On 02/06/2020 19.57, Natxo Asenjo via FreeIPA-users wrote:
hi,
We have a new realm with rhel 7.8 and a default CA key of 2048 bits.
Recently a question arose to upgrade this to 4096 bits.
Is there any particular reason you want a 4096 bit RSA certificate and
not a 3072 bit RSA certificate? For RSA 4096 is a odd and unusual number
that does not fit in with the security profile of AES and SHA. RSA
becomes a LOT slower but only a bit more secure with larger key sizes.
NIST and IPA team recommends 3072 bit RSA keys because they have an
equivalent strength as AES-128 or SHA2-256.
Christian
--
Christian Heimes
Principal Software Engineer, Identity Management and Platform Security
Red Hat GmbH,
http://www.de.redhat.com/, Registered seat: Grasbrunn,
Commercial register: Amtsgericht Muenchen, HRB 153243,
Managing Directors: Charles Cachera, Laurie Krebs, Michael O'Neill,
Thomas Savage