8.9. Changes to RSA and DSA Key Generation

Normal Red Hat Enterprise Linux 6 operation allows the generation of RSA and DSA keys of any size. Additional restrictions are applied if Red Hat Enterprise Linux 6 is run in FIPS mode.

As of Red Hat Enterprise Linux 6.6, the OPENSSL_ENFORCE_MODULUS_BITS environment variable determines key generation behavior in FIPS mode.

When FIPS mode is in use and the OPENSSL_ENFORCE_MODULUS_BITS environment variable is set, only 2048 bit or 3072 bit RSA and DSA keys can be generated.

If the OPENSSL_ENFORCE_MODULUS_BITS environment variable is not set, key generation behavior does not change from previous releases of Red Hat Enterprise Linux 6: the system can generate RSA keys greater than or equal to 1024 bits, and DSA keys of 1024 bits, 2048 bits, or 3072 bits.