Weak RSA key size (ARCH7117)

Key php.security.weak-rsa-key-size · Severity warning · Category security · CWE CWE-326

RSA/DSA keys of 1024 bits or fewer are no longer considered secure and can be broken with reasonable resources. Keys should be generated at a minimum of 2048 bits, preferably 3072 bits or more.

Incorrect

<?php
$key = openssl_pkey_new([
    'private_key_bits' => 1024,
    'private_key_type' => OPENSSL_KEYTYPE_RSA,
]);

Correct

<?php
$key = openssl_pkey_new([
    'private_key_bits' => 3072,
    'private_key_type' => OPENSSL_KEYTYPE_RSA,
]);

Fix

Generate RSA/DSA keys at a minimum of 2048 bits, preferably 3072 bits or more.