On Wed, Jun 3, 2020 at 5:04 PM Christian Heimes <cheimes@redhat.com> wrote:
On 02/06/2020 19.57, Natxo Asenjo via FreeIPA-users wrote:
> hi,
>
> We have a new realm with rhel 7.8 and a default CA key of 2048 bits.
>
> Recently a question arose to upgrade this to 4096 bits.


Is there any particular reason you want a 4096 bit RSA certificate and
not a 3072 bit RSA certificate? For RSA 4096 is a odd and unusual number
that does not fit in with the security profile of AES and SHA. RSA
becomes a LOT slower but only a bit more secure with larger key sizes.

company policies. I am arguing this at this point, so this could vary.

NIST and IPA team recommends 3072 bit RSA keys because they have an
equivalent strength as AES-128 or SHA2-256.

interesting to know, thanks. I will use this point as well in the internal discussion.

--
regards,
natxo



--
--
Groeten,
natxo