Daniel Bruce wrote:
>
> Not strictly Openssl ...
>
> I have been struggling for a while now trying to issue keys >512 to
> MSIE clients.
> Netscape is fine and creates a 1024 key. I have been exporting from netscape
> and importing to IE.
>
> IE is the 128bit strength. The keys are always 512. The script I have seems
> OK. MS black magic. Can't find a decent example from MS (SDK somewhere?).
>
> part of what I have looks like this:
>
> Xenroll.KeySpec = 1
> Xenroll.GenKeyFlags = 3
> Xenroll.HashAlgorithm = "MD5"
> sz10 = Xenroll.CreatePKCS10(szName,"1.3.6.1.5.5.7.3.2") (magic
> numbers!)
>
> What's the secret? (Besides not using IEEEE!)
>
> Any help appreciated! THX.
All this stuff uses MS CryptoAPI.
It uses two kinds of key, signing only and general purpose. The export
regulations at the time said that only 512 bit keys could be used for
encryption so general purpose keys are limited to 512 bits in the export
version of CryptoAPI. To change this you need to install the 128 bit
domestic security patch even then you might need to change the CSP
Xenroll uses.
However if you want keys that are signature only then you can only use
the certificates for SSL client authentication and S/MIME signing. Due
to a bug IE4 wont use signing only keys for SSL client authentication.
Anyway if you check the Xenroll and CryptoAPI documentation on MSDN
online it might help. GenKeyFlags correspond to the parametere dwFlags
passed to CryptGenKey(). '3' means
CRYPT_EXPORTABLE|CRYPT_USER_PROTECTED. The docs say that the upper 16
bits of this paraemeter are the key size to generate in bits. However if
its zero it uses a default size.
Keyspec is the Algid paramater to CryptGenKey(). 1 corresponds to a key
exchange (general purpose) key. Setting this to 2 or not setting it at
all will give a signature only key.
There are also functions to enumerate the CSPs and change the CSP used.
You might need to use them to check for the enhanced CSP and use that if
you want 1024 bit general purpose keys. If you do change the CSP to use
the enhanced CSP then the default keysize if 1024 bits.
Steve
--
Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED]
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
