From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Fri, 28 May 2010 19:08:44 +0000 (+0200)
Subject: Added gnutls_sec_param_to_pk_bits() et al. to allow select bit
X-Git-Tag: gnutls_2_11_3~237
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=283485a418ca383e8c5fb170077e5a6e8afbfea2;p=thirdparty%2Fgnutls.git

Added gnutls_sec_param_to_pk_bits() et al. to allow select bit
sizes for private keys using a human understandable scale.
---

diff --git a/NEWS b/NEWS
index e23313c9ea..e6670fae78 100644
--- a/NEWS
+++ b/NEWS
@@ -26,6 +26,9 @@ PKCS #11 private keys.
 ** libgnutls: Added  gnutls_pkcs11_copy_x509_crt(), gnutls_pkcs11_copy_x509_privkey(),
 and gnutls_pkcs11_delete_url() to allow copying and deleting data in tokens.
 
+** libgnutls: Added gnutls_sec_param_to_pk_bits() et al. to allow select bit
+sizes for private keys using a human understandable scale.
+
 ** certtool: Added new options: --pkcs11-list-tokens, --pkcs11-list-all
 --pkcs11-list-all-certs, --pkcs11-list-trusted, --pkcs11-list-certs,
 --pkcs11-delete-url, --pkcs11-write
@@ -40,6 +43,9 @@ pkcs11:token=Root%20CA%20Certificates;serial=1%3AROOTS%3ADEFAULT;model=1%2E0;man
 gnutls_certificate_set_server_retrieve_function: DEPRECATED
 gnutls_certificate_set_client_retrieve_function: DEPRECATED
 gnutls_sign_callback_set: DEPRECATED
+gnutls_sec_param_to_pk_bits: ADDED
+gnutls_pk_bits_to_sec_param: ADDED
+gnutls_sec_param_get_name: ADDED
 gnutls_pkcs11_type_get_name: ADDED
 gnutls_certificate_set_retrieve_function: ADDED
 gnutls_pkcs11_init: ADDED
diff --git a/lib/gnutls_algorithms.c b/lib/gnutls_algorithms.c
index 1f7492aea0..891b2aa8a0 100644
--- a/lib/gnutls_algorithms.c
+++ b/lib/gnutls_algorithms.c
@@ -2326,3 +2326,118 @@ _gnutls_x509_pk_to_oid (gnutls_pk_algorithm_t algorithm)
   return ret;
 }
 
