Switch p256/rsa3072 to rsa4096 in oem-factory-reset
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 1.6k
- Forks
- 211
- Avg merge
- 4d 21h
- Merged PRs (30d)
- 6
Description
@daringer @JonathonHall-Purism what would justify having nk3 enforce somewhat hidden p256 defaults (unless DEBUG is on) for nk3 today?
What would justify keeping RSA 3072 key generation on USB Security dongle (All other non nk3 today, all USB Security dongle if we switch to RSA for all) where before that was justified by OEM needing to stay behind laptops while they were provisioning where today everything is fully automated there?
If the justification is that some older nk3 firmware cannot enforce secure element based RSA key gen, then logic of oem-factory reset should be refactored with firmware versions verification to enforce p256 only where RSA4096 cannot be enforced, no?
Thoughts?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Begin at the oem-factory-reset entry point and trace how p256, RSA3072, and RSA4096 choices are selected. Resolve the firmware-compatibility behavior discussed in the issue and verify that the resulting key-generation policy matches the supported firmware versions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cryptography
- Domain
- cryptography, embedded-iot, security
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100