STRENGTH.CONF(5)

💖 STRENGTH.CONF 💖

okay bestie, welcome to strength.conf — the openCryptoki strength configuration file, and honestly? she's lowkey the vibe-setter for how strong your keys are allowed to be. let's get into it ✨

---

🌸 NAME 🌸

strength.conf — the configuration file for openCryptoki strength configuration. that's it, that's the girl 💅

---

🦋 DESCRIPTION 🦋

so openCryptoki reads a strength config file living at /etc/opencryptoki/strength.conf — that's her home address, no cap 🏠

this file is literally how you, the user, get to configure how openCryptoki decides cryptographic key strength based on key attributes. and heads up: this file is required by openCryptoki. not optional, not "eh maybe later". required. periodt.

---

✨ SYNTAX ✨

okay so the file always opens with a version spec, and it looks like this:

version strength-0

after that lil intro, you get the definitions of all your various strengths. main character energy fr fr.

each strength definition is made of three things: a strength, brackets, and key-value pairs. like so:

strength number
{
    ...
}

the numbers you're allowed to use are 112, 128, 192, and 256 — those represent the corresponding strength in bits. cute, right? 🎀

note: these definitions are optional! if a definition is missing, no key can have that strength. and if no strength definition is present at all? every single key gets strength 0. yeah. zero. 💀

you can stack more than one key-value pair inside a strength description, no problem.

a key-value pair looks like keyword = value, where value is an unsigned number.

here's every keyword that's valid, bestie:

• MOD_EXP — sets the minimum number of bits required for RSA moduli, and DH and DSA primes, so that the corresponding key counts as the currently defined strength.

note: optional. if it's not there, no RSA, DH, or DSA key can have the currently defined strength. 🙈

• ECC — sets the minimum number of bits in the prime field of the elliptic curve, so the corresponding key counts as the currently defined strength.

note: optional. if it's not there, no EC key can have the currently defined strength.

• SYMMETRIC — sets the minimum number of bits required for symmetric keys, so the corresponding key counts as the currently defined strength.

note: optional. if it's not there, no symmetric key can have the currently defined strength.

• digest — sets the minimum size in bits of digest outputs required by the currently defined strength.

note: optional. if it's not there, this strength definition simply doesn't constrain the size of digests. she's unbothered 💅

• signature — sets the minimum size in bits of signatures required by the currently defined strength.

note: optional. if it's not there, this strength definition doesn't constrain the size of signatures either.

---

🌈 NOTES 🌈

okay this part matters, so listen up:

the strength configuration file has to be owned by root:pkcs11, have mode 0640, and be parsable. otherwise? openCryptoki will hit you with CKR_FUNCTION_FAILED on C_Initialize and log a corresponding message to syslog detailing exactly why the strength configuration couldn't be used. in that case, fix the problem described in syslog so you can use openCryptoki again. no shortcuts, bestie 😭

the pound sign ('#') is your comment character. both the comment character and any text after it, all the way to the end of the line, get ignored. and she's flexible: you can drop that comment character at the beginning of a line (including before the file version specification), after a value, and before and after the braces. iconic behaviour honestly 👑

---

🫶 SEE ALSO 🫶

• strength.conf(5)
• opencryptoki(7)
• /usr/share/doc/opencryptoki/strength-example.conf

---

and that's the whole page, babe 💜 this was openCryptoki 3.27.0, dated September 2021 — go forth and configure your strengths, you absolute legend 🎀✨