+/**
+ * gnutls_sec_param_to_pk_bits:
+ * @algo: is a public key algorithm
+ * @param: is a security parameter
+ *
+ * When generating private and public key pairs a difficult question
+ * is which size of "bits" the modulus will be in RSA and the group size
+ * in DSA. The easy answer is 1024, which is also wrong. This function
+ * will convert a human understandable security parameter to an
+ * appropriate size for the specific algorithm.
+ *
+ * Returns: The number of bits, or zero.
+ *
+ **/
+unsigned int gnutls_sec_param_to_pk_bits (gnutls_pk_algorithm_t algo,
+                                      gnutls_sec_param_t param)
+{
+
+  switch(algo)
+    {
+      case GNUTLS_PK_RSA:
+      case GNUTLS_PK_DSA:
+        switch(param)
+          {
+            case GNUTLS_SEC_PARAM_LOW:
+              return 1024;
+            case GNUTLS_SEC_PARAM_HIGH:
+              return 3072;
+            case GNUTLS_SEC_PARAM_ULTRA:
+              return 7680;
+            case GNUTLS_SEC_PARAM_NORMAL:
+            default:
+              return 2048;
+          }
+        default:
+          gnutls_assert();
+          return 0;
+    }
+
+}
+
+/**
+ * gnutls_sec_param_get_name:
+ * @param: is a security parameter
+ *
+ * Convert a #gnutls_sec_param_t value to a string.
+ *
+ * Returns: a pointer to a string that contains the name of the
+ *   specified public key algorithm, or %NULL.
+ *
+ **/
+const char *
+gnutls_sec_param_get_name (gnutls_sec_param_t param)
+{
+  const char *p;
+
+  switch (param)
+    {
+    case GNUTLS_SEC_PARAM_WEAK:
+      p = "Weak";
+      break;
+
+    case GNUTLS_SEC_PARAM_LOW:
+      p = "Low";
+      break;
+
+    case GNUTLS_SEC_PARAM_NORMAL:
+      p = "Normal";
+      break;
+
+    case GNUTLS_SEC_PARAM_HIGH:
+      p = "High";
+      break;
+
+    case GNUTLS_SEC_PARAM_ULTRA:
+      p = "Ultra";
+      break;
+
+    default:
+      p = "Unknown";
+      break;
+    }
+
+  return p;
+}
+
+/**
+ * gnutls_pk_bits_to_sec_param:
+ * @algo: is a public key algorithm
+ * @bits: is the number of bits
+ *
+ * This is the inverse of gnutls_sec_param_to_pk_bits(). Given an algorithm
+ * and the number of bits, it will return the security parameter. This is
+ * a rough indication.
+ *
+ * Returns: The security parameter.
+ *
+ **/
+gnutls_sec_param_t gnutls_pk_bits_to_sec_param (gnutls_pk_algorithm_t algo,
+                                      unsigned int bits)
+{
+
+  /* currently we ignore algo */
+  if (bits >= 7680)
+    return GNUTLS_SEC_PARAM_ULTRA;
+  else if (bits >= 3072)
+    return GNUTLS_SEC_PARAM_HIGH;
+  else if (bits >= 2048)
+    return GNUTLS_SEC_PARAM_NORMAL;
+  else if (bits >= 1024)
+    return GNUTLS_SEC_PARAM_LOW;
+  else
+    return GNUTLS_SEC_PARAM_WEAK;
+
+}
diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in
index df63cb8786..441b42850c 100644
--- a/lib/includes/gnutls/gnutls.h.in
+++ b/lib/includes/gnutls/gnutls.h.in
@@ -602,6 +602,28 @@ extern "C"
 
   const char *gnutls_sign_algorithm_get_name (gnutls_sign_algorithm_t sign);
 
+  /**
+   * gnutls_sec_param_t:
+   * @GNUTLS_SEC_PARAM_UNKNOWN: Cannot be known
+   * @GNUTLS_SEC_PARAM_WEAK: 50 or less bits of security
+   * @GNUTLS_SEC_PARAM_LOW: 80 bits of security
+   * @GNUTLS_SEC_PARAM_NORMAL: 112 bits of security
+   * @GNUTLS_SEC_PARAM_HIGH: 128 bits of security
+   * @GNUTLS_SEC_PARAM_ULTRA: 192 bits of security
+   *
+   * Enumeration of security parameters for passive attacks
+   */
+  typedef enum
+  {
+    GNUTLS_SEC_PARAM_UNKNOWN,
+    GNUTLS_SEC_PARAM_WEAK,
+    GNUTLS_SEC_PARAM_LOW,
+    GNUTLS_SEC_PARAM_NORMAL,
+    GNUTLS_SEC_PARAM_HIGH,
+    GNUTLS_SEC_PARAM_ULTRA,
+  } gnutls_sec_param_t;
+
+
 /* If you want to change this, then also change the define in
  * gnutls_int.h, and recompile.
  */
@@ -660,6 +682,12 @@ extern "C"
   int gnutls_alert_send_appropriate (gnutls_session_t session, int err);
   const char *gnutls_alert_get_name (gnutls_alert_description_t alert);
 
