Px5g to be improved

reinerotto · August 4, 2024, 6:56pm

px5g generates 512 bit keys, hardcoded, unfortunately. Which is outdated, should be 2048 nowadays. To avoid complaints of certain SSL-modules about "... key too short."

brada4 · August 4, 2024, 7:19pm

Make a PR:
mbedtls:

github.com

openwrt/openwrt/blob/d604b2699b6015f99ff194b34f532958bde7d442/package/utils/px5g-mbedtls/px5g-mbedtls.c#L155


      
          		if (!mbedtls_ecp_gen_key(curve, mbedtls_pk_ec(*key), _urandom, NULL))
          			return;
          	}
          	fprintf(stderr, "error: key generation failed\n");
          	exit(1);
          }
          
          int dokey(bool rsa, char **arg)
          {
          	mbedtls_pk_context key;
          	unsigned int ksize = 512;
          	int exp = 65537;
          	char *path = NULL;
          	bool pem = true;
          	mbedtls_ecp_group_id curve = MBEDTLS_ECP_DP_SECP256R1;
          
          	while (*arg && **arg == '-') {
          		if (!strcmp(*arg, "-out") && arg[1]) {
          			path = arg[1];
          			arg++;
          		} else if (!strcmp(*arg, "-3")) {

wolfssl is 2048 already

github.com

openwrt/openwrt/blob/d604b2699b6015f99ff194b34f532958bde7d442/package/utils/px5g-wolfssl/px5g-wolfssl.c#L22


      
          #include <wolfssl/options.h>
          #include <wolfssl/wolfcrypt/asn.h>
          #include <wolfssl/wolfcrypt/asn_public.h>
          #include <wolfssl/wolfcrypt/ecc.h>
          #include <wolfssl/wolfcrypt/error-crypt.h>
          #include <wolfssl/wolfcrypt/rsa.h>
          #include <wolfssl/wolfcrypt/settings.h>
          
          #define HEAP_HINT NULL
          #define FOURK_SZ 4096
          #define WOLFSSL_MIN_RSA_BITS 2048
          
          enum {
            EC_KEY_TYPE = 0,
            RSA_KEY_TYPE = 1,
          };
          
          int write_file(byte *buf, int bufSz, char *path, bool cert) {
            mode_t mode = S_IRUSR | S_IWUSR;
            ssize_t written;
            int err;

In practice uhttpd script adds 2048 by parameter for default key, so there is no operational constraint.
Check https://cabforum.org/working-groups/server/baseline-requirements/requirements/ also, might be some other deficiencies in defaults.

reinerotto · August 4, 2024, 8:49pm

px5g-mbedtls.c has to be edited in 2 locations, not just one. And because it is also used as px5g-standalone on my 23.05.4, the update of px5g-wolff is not sufficient.

brada4 · August 5, 2024, 4:40am

Only use adds proper parameter:

github.com

openwrt/openwrt/blob/d604b2699b6015f99ff194b34f532958bde7d442/package/network/services/uhttpd/files/uhttpd.config#L133


      
          # Defaults for automatic certificate and key generation
          config cert defaults
          
          	# Validity time
          	option days		730
          
          	# key type: rsa or ec
          	option key_type		ec
          
          	# RSA key size
          	option bits		2048
          
          	# EC curve name
          	# Curve names vary between px5g-{wolfssl,mbedtls} and openssl
          	# P-256 or P-384 are guaranteed to work
          	option ec_curve		P-256
          
          	# Location
          	option country		ZZ
          	option state		Somewhere
          	option location		Unknown

reinerotto · August 5, 2024, 5:02am

Thank you for this hint. But that does not solve the issue, only my direct edit of px5g-mbedtls.c and re-build. It is an annoyance, when px5g-wolff and px5g-mbedtls have different functionality.

brada4 · August 5, 2024, 5:05am

You add parameters to your calling script or submit a PR via github, there is no way present px5g suddenly blinks a byte and changes behaviour without recompilong.