certificate-signer service - Key generation

[maheshkumargangula]

@dileepbapat - Please point us to the documentation on how to generate the keys to use in certificate-signer service for signing.

RSA and ED25519 keys are supported in the certificate-signer service? Also, please provide the details about any specific configuration to be done for any specific signing key type.

Cc: @vrayulu

[dileepbapat]

for RSA

openssl genrsa -out key.pem; cat key.pem;
openssl rsa -in key.pem -pubout -out pubkey.pem;
cat pubkey.pem; rm key.pem pubkey.pem

For ED25519

import {Ed25519VerificationKey2018} from '@digitalbazaar/ed25519-verification-key-2018';

const edKeyPair = await Ed25519VerificationKey2018.generate();

[gandham-santhosh]

@dileepbapat does certificate-signer service works with both RSA and ED25519?
Is there any variable we need to set to specify the signing algorithm?
Also, is there a recommended key size for RSA type? We are thinking of creating key with length 4096. Please suggest

[dileepbapat]

environment variable SIGNING_KEY_TYPE = "RSA" | "ED25519"

4k key size should be fine. Edit: there is an issue with 4k, 2k bitsize is working.

[gandham-santhosh]

Thanks @dileepbapat

[dileepbapat]

For newer implementations consider using EC based ED25519 since it also reduces payload with similar security strength.

[pramodkvarma]

Please make sure signing options are configurable. For example, IT Act in India still hasn't fully endorsed ED as far as I know. So, adopters should be able to configure the signature algorithm.