+  gnutls_sec_param_t gnutls_pk_bits_to_sec_param (gnutls_pk_algorithm_t algo,
+                                      unsigned int bits);
+  const char * gnutls_sec_param_get_name (gnutls_sec_param_t param);
+  unsigned int gnutls_sec_param_to_pk_bits (gnutls_pk_algorithm_t algo,
+                                      gnutls_sec_param_t param);
+
 /* get information on the current session */
   gnutls_cipher_algorithm_t gnutls_cipher_get (gnutls_session_t session);
   gnutls_kx_algorithm_t gnutls_kx_get (gnutls_session_t session);
diff --git a/lib/libgnutls.map b/lib/libgnutls.map
index 2acda43b54..1baa463e64 100644
--- a/lib/libgnutls.map
+++ b/lib/libgnutls.map
@@ -671,6 +671,10 @@ GNUTLS_2_11
 	gnutls_pkcs11_copy_x509_crt;
 	gnutls_pkcs11_copy_x509_privkey;
 	gnutls_pkcs11_delete_url;
+
+	gnutls_sec_param_to_pk_bits;
+	gnutls_sec_param_get_name;
+	gnutls_pk_bits_to_sec_param;
 } GNUTLS_2_10;
 
 GNUTLS_PRIVATE {
diff --git a/lib/openpgp/output.c b/lib/openpgp/output.c
index 982a6a6662..20d2855aa2 100644
--- a/lib/openpgp/output.c
+++ b/lib/openpgp/output.c
@@ -237,6 +237,8 @@ print_key_info (gnutls_string * str, gnutls_openpgp_crt_t cert, int idx)
 	name = _("unknown");
 
       addf (str, _("\tPublic Key Algorithm: %s\n"), name);
+      addf (str, _("\tKey Security Level: %s\n"), gnutls_sec_param_get_name(gnutls_pk_bits_to_sec_param(err, bits)));
+
       switch (err)
 	{
 	case GNUTLS_PK_RSA:
diff --git a/lib/x509/output.c b/lib/x509/output.c
index f4ea366895..126b88c483 100644
--- a/lib/x509/output.c
+++ b/lib/x509/output.c
@@ -1096,6 +1096,8 @@ print_cert (gnutls_string * str, gnutls_x509_crt_t cert, int notsigned)
 	  name = _("unknown");
 
 	addf (str, _("\tSubject Public Key Algorithm: %s\n"), name);
+	addf (str, _("\tCertificate Security Level: %s\n"), gnutls_sec_param_get_name(gnutls_pk_bits_to_sec_param(err, bits)));
+
 #ifdef ENABLE_PKI
 	switch (err)
 	  {
diff --git a/lib/x509/privkey.c b/lib/x509/privkey.c
index dbc3dbc222..6ef1ad248c 100644
--- a/lib/x509/privkey.c
+++ b/lib/x509/privkey.c
@@ -1402,6 +1402,8 @@ cleanup:
  * This function will generate a random private key. Note that this
  * function must be called on an empty private key.
  *
+ * Do not set the number of bits directly, use gnutls_sec_param_to_pk_bits().
+ *
  * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
  *   negative error value.
  **/
diff --git a/src/certtool-gaa.c b/src/certtool-gaa.c
index fae02faa53..c8c761c69e 100644
--- a/src/certtool-gaa.c
+++ b/src/certtool-gaa.c
@@ -172,6 +172,7 @@ void gaa_help(void)
 	__gaa_helpsingle(0, "outder", "", "Use DER format for output certificates and private keys.");
 	__gaa_helpsingle(0, "outraw", "", "Use RAW/DER format for output certificates and private keys.");
 	__gaa_helpsingle(0, "bits", "BITS ", "specify the number of bits for key generation.");
+	__gaa_helpsingle(0, "sec-param", "PARAM ", "specify the security level [low|normal|high|ultra].");
 	__gaa_helpsingle(0, "disable-quick-random", "", "Use /dev/random for key generationg, thus increasing the quality of randomness used.");
 	__gaa_helpsingle(0, "outfile", "FILE ", "Output file.");
 	__gaa_helpsingle(0, "infile", "FILE ", "Input file.");
@@ -205,28 +206,30 @@ typedef struct _gaainfo gaainfo;
 
