does gpg cope with very large key sizes

[Philippe Cerfon]

Hi list and GnuPG developers!


Let me introduce myself,... I'm Philippe Cerfon and I'm currently taking
some crypto-lectures... including all that fancy algorithms and so on ;-)
Out of curiosity I was starting some test series on how key creation time
and encryption/signing time relates to key sizes.
I soon found out that gpg puts a limit on keys at 4096 bits which is surely
reasonable for real world but somewhat disturbing my test.

I was looking into the gnupg mailing list archives and found out that gpg is
said to be able to work with larger keys. I've also seen that this topic is
well somewhat critical, so to say it in advance,.. this only for trying and
playing :)

So I grepped the sources (for both version 1.x and 2.x) and found that the
limit is enfored here:
g10/keygen.c:  unsigned nbits, min, def=2048, max=4096;

With version 2.x probably in some other places, too:
g10/app-openpgp.c:      max_length = 4096;
scd/app-openpgp.c:      max_length = 4096;
scd/command.c:#define MAXLEN_KEYDATA 4096
tools/gpgkey2ssh.c:      max_length = 4096;
tools/gpgconf-comp.c:#define BUF_LEN 4096
but I think they're unrelated to key creation/use.

So all I must to is e.g. set max = 65536 or even something higher ;-)
Right so far?

I've seen many other places where some buffers or other this are set to 4096
(see attachments):
So my questions now are:
- Is it done with changing the max or would I have to change some other
places too in order to make everything work correctly (e.g. these
max_length's or so)?
- Are the generated keys (or their signatures) actually sane? I mean I could
imagine that at some point randomness gets just worse, or some buffers cap
the key entropy or whatever.
- Or is in everything ok,.. and there's just this max=something in
g10/keygen.c where you save users from shooting into their feets by creating
to large keys but nothing else?

You know, my time measurements might be simply bogus as gpg stops producing
valuable key bits after some limit,.. or the measurements might be useless
as these keys were no longer secure (even less than normal keys) anyway...


Thanks and au revoir,
Philippe.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </pipermail/attachments/20090910/7aedb458/attachment.htm>