I don't feel strongly about where the check is, FWIW.


On Mon, Feb 10, 2014 at 1:21 PM, Paul Kehrer <notifications@github.com>wrote:

> In cryptography/hazmat/backends/openssl/backend.py:
>
> > @@ -259,6 +261,43 @@ def _handle_error_code(self, code):
> >              )
> >          )
> >
> > +    def _bn_to_int(self, bn):
> > +        hex_cdata = self._lib.BN_bn2hex(bn)
> > +        assert hex_cdata != self._ffi.NULL
> > +        hex_str = self._ffi.string(hex_cdata)
> > +        self._lib.OPENSSL_free(hex_cdata)
> > +        return int(hex_str, 16)
> > +
> > +    def generate_rsa_private_key(self, public_exponent, key_size):
>
> Interesting question. I think we should keep checks in the backend to
> prevent the user from passing parameters that can cause the underlying
> library to hang/crash, so some checks on the public_exponent are needed
> (OpenSSL will hang forever trying to generate if you pass an even
> public_exponent). Of course, it can also die with very small key sizes (or
> very large) so we may need backend specific logic there?
>
> @public <https://github.com/public>, opinions? I remember you originally
> advocated in IRC for any minimum being enforced in the backends rather than
> up in #582 <https://github.com/pyca/cryptography/pull/582>.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/pyca/cryptography/pull/580/files#r9602351>
> .
>



-- 
"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: 125F 5C67 DFE9 4084