 struct _gaainfo
 {
-#line 156 "certtool.gaa"
+#line 159 "certtool.gaa"
 	int debug;
-#line 151 "certtool.gaa"
+#line 154 "certtool.gaa"
 	int pkcs11_trusted;
-#line 148 "certtool.gaa"
+#line 151 "certtool.gaa"
 	char* pkcs11_label;
-#line 141 "certtool.gaa"
+#line 144 "certtool.gaa"
 	int pkcs11_type;
-#line 138 "certtool.gaa"
+#line 141 "certtool.gaa"
 	char* pkcs11_url;
-#line 135 "certtool.gaa"
+#line 138 "certtool.gaa"
 	char* pkcs11_provider;
-#line 132 "certtool.gaa"
+#line 135 "certtool.gaa"
 	char *pkcs_cipher;
-#line 129 "certtool.gaa"
+#line 132 "certtool.gaa"
 	char *template;
-#line 126 "certtool.gaa"
+#line 129 "certtool.gaa"
 	char *infile;
-#line 123 "certtool.gaa"
+#line 126 "certtool.gaa"
 	char *outfile;
-#line 120 "certtool.gaa"
+#line 123 "certtool.gaa"
 	int quick_random;
+#line 120 "certtool.gaa"
+	char* sec_param;
 #line 117 "certtool.gaa"
 	int bits;
 #line 113 "certtool.gaa"
@@ -319,7 +322,7 @@ static int gaa_error = 0;
 #define GAA_MULTIPLE_OPTION     3
 
 #define GAA_REST                0
-#define GAA_NB_OPTION           62
+#define GAA_NB_OPTION           63
 #define GAAOPTID_version	1
 #define GAAOPTID_help	2
 #define GAAOPTID_debug	3
@@ -339,49 +342,50 @@ static int gaa_error = 0;
 #define GAAOPTID_infile	17
 #define GAAOPTID_outfile	18
 #define GAAOPTID_disable_quick_random	19
-#define GAAOPTID_bits	20
-#define GAAOPTID_outraw	21
-#define GAAOPTID_outder	22
-#define GAAOPTID_inraw	23
-#define GAAOPTID_inder	24
-#define GAAOPTID_export_ciphers	25
-#define GAAOPTID_hash	26
-#define GAAOPTID_dsa	27
-#define GAAOPTID_pkcs8	28
-#define GAAOPTID_to_p8	29
-#define GAAOPTID_to_p12	30
-#define GAAOPTID_v1	31
-#define GAAOPTID_fix_key	32
-#define GAAOPTID_pubkey_info	33
-#define GAAOPTID_pgp_key_info	34
-#define GAAOPTID_key_info	35
-#define GAAOPTID_smime_to_p7	36
-#define GAAOPTID_p7_info	37
-#define GAAOPTID_p12_info	38
-#define GAAOPTID_no_crq_extensions	39
-#define GAAOPTID_crq_info	40
-#define GAAOPTID_crl_info	41
-#define GAAOPTID_pgp_ring_info	42
-#define GAAOPTID_pgp_certificate_info	43
-#define GAAOPTID_certificate_info	44
-#define GAAOPTID_password	45
-#define GAAOPTID_load_ca_certificate	46
-#define GAAOPTID_load_ca_privkey	47
-#define GAAOPTID_load_certificate	48
-#define GAAOPTID_load_request	49
-#define GAAOPTID_load_pubkey	50
-#define GAAOPTID_load_privkey	51
-#define GAAOPTID_get_dh_params	52
-#define GAAOPTID_generate_dh_params	53
-#define GAAOPTID_verify_crl	54
-#define GAAOPTID_verify_chain	55
-#define GAAOPTID_generate_request	56
-#define GAAOPTID_generate_privkey	57
-#define GAAOPTID_update_certificate	58
-#define GAAOPTID_generate_crl	59
-#define GAAOPTID_generate_proxy	60
-#define GAAOPTID_generate_certificate	61
-#define GAAOPTID_generate_self_signed	62
+#define GAAOPTID_sec_param	20
+#define GAAOPTID_bits	21
+#define GAAOPTID_outraw	22
+#define GAAOPTID_outder	23
+#define GAAOPTID_inraw	24
+#define GAAOPTID_inder	25
+#define GAAOPTID_export_ciphers	26
+#define GAAOPTID_hash	27
+#define GAAOPTID_dsa	28
+#define GAAOPTID_pkcs8	29
+#define GAAOPTID_to_p8	30
+#define GAAOPTID_to_p12	31
+#define GAAOPTID_v1	32
+#define GAAOPTID_fix_key	33
+#define GAAOPTID_pubkey_info	34
+#define GAAOPTID_pgp_key_info	35
+#define GAAOPTID_key_info	36
+#define GAAOPTID_smime_to_p7	37
+#define GAAOPTID_p7_info	38
+#define GAAOPTID_p12_info	39
+#define GAAOPTID_no_crq_extensions	40
+#define GAAOPTID_crq_info	41
+#define GAAOPTID_crl_info	42
+#define GAAOPTID_pgp_ring_info	43
+#define GAAOPTID_pgp_certificate_info	44
+#define GAAOPTID_certificate_info	45
+#define GAAOPTID_password	46
+#define GAAOPTID_load_ca_certificate	47
+#define GAAOPTID_load_ca_privkey	48
+#define GAAOPTID_load_certificate	49
+#define GAAOPTID_load_request	50
+#define GAAOPTID_load_pubkey	51
+#define GAAOPTID_load_privkey	52
+#define GAAOPTID_get_dh_params	53
+#define GAAOPTID_generate_dh_params	54
+#define GAAOPTID_verify_crl	55
+#define GAAOPTID_verify_chain	56
+#define GAAOPTID_generate_request	57
+#define GAAOPTID_generate_privkey	58
+#define GAAOPTID_update_certificate	59
+#define GAAOPTID_generate_crl	60
+#define GAAOPTID_generate_proxy	61
+#define GAAOPTID_generate_certificate	62
+#define GAAOPTID_generate_self_signed	63
 
