Weak RSA key size (ARCH2117)

Key python.security.weak-rsa-key-size · Severity warning · Category security · CWE CWE-326

RSA/DSA keys below 2048 bits are no longer considered secure and are open to factoring. Generate keys of at least 2048 bits, preferably 3072.

Incorrect

from cryptography.hazmat.primitives.asymmetric import rsa

def make_key():
    return rsa.generate_private_key(public_exponent=65537, key_size=1024)

Correct

from cryptography.hazmat.primitives.asymmetric import rsa

def make_key():
    return rsa.generate_private_key(public_exponent=65537, key_size=3072)

Fix

Generate RSA keys of at least 2048 bits (preferably 3072 bits).