Key Validators

Key Validators validate the quality of keys, foremost as a result of incoming CSRs. The following covers the different types of Key Validators, RSA Key Validator, ECC Key Validator, and Blacklist Key Validator, and also lists common Key Validator settings.

Key Validator Types

RSA Key Validator

The RSA Key Validator inspects RSA key parameters and validates key quality beyond key length and size. This key validator can enforce the CA/B-Forum requirements on public keys, and also performs the following tests on the RSA exponent and modulus:

• That the value of the public exponent is an odd number equal to 3 or more.
• That the public exponent is in the range between 2^16+1 and 2^256-1.
• That the modulus is an odd number, not the power of a prime, and have no factors smaller than 752.

ECC Key Validator

The ECC Key validator inspects the full public key validation (NIST SP 56A) routine on ECC keys.

Blacklist Key Validator

This validator compares public keys against a blacklist of known bad public keys, such as weak Debian keys.

The blacklist is empty by default and must be filled manually.

The public key blacklisted entries can be added using the CLI:

bin/ejbca.sh ca updatepublickeyblacklist add <directory of blacklisted public keys>		

where the directory contains public key files in PEM format. If you have a list of PEM formatted private keys, you can create the public key entries, and CSRs to test with using these commands:

openssl req -key blacklisted-privatekey.pem -out blacklisted.csr -new
openssl rsa -in blacklisted-privatekey.pem -pubout > tmp/blacklisted-publickey.pem

You can import a blacklist fingerprint file (a file with one blacklist fingerprint per line) with:

bin/ejbca.sh ca updatepublickeyblacklist add <directory where blacklist fingerprint file resides> --mode fingerprint			

Fingerprints are:

• RSA keys, the SHA-256 hash of the RSA key modulus bytes (ignoring the fixed value e).
• ECDSA keys, the SHA-256 hash of the binary public key encoding (SubjectPublicKeyInfo).

To import one of the lists of weak Debian keys provided by the Debian maintainers, use --mode debianfingerprint.

bin/ejbca.sh ca updatepublickeyblacklist add <directory where debian blacklists reside> --mode debianfingerprint

You can also remove fingerprints using the fingerprint file:

bin/ejbca.sh ca updatepublickeyblacklist remove <directory where blacklist fingerprint file resides> --mode fingerprint

For more information on Debian weak key checks, see Post Processing Validators.

Common Key Validator Settings