 #line 168 "gaa.skel"
 
@@ -628,6 +632,12 @@ struct GAAOPTION_outfile
 	int size1;
 };
 
+struct GAAOPTION_sec_param
+{
+	char* arg1;
+	int size1;
+};
+
 struct GAAOPTION_bits 
 {
 	int arg1;
@@ -721,6 +731,7 @@ static int gaa_get_option_num(char *str, int status)
 			GAA_CHECK1STR("", GAAOPTID_template);
 			GAA_CHECK1STR("", GAAOPTID_infile);
 			GAA_CHECK1STR("", GAAOPTID_outfile);
+			GAA_CHECK1STR("", GAAOPTID_sec_param);
 			GAA_CHECK1STR("", GAAOPTID_bits);
 			GAA_CHECK1STR("", GAAOPTID_hash);
 			GAA_CHECK1STR("", GAAOPTID_password);
@@ -798,6 +809,7 @@ static int gaa_get_option_num(char *str, int status)
 			GAA_CHECKSTR("infile", GAAOPTID_infile);
 			GAA_CHECKSTR("outfile", GAAOPTID_outfile);
 			GAA_CHECKSTR("disable-quick-random", GAAOPTID_disable_quick_random);
+			GAA_CHECKSTR("sec-param", GAAOPTID_sec_param);
 			GAA_CHECKSTR("bits", GAAOPTID_bits);
 			GAA_CHECKSTR("outraw", GAAOPTID_outraw);
 			GAA_CHECKSTR("outder", GAAOPTID_outder);
@@ -863,6 +875,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 	struct GAAOPTION_template GAATMP_template;
 	struct GAAOPTION_infile GAATMP_infile;
 	struct GAAOPTION_outfile GAATMP_outfile;
+	struct GAAOPTION_sec_param GAATMP_sec_param;
 	struct GAAOPTION_bits GAATMP_bits;
 	struct GAAOPTION_hash GAATMP_hash;
 	struct GAAOPTION_password GAATMP_password;
@@ -894,14 +907,14 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
     {
 	case GAAOPTID_version:
 	OK = 0;
-#line 161 "certtool.gaa"
+#line 164 "certtool.gaa"
 { certtool_version(); exit(0); ;};
 
