Skip to content

fix: check priv_key_bits only for relevant private key types #19103

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

joostdebruijn
Copy link

Description

php_openssl_generate_private_key currently applies the MIN_KEY_LENGTH (384 bits) check across all key types, including EC (Elliptic Curve) keys. However, for EC key generation, the private_key_bits parameter is not relevant—the security of EC keys is determined by the selected curve, not the bit length. As a result, applying this check to EC keys can cause developer confusion. For reference, see related discussions:

Solution

This PR updates php_openssl_generate_private_key to enforce the MIN_KEY_LENGTH check only for key types where the priv_key_bits parameter is meaningful—specifically RSA, DSA, and DH keys.

Additional Notes

  • As a side note, the current MIN_KEY_LENGTH of 384 bits for RSA, DSA, and DH keys is not considered secure by modern standards. Ideally, this minimum should be raised (e.g., to 2048 bits for RSA), or the check reconsidered entirely.
  • Regarding branch targets: The contribution guide suggests targeting the PHP-8.3 branch for bug fixes (as this is the lowest actively supported version). However, for extension changes, this branch lacks the involved source files. Please advise if a different branch is preferred for this PR.

@joostdebruijn joostdebruijn force-pushed the fix/openssl-check-type-for-bits branch from badf620 to bf267a5 Compare July 13, 2025 14:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant