Re: [Puppet Users] changing the default key length and hash

2011-05-25 Thread Nigel Kersten
Just noting that we are moving forward on the original ticket. It does appear that we've drifted onto other issues, I'd like to remind people to please file bugs/feature requests on those so we don't lose track of them. On Wed, May 25, 2011 at 12:41 PM, Daniel Pittman wrote: > On Wed, May 25,

Re: [Puppet Users] changing the default key length and hash

2011-05-25 Thread Daniel Pittman
On Wed, May 25, 2011 at 10:23, Jennings, Jared L CTR USAF AFMC 46 SK/CCI wrote: >> Ah.  I was thinking in the broader scope of getting us away from >> insecure hashes elsewhere in the product.  From a strictly certificate >> POV, indeed, it should be just fine. > > I'm trying to configure FIPS-com

RE: [Puppet Users] changing the default key length and hash

2011-05-25 Thread Jennings, Jared L CTR USAF AFMC 46 SK/CCI
> Ah. I was thinking in the broader scope of getting us away from > insecure hashes elsewhere in the product. From a strictly certificate > POV, indeed, it should be just fine. I'm trying to configure FIPS-compliant servers, and I've run into segfaults thrown by the Ruby interpreter when Puppet

Re: [Puppet Users] changing the default key length and hash

2011-05-24 Thread Daniel Pittman
On Tue, May 24, 2011 at 11:02, Mark Stanislav wrote: > On May 24, 2011, at 1:50 PM, Daniel Pittman wrote: >> On Tue, May 24, 2011 at 06:36, Mark Stanislav >> wrote: >>> On May 24, 2011, at 1:38 AM, Daniel Pittman wrote: On Fri, May 20, 2011 at 08:23, Nigel Kersten wrote: > On Fri, May

Re: [Puppet Users] changing the default key length and hash

2011-05-24 Thread Mark Stanislav
On May 24, 2011, at 1:50 PM, Daniel Pittman wrote: > On Tue, May 24, 2011 at 06:36, Mark Stanislav > wrote: >> On May 24, 2011, at 1:38 AM, Daniel Pittman wrote: >>> On Fri, May 20, 2011 at 08:23, Nigel Kersten wrote: On Fri, May 20, 2011 at 5:39 AM, Mark Stanislav wrote: > […] >>> L

Re: [Puppet Users] changing the default key length and hash

2011-05-24 Thread Brice Figureau
On 24/05/11 19:50, Daniel Pittman wrote: > On Tue, May 24, 2011 at 06:36, Mark Stanislav > wrote: >> On May 24, 2011, at 1:38 AM, Daniel Pittman wrote: >>> On Fri, May 20, 2011 at 08:23, Nigel Kersten wrote: On Fri, May 20, 2011 at 5:39 AM, Mark Stanislav wrote: > […] >>> Larger keys,

Re: [Puppet Users] changing the default key length and hash

2011-05-24 Thread Daniel Pittman
On Tue, May 24, 2011 at 06:36, Mark Stanislav wrote: > On May 24, 2011, at 1:38 AM, Daniel Pittman wrote: >> On Fri, May 20, 2011 at 08:23, Nigel Kersten wrote: >>> On Fri, May 20, 2011 at 5:39 AM, Mark Stanislav >>> wrote: […] >> Larger keys, better hashing (probably by adding them as well as m

Re: [Puppet Users] changing the default key length and hash

2011-05-24 Thread Mark Stanislav
On May 24, 2011, at 1:38 AM, Daniel Pittman wrote: > On Fri, May 20, 2011 at 08:23, Nigel Kersten wrote: >> On Fri, May 20, 2011 at 5:39 AM, Mark Stanislav >> wrote: >>> >>> In short, I'm in agreement with you. With the CA which is defaulted to 5 >>> years (not at all surprising) there's no dou

Re: [Puppet Users] changing the default key length and hash

2011-05-23 Thread Daniel Pittman
On Fri, May 20, 2011 at 08:23, Nigel Kersten wrote: > On Fri, May 20, 2011 at 5:39 AM, Mark Stanislav > wrote: >> >> In short, I'm in agreement with you. With the CA which is defaulted to 5 >> years (not at all surprising) there's no doubt that soon (maybe 2.7 is a >> good time?) that 2048 key si

Re: [Puppet Users] changing the default key length and hash

2011-05-20 Thread Nigel Kersten
On Fri, May 20, 2011 at 5:39 AM, Mark Stanislav wrote: > Hi Micah, > > In short, I'm in agreement with you. With the CA which is defaulted to 5 > years (not at all surprising) there's no doubt that soon (maybe 2.7 is a > good time?) that 2048 key size should be used for at least the CA key, if > n

Re: [Puppet Users] changing the default key length and hash

2011-05-20 Thread Mark Stanislav
Hi Micah, In short, I'm in agreement with you. With the CA which is defaulted to 5 years (not at all surprising) there's no doubt that soon (maybe 2.7 is a good time?) that 2048 key size should be used for at least the CA key, if not default for client key generation as well. Secondly, yes, I d

[Puppet Users] changing the default key length and hash

2011-05-19 Thread Micah Anderson
Hi all, I would like to start a discussion about changing the default key length From 1024 bits to 2048, and am interested to know if this might cause any issues for people. puppet.conf(5) says that the keylength parameter defaults to 1024 bits for new RSA keys. There are many reasons why 1024