 		return GAA_OK;
 		break;
 	case GAAOPTID_help:
 	OK = 0;
-#line 159 "certtool.gaa"
+#line 162 "certtool.gaa"
 { gaa_help(); exit(0); ;};
 
 		return GAA_OK;
@@ -911,7 +924,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 		GAA_TESTMOREARGS;
 		GAA_FILL(GAATMP_debug.arg1, gaa_getint, GAATMP_debug.size1);
 		gaa_index++;
-#line 157 "certtool.gaa"
+#line 160 "certtool.gaa"
 { gaaval->debug = GAATMP_debug.arg1 ;};
 
 		return GAA_OK;
@@ -921,14 +934,14 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 		GAA_TESTMOREARGS;
 		GAA_FILL(GAATMP_pkcs11_delete_url.arg1, gaa_getstr, GAATMP_pkcs11_delete_url.size1);
 		gaa_index++;
-#line 154 "certtool.gaa"
+#line 157 "certtool.gaa"
 { gaaval->action = ACTION_PKCS11_DELETE_URL; gaaval->pkcs11_url = GAATMP_pkcs11_delete_url.arg1; ;};
 
 		return GAA_OK;
 		break;
 	case GAAOPTID_pkcs11_write_trusted:
 	OK = 0;
-#line 152 "certtool.gaa"
+#line 155 "certtool.gaa"
 { gaaval->pkcs11_trusted = 1; ;};
 
 		return GAA_OK;
@@ -938,7 +951,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 		GAA_TESTMOREARGS;
 		GAA_FILL(GAATMP_pkcs11_write_label.arg1, gaa_getstr, GAATMP_pkcs11_write_label.size1);
 		gaa_index++;
-#line 150 "certtool.gaa"
+#line 153 "certtool.gaa"
 { gaaval->pkcs11_label = GAATMP_pkcs11_write_label.arg1; ;};
 
 		return GAA_OK;
@@ -948,42 +961,42 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 		GAA_TESTMOREARGS;
 		GAA_FILL(GAATMP_pkcs11_write.arg1, gaa_getstr, GAATMP_pkcs11_write.size1);
 		gaa_index++;
-#line 149 "certtool.gaa"
+#line 152 "certtool.gaa"
 { gaaval->action = ACTION_PKCS11_WRITE_URL; gaaval->pkcs11_url = GAATMP_pkcs11_write.arg1; ;};
 
 		return GAA_OK;
 		break;
 	case GAAOPTID_pkcs11_list_tokens:
 	OK = 0;
-#line 146 "certtool.gaa"
+#line 149 "certtool.gaa"
 { gaaval->action = ACTION_PKCS11_TOKENS; ;};
 
 		return GAA_OK;
 		break;
 	case GAAOPTID_pkcs11_list_all:
 	OK = 0;
-#line 145 "certtool.gaa"
+#line 148 "certtool.gaa"
 { gaaval->action = ACTION_PKCS11_LIST; gaaval->pkcs11_type=PKCS11_TYPE_ALL; ;};
 
 		return GAA_OK;
 		break;
 	case GAAOPTID_pkcs11_list_all_certs:
 	OK = 0;
-#line 144 "certtool.gaa"
+#line 147 "certtool.gaa"
 { gaaval->action = ACTION_PKCS11_LIST; gaaval->pkcs11_type=PKCS11_TYPE_CRT_ALL; ;};
 
 		return GAA_OK;
 		break;
 	case GAAOPTID_pkcs11_list_trusted:
 	OK = 0;
-#line 143 "certtool.gaa"
+#line 146 "certtool.gaa"
 { gaaval->action = ACTION_PKCS11_LIST; gaaval->pkcs11_type=PKCS11_TYPE_TRUSTED; ;};
 
 		return GAA_OK;
 		break;
 	case GAAOPTID_pkcs11_list_certs:
 	OK = 0;
-#line 142 "certtool.gaa"
+#line 145 "certtool.gaa"
 { gaaval->action = ACTION_PKCS11_LIST; gaaval->pkcs11_type=PKCS11_TYPE_PK; ;};
 
