RSA keys should be at least 2,048 bits

Docs > Plateforme de sécurité Datadog > Code Security > Static Code Analysis (SAST) > Règles SAST > RSA keys should be at least 2,048 bits

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

ID: rust-security/rsa-key-too-short

Language: Rust

Severity: Warning

Category: Security

CWE: 326

Related CWEs:

Description

RSA keys shorter than 2,048 bits can be factored with modern hardware and cloud-scale compute, exposing encrypted data and signatures to recovery or forgery. NIST SP 800-57 recommends a minimum of 2,048 bits, with 3,072 or 4,096 bits preferred for data with long-term secrecy requirements. The min-length argument can be raised above the 2,048-bit default to enforce a stricter threshold. Values below 2,048 are clamped to the NIST minimum.

Learn More

CWE-326: Inadequate Encryption Strength

Arguments

min-length: Minimum length of the RSA key. Default: 2048.

Non-Compliant Code Examples

use rsa::RsaPrivateKey;
use openssl::rsa::Rsa;
use rand::rngs::OsRng;

fn bad() -> Result<(), Box<dyn std::error::Error>> {
    let mut rng = OsRng;

    // `rsa` crate — classic too-short key
    let _ = RsaPrivateKey::new(&mut rng, 1024)?;

    // Fully qualified path
    let _ = rsa::RsaPrivateKey::new(&mut rng, 1024)?;

    // Digit separator below threshold
    let _ = RsaPrivateKey::new(&mut rng, 1_024)?;

    // Type-suffixed literal below threshold
    let _ = RsaPrivateKey::new(&mut rng, 1024usize)?;

    // new_with_exp also flagged
    let exp = rsa::BoxedUint::from(65537u64);
    let _ = rsa::RsaPrivateKey::new_with_exp(&mut rng, 1024, exp)?;

    // `openssl` crate
    let _ = Rsa::generate(1024)?;

    Ok(())
}

Compliant Code Examples

use rsa::RsaPrivateKey;
use openssl::rsa::Rsa;
use rand::rngs::OsRng;

fn ok() -> Result<(), Box<dyn std::error::Error>> {
    let mut rng = OsRng;

    // `rsa` crate at the minimum
    let _ = RsaPrivateKey::new(&mut rng, 2048)?;

    // Digit separator and type suffix — both >= 2048
    let _ = RsaPrivateKey::new(&mut rng, 2_048)?;
    let _ = RsaPrivateKey::new(&mut rng, 4096usize)?;

    // Fully qualified path
    let _ = rsa::RsaPrivateKey::new(&mut rng, 2048)?;

    // new_with_exp with sufficient bits
    let exp = rsa::BoxedUint::from(65537u64);
    let _ = rsa::RsaPrivateKey::new_with_exp(&mut rng, 2048, exp)?;

    // `openssl` crate at or above the minimum
    let _ = Rsa::generate(2048)?;
    let _ = openssl::rsa::Rsa::generate(4096)?;

    Ok(())
}