter the key size) like DES, Blowfish.
$config = array(
"digest_alg" => "sha512",
"private_key_bits" => 1024, // Noncompliant
"private_key_type" => OPENSSL_KEYTYPE_RSA,
);
$res = openssl_pkey_new($config);
$config = array(
"digest_alg" => "sha512",
"private_key_bits" => 2048 // Compliant
"private_key_type" => OPENSSL_KEYTYPE_RSA,
);
$res = openssl_pkey_new($config);