 		return GAA_OK;
@@ -993,7 +1006,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 		GAA_TESTMOREARGS;
 		GAA_FILL(GAATMP_pkcs11_export_url.arg1, gaa_getstr, GAATMP_pkcs11_export_url.size1);
 		gaa_index++;
-#line 139 "certtool.gaa"
+#line 142 "certtool.gaa"
 { gaaval->action = ACTION_PKCS11_EXPORT_URL; gaaval->pkcs11_url = GAATMP_pkcs11_export_url.arg1; ;};
 
 		return GAA_OK;
@@ -1003,7 +1016,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 		GAA_TESTMOREARGS;
 		GAA_FILL(GAATMP_pkcs11_provider.arg1, gaa_getstr, GAATMP_pkcs11_provider.size1);
 		gaa_index++;
-#line 136 "certtool.gaa"
+#line 139 "certtool.gaa"
 { gaaval->pkcs11_provider = GAATMP_pkcs11_provider.arg1 ;};
 
 		return GAA_OK;
@@ -1013,7 +1026,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 		GAA_TESTMOREARGS;
 		GAA_FILL(GAATMP_pkcs_cipher.arg1, gaa_getstr, GAATMP_pkcs_cipher.size1);
 		gaa_index++;
-#line 133 "certtool.gaa"
+#line 136 "certtool.gaa"
 { gaaval->pkcs_cipher = GAATMP_pkcs_cipher.arg1 ;};
 
 		return GAA_OK;
@@ -1023,7 +1036,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 		GAA_TESTMOREARGS;
 		GAA_FILL(GAATMP_template.arg1, gaa_getstr, GAATMP_template.size1);
 		gaa_index++;
-#line 130 "certtool.gaa"
+#line 133 "certtool.gaa"
 { gaaval->template = GAATMP_template.arg1 ;};
 
 		return GAA_OK;
@@ -1033,7 +1046,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 		GAA_TESTMOREARGS;
 		GAA_FILL(GAATMP_infile.arg1, gaa_getstr, GAATMP_infile.size1);
 		gaa_index++;
-#line 127 "certtool.gaa"
+#line 130 "certtool.gaa"
 { gaaval->infile = GAATMP_infile.arg1 ;};
 
 		return GAA_OK;
@@ -1043,16 +1056,26 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 		GAA_TESTMOREARGS;
 		GAA_FILL(GAATMP_outfile.arg1, gaa_getstr, GAATMP_outfile.size1);
 		gaa_index++;
-#line 124 "certtool.gaa"
+#line 127 "certtool.gaa"
 { gaaval->outfile = GAATMP_outfile.arg1 ;};
 
 		return GAA_OK;
 		break;
 	case GAAOPTID_disable_quick_random:
 	OK = 0;
-#line 121 "certtool.gaa"
+#line 124 "certtool.gaa"
 { gaaval->quick_random = 0; ;};
 
+		return GAA_OK;
+		break;
+	case GAAOPTID_sec_param:
+	OK = 0;
+		GAA_TESTMOREARGS;
+		GAA_FILL(GAATMP_sec_param.arg1, gaa_getstr, GAATMP_sec_param.size1);
+		gaa_index++;
+#line 121 "certtool.gaa"
+{ gaaval->sec_param = GAATMP_sec_param.arg1 ;};
+
 		return GAA_OK;
 		break;
 	case GAAOPTID_bits:
@@ -1407,14 +1430,14 @@ int gaa(int argc, char **argv, gaainfo *gaaval)
     if(inited == 0)
     {
 
