check-keysize.sh (1638B)
1 #!/bin/sh 2 # mk/check-keysize.sh - enforce 4096-bit minimum for RSA signing keys. 3 # 4 # ./mk/check-keysize.sh <pubkey-or-privkey> [minbits] 5 # ./mk/check-keysize.sh --check <pubkey> # for conductor allowlist insert 6 # 7 # Used by the conductor admin API and by mk/keymgmt.sh new (defence in depth). 8 # Rejects keys < 4096 bits; accepts >= 4096. 9 set -eu 10 11 MINBITS="${2:-4096}" 12 KEY="${1:-}" 13 14 if [ "${KEY}" = "--check" ]; then 15 KEY="${2:-}" 16 MINBITS="${3:-4096}" 17 fi 18 19 [ -n "${KEY}" ] || { echo "usage: check-keysize.sh <keyfile> [minbits]" >&2; exit 1; } 20 [ -f "${KEY}" ] || { echo "check-keysize.sh: not found: ${KEY}" >&2; exit 1; } 21 22 # Detect whether this is a private or public key by trying both. 23 bits="" 24 if openssl rsa -in "${KEY}" -text -noout 2>/dev/null | grep -q "Private-Key"; then 25 bits=$(openssl rsa -in "${KEY}" -text -noout 2>/dev/null | sed -n 's/.*Private-Key: (\([0-9]*\) bit.*/\1/p' | head -1) 26 elif openssl rsa -pubin -in "${KEY}" -text -noout 2>/dev/null | grep -q "Public-Key"; then 27 bits=$(openssl rsa -pubin -in "${KEY}" -text -noout 2>/dev/null | sed -n 's/.*Public-Key: (\([0-9]*\) bit.*/\1/p' | head -1) 28 else 29 # Try pkey (handles both) 30 bits=$(openssl pkey -in "${KEY}" -text -noout 2>/dev/null | sed -n 's/.*Private-Key: (\([0-9]*\) bit.*/\1/p; s/.*Public-Key: (\([0-9]*\) bit.*/\1/p' | head -1) 31 fi 32 33 if [ -z "${bits}" ]; then 34 echo "check-keysize.sh: could not determine key size for ${KEY}" >&2 35 exit 1 36 fi 37 38 if [ "${bits}" -lt "${MINBITS}" ]; then 39 echo "check-keysize.sh: key too small: ${bits} bits < ${MINBITS} minimum: ${KEY}" >&2 40 exit 1 41 fi 42 43 echo "check-keysize.sh: OK ${bits} bits >= ${MINBITS}: ${KEY}"