9a39eaa237
Use smaller and safer EC keys, replacing 2048 bit RSA. NID_X9_62_prime256v1 is roughly as secure as a 3072 bit RSA key, but way shorter. Since we have to embed the key in the identity packet that is sent over UDP and some stacks aren't happy with large UDP messages (notably: macos), I switched to EC instead of to a longer RSA key. This seems to be compatible with other clients even on older systems like Android 5.0. I did stick with NID_X9_62_prime256v1 because stronger EC like NID_secp384r1 failed the handshake (I didn't investigate why). We now store the kind of key in the config, so we can know which kind of key we are loading.
21 lines
472 B
C++
21 lines
472 B
C++
/**
|
|
* SPDX-FileCopyrightText: 2023 Albert Vaca <albertvaka@gmail.com>
|
|
*
|
|
* SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only OR LicenseRef-KDE-Accepted-GPL
|
|
*/
|
|
|
|
#ifndef SSLHELPER_H
|
|
#define SSLHELPER_H
|
|
|
|
#include <QSslCertificate>
|
|
#include <QSslKey>
|
|
#include <QString>
|
|
|
|
namespace SslHelper
|
|
{
|
|
QSslKey generateEcPrivateKey();
|
|
QSslKey generateRsaPrivateKey();
|
|
QSslCertificate generateSelfSignedCertificate(const QSslKey &privateKey, const QString &commonName);
|
|
}
|
|
|
|
#endif
|