-#line 163 "certtool.gaa"
-{ gaaval->bits = 2048; gaaval->pkcs8 = 0; gaaval->privkey = NULL; gaaval->ca=NULL; gaaval->ca_privkey = NULL; 
+#line 166 "certtool.gaa"
+{ gaaval->bits = 0; gaaval->pkcs8 = 0; gaaval->privkey = NULL; gaaval->ca=NULL; gaaval->ca_privkey = NULL;
 	gaaval->debug=1; gaaval->request = NULL; gaaval->infile = NULL; gaaval->outfile = NULL; gaaval->cert = NULL; 
 	gaaval->incert_format = 0; gaaval->outcert_format = 0; gaaval->action=-1; gaaval->pass = NULL; gaaval->v1_cert = 0;
 	gaaval->export = 0; gaaval->template = NULL; gaaval->hash=NULL; gaaval->fix_key = 0; gaaval->quick_random=1; 
 	gaaval->privkey_op = 0; gaaval->pkcs_cipher = "3des"; gaaval->crq_extensions=1; gaaval->pkcs11_provider= NULL;
 	gaaval->pkcs11_url = NULL; gaaval->pkcs11_type = PKCS11_TYPE_PK; gaaval->pubkey=NULL; gaaval->pkcs11_label = NULL; 
-	gaaval->pkcs11_trusted=0; ;};
+	gaaval->pkcs11_trusted=0; gaaval->sec_param = NULL; ;};
 
     }
     inited = 1;
diff --git a/src/certtool-gaa.h b/src/certtool-gaa.h
index 8cda5acc1b..647e512b9f 100644
--- a/src/certtool-gaa.h
+++ b/src/certtool-gaa.h
@@ -8,28 +8,30 @@ typedef struct _gaainfo gaainfo;
 
 struct _gaainfo
 {
-#line 156 "certtool.gaa"
+#line 159 "certtool.gaa"
 	int debug;
-#line 151 "certtool.gaa"
+#line 154 "certtool.gaa"
 	int pkcs11_trusted;
-#line 148 "certtool.gaa"
+#line 151 "certtool.gaa"
 	char* pkcs11_label;
-#line 141 "certtool.gaa"
+#line 144 "certtool.gaa"
 	int pkcs11_type;
-#line 138 "certtool.gaa"
+#line 141 "certtool.gaa"
 	char* pkcs11_url;
-#line 135 "certtool.gaa"
+#line 138 "certtool.gaa"
 	char* pkcs11_provider;
-#line 132 "certtool.gaa"
+#line 135 "certtool.gaa"
 	char *pkcs_cipher;
-#line 129 "certtool.gaa"
+#line 132 "certtool.gaa"
 	char *template;
-#line 126 "certtool.gaa"
+#line 129 "certtool.gaa"
 	char *infile;
-#line 123 "certtool.gaa"
+#line 126 "certtool.gaa"
 	char *outfile;
-#line 120 "certtool.gaa"
+#line 123 "certtool.gaa"
 	int quick_random;
+#line 120 "certtool.gaa"
+	char* sec_param;
 #line 117 "certtool.gaa"
 	int bits;
 #line 113 "certtool.gaa"
diff --git a/src/certtool.c b/src/certtool.c
index b646453c50..e2f5f4c280 100644
--- a/src/certtool.c
+++ b/src/certtool.c
@@ -166,6 +166,33 @@ print_rsa_pkey (gnutls_datum_t * m, gnutls_datum_t * e, gnutls_datum_t * d,
     }
 }
 
+static gnutls_sec_param_t str_to_sec_param(const char* str)
+{
+  if (strcasecmp(str, "low")==0)
+    {
+      return GNUTLS_SEC_PARAM_LOW;
+    }
+  else if (strcasecmp(str, "normal")==0)
+    {
+      return GNUTLS_SEC_PARAM_NORMAL;
+    }
+  else if (strcasecmp(str, "high")==0)
+    {
+      return GNUTLS_SEC_PARAM_HIGH;
+    }
+  else if (strcasecmp(str, "ultra")==0)
+    {
+      return GNUTLS_SEC_PARAM_ULTRA;
+    }
+  else
+    {
+      fprintf(stderr, "Unknown security parameter string: %s\n", str);
+      exit(1);
+    }
+
+}
+
+
 static gnutls_x509_privkey_t
 generate_private_key_int (void)
 {
@@ -183,6 +210,19 @@ generate_private_key_int (void)
   if (ret < 0)
     error (EXIT_FAILURE, 0, "privkey_init: %s", gnutls_strerror (ret));
 
+  if (info.bits != 0)
+