Skip to content

Commit 58fe946

Browse files
sybrenstuvelsybrenstuvel
committed
More documentation about key size and OpenSSL compatibility
1 parent dbea213 commit 58fe946

4 files changed

Lines changed: 55 additions & 23 deletions

File tree

‎doc/compatibility.rst‎

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -27,24 +27,25 @@ Public keys:
2727
:ref:`VARBLOCK <bigfiles>` encryption:
2828
Python-RSA only, not compatible with any other known application.
2929

30+
.. _openssl:
3031

31-
Public keys from OpenSSL
32+
Interoperability with OpenSSL
3233
--------------------------------------------------
3334

35+
You can create a 512-bit RSA key in OpenSSL as follows::
36+
37+
openssl genrsa -out myprivatekey.pem 512
38+
3439
To get a Python-RSA-compatible public key from OpenSSL, you need the
35-
private key. Get the private key in PEM or DER format and run it
36-
through the ``pyrsa-priv2pub`` command::
37-
38-
39-
Usage: pyrsa-priv2pub [options]
40-
41-
Reads a private key and outputs the corresponding public key. Both
42-
private and public keys use the format described in PKCS#1 v1.5
43-
44-
Options:
45-
-h, --help show this help message and exit
46-
--in=INFILENAME Input filename. Reads from stdin if not specified
47-
--out=OUTFILENAME Output filename. Writes to stdout of not specified
48-
--inform=INFORM key format of input - default PEM
49-
--outform=OUTFORM key format of output - default PEM
40+
private key first, then run it through the ``pyrsa-priv2pub``
41+
command::
42+
43+
pyrsa-priv2pub -i myprivatekey.pem -o mypublickey.pem
44+
45+
Encryption and decryption is also compatible::
46+
47+
$ echo hello there > testfile.txt
48+
$ pyrsa-encrypt -i testfile.txt -o testfile.rsa publickey.pem
49+
$ openssl rsautl -in testfile.rsa -inkey privatekey.pem -decrypt
50+
hello there
5051

‎doc/usage.rst‎

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,9 @@ encrypt. If you don't mind having a slightly smaller key than you
4444
requested, you can pass ``accurate=False`` to speed up the key
4545
generation process.
4646

47-
These are some timings from my netbook (Linux 2.6, 1.6 GHz Intel Atom
48-
N270 CPU, 2 GB RAM):
47+
These are some average timings from my netbook (Linux 2.6, 1.6 GHz
48+
Intel Atom N270 CPU, 2 GB RAM). Since key generation is a random
49+
process, times may differ.
4950

5051
+----------------+------------------+
5152
| Keysize (bits) | Time to generate |
@@ -69,6 +70,36 @@ N270 CPU, 2 GB RAM):
6970
| 2048 | 132.97 sec. |
7071
+----------------+------------------+
7172

73+
If key generation is too slow for you, you could use OpenSSL to
74+
generate them for you, then load them in your Python code. See
75+
:ref:`openssl` for more information.
76+
77+
Key size requirements
78+
--------------------------------------------------
79+
80+
Python-RSA version 3.0 introduced PKCS#1-style random padding. This
81+
means that 11 bytes (88 bits) of your key are no longer usable for
82+
encryption, so keys smaller than this are unusable. The larger the
83+
key, the higher the security.
84+
85+
Creating signatures also requires a key of a certain size, depending
86+
on the used hash method:
87+
88+
+-------------+-----------------------------------+
89+
| Hash method | Suggested minimum key size (bits) |
90+
+=============+===================================+
91+
| MD5 | 360 |
92+
+-------------+-----------------------------------+
93+
| SHA-1 | 368 |
94+
+-------------+-----------------------------------+
95+
| SHA-256 | 496 |
96+
+-------------+-----------------------------------+
97+
| SHA-384 | 624 |
98+
+-------------+-----------------------------------+
99+
| SHA-512 | 752 |
100+
+-------------+-----------------------------------+
101+
102+
72103

73104
Encryption and decryption
74105
--------------------------------------------------

‎rsa/cli.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ def keygen():
4141
'not saved if this option is not present. You can use '
4242
'pyrsa-priv2pub to create the public key file later.')
4343

44-
parser.add_option('--out', type='string',
44+
parser.add_option('-o', '--out', type='string',
4545
help='Output filename for the private key. The key is '
4646
'written to stdout if this option is not present.')
4747

@@ -142,10 +142,10 @@ def parse_cli(self):
142142

143143
parser = OptionParser(usage=self.usage, description=self.description)
144144

145-
parser.add_option('--input', type='string', help=self.input_help)
145+
parser.add_option('-i', '--input', type='string', help=self.input_help)
146146

147147
if self.has_output:
148-
parser.add_option('--output', type='string', help=self.output_help)
148+
parser.add_option('-o', '--output', type='string', help=self.output_help)
149149

150150
parser.add_option('--keyform',
151151
help='Key format of the %s key - default PEM' % self.keyname,

‎rsa/util.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,9 @@ def private_to_public():
3030
'corresponding public key. Both private and public keys use '
3131
'the format described in PKCS#1 v1.5')
3232

33-
parser.add_option('--in', dest='infilename', type='string',
33+
parser.add_option('-i', '--input', dest='infilename', type='string',
3434
help='Input filename. Reads from stdin if not specified')
35-
parser.add_option('--out', dest='outfilename', type='string',
35+
parser.add_option('-o', '--output', dest='outfilename', type='string',
3636
help='Output filename. Writes to stdout of not specified')
3737

3838
parser.add_option('--inform', dest='inform',

0 commit comments

Comments
 (0)