Strength configuration file

For every used key, openCryptoki computes a strength value depending on the key type, and compares it to the strengths found in the applicable strength configuration file to decide whether to accept or refuse the key. The rules how key strengths are calculated are explained in Rules for key strength calculation.

version strength-<n>

version strength-0

Before and after this line, you can have as many empty lines or comment lines that start with a hash (#) sign.

strength <num> { <content> }

Valid keywords defining the key constraint policy are:

MOD_EXP

describes the minimal size in bits of the modulus used by RSA, DSA, and DH algorithms.

ECC

for an ECDSA/EdDSA or ECDH/EdDH algorithm it describes the minimal size in bits of the prime defining the Galois field over which the elliptic curve is defined.

SYMMETRIC

covers the minimal size of all symmetric keys. This includes GENERIC_SECRET, AES, and various HMAC keys.

Valid keywords defining the output length constraints are:

digest

provides the minimal length that a digest must have to be in this strength class.

signature

provides the minimal length that a signature or a message authentication code must have to be in this strength class.

If either of the MOD_EXP, ECC, or SYMMETRIC attributes are missing inside a strength definition, no key that would be compared against this attribute will have the corresponding strength. If either of the digest or signature attributes are missing, the output constraint represented by these attributes defaults to 0, thus effectively allowing all output sizes.

Example of a strength.conf configuration file

Have a look at a sample strength configuration file.

strength.conf file with NIST recommendations

Figure 1 provides a sample for a strength configuration file that is specifying NIST recommendations on key and algorithm strength. The indentation is optional but helpful to simplify the maintenance of the file. openCryptoki applies this configuration during installation from the source package, if a strength configuration file does not yet exist in the target folder.

# openCryptoki strength example corresponding to NIST recommendations
# See https://www.keylength.com/en/4/ 

version strength-0
strength 112 {
         MOD_EXP = 2048
         ECC = 224
         SYMMETRIC = 112
         digest = 224
         signature = 112
}
strength 128 {
         MOD_EXP = 3072
         ECC = 256
         SYMMETRIC = 128
         digest = 256
         signature = 128
}
strength 192 {
         MOD_EXP = 7680    
         ECC = 384
         SYMMETRIC = 192
         digest = 384
         signature = 192
}
strength 256 {
         MOD_EXP = 15360
         ECC = 512
         SYMMETRIC = 256
         digest = 512
         signature = 256
}

Rules for key strength calculation

openCryptoki retrieves certain attributes of a key depending on the key type. The found value is compared against the definitions in the strength configuration file and thus the resulting strength is found. The rules in the policy configuration file finally decide whether the key is accepted or refused by the openCryptoki application. Therefore, you need to know the calculation rules to understand why a key may be refused, so that you can change your strength definition accordingly.

The strength of a key is calculated during key or key pair generation, key derivation, and key loading, by comparing key attributes (for example, its modular exponent for RSA keys) with the values defined in the strength configuration. This key strength is held in memory together with the key object. The policies in the policy configuration file decide whether a key with the calculated strength is allowed for the application.

Also the expected signature size when using this key is calculated and held in memory with the key. This size is used to check if the key is allowed in a sign or verify operation by the policy.

Additionally, a flag used by policies to mark ECC keys as usable is held in memory.

Shortly spoken, the key strength computation is based on the key attributes, especially its key type. The value of the highest matching strength definition from the strength configuration file is used as strength.

RSA

For keys of type CKK_RSA, the length of CKA_MODULUS multiplied by 8 is compared to the setting of the MOD_EXP property of the configurations.

DH and DSA

For keys of type CKK_DH, CKK_DSA, or CKK_X9_42_DH, the length of CKK_PRIME multiplied by 8 is compared against the MOD_EXP property of the configurations.

EC (including Edwards and Montgomery)

Based on the curve type specified in CKK_EC_PARAMS, the size of the elliptic curve is determined. This size is compared against the ECC property of the configurations.

DES

The base strength of DES keys is fixed. Keys of type CKK_DES2 have 80 bits and keys of type CKK_DES3 have 112 bits of base strength. The base value is then compared against the SYMMETRIC property of the configurations.

AES and GENERIC_SECRET

For keys of type CKK_AES, CKK_AES_XTS, or CKK_GENERIC_SECRET, a base strength is computed by multiplying CKA_VALUE_LEN with 8, for CKK_AES_XTS keys: CKA_VALUE_LEN * 8/2. The base value is then compared against the SYMMETRIC property of the configurations.

Post-quantum algorithms (Dilithium and Kyber)

The strength of dilithium and kyber keys is always set to 256.

Similarly to the strength determination based on attributes, for key types CKK_RSA, CKK_DSA and CKK_ECC, a signature size is computed that would be achieved with this key. This signature size is also held in memory within the key object. This size is used to check if the key is allowed in a sign or verify operation by the policy.