martes, 20 de agosto de 2013

Adiós a las claves de 1024 bits

Me entero a través de varios medios que la industria eliminará el uso de claves RSA de 1024 bits, y pasarán a usar por defecto 2048 bits. Mucha gente tiene sus dudas y por eso han decidido usar más de 2048 bits. Un caso práctico sería cifrar los correos que tenemos almacenados en servidores ajenos, como GMail y que estarán almacenados por muchos años, sin olvidarnos de las grandes bases de datos que tienen los gobiernos por todos lados con copias de nuestras cosas personales.

What you need to know to migrate from 1024-bit to 2048-bit encryption

I hope by now that you are aware that the Certificate Authority/Browser Forum has mandated that Certificate Authorities stop supporting 1024-bit key length RSA certificates for both SSL and code signing by the end of this year (2013). To learn more about these changes please read the CA/Browser Forum's paper on the Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates.

What do you need to do?

Any Symantec customers with certificates expiring this year (2013) will need to renew by generating a Certificate Signing Request (CSR) of 2048 bits or higher. Any Symantec customers with certificates expiring in 2014 or later will need to replace and upgrade all 1024-bit certificates with 2048-bit RSA/DSA or 256-bit ECC certificates by 1st October 2013. All existing 1024-bit certificates will be discontinued industry-wide in the new year (2014). This is in compliance with NIST Special Publication 800-131A you can read more about the changes here

To make this transition as easy as possible here are a few helpful resources:

Check your certificate's encryption strength

How to generate a new CSR

We have several tutorials that show you how to generate a CSR:

You can check and validate your CSR using this tool

How to Install a Certificate

We have several tutorials that show you how to install a SSL Certificate:

If you have a Microsoft IIS 6.0 or 7.0 server running .NET 2.0 or higher, or a Red Hat servers our SSL Assistant will help you automatically generate your new 2048-bit CSR and later install it

Additional Resources

FAQ: Ending support for 1024-bit certificates

Support: Get technical support for 1024-bit transition

http://barrapunto.com/articles/13/08/20/1036239.shtml

http://www.symantec.com/connect/blogs/what-you-need-know-migrate-1024-bit-2048-bit-encryption