On Tue, Jun 8, 2021 at 1:00 PM ben edmunds <tigger20...@gmail.com> wrote: > By not showing this to the user to avoid confusion we actually would > create confusion in this scenario as the kernel module is performing the > clamping but the user would have no knowledge of this and leads to > issues being opened that are a non issue. The aim is not to show the > users anything about clamping unless the key needs to be clamped as it > was not clamped already.
I think you are making a mistake, and introducing users to the concept of clamping will just breed confusion. > I belive it is key to remember that pfSense is not an end user > application/tool and designed to be used by admins & network engineers You made that same point on some Github bug report; it's not news to me, and it still doesn't change my point of view. Introducing excessive complexity and superfluous technical information results in problematic decisions, configurations, and decision calculuses, even for the most powerful of power users. In particular, here, I think it's only going to sow confusion and bad information to expose users to contingent details about "valid private keys" and "less valid private keys" with weird nerdy language like "unclamped". Because the fact is, any 256-bit bitstring generated from a csprng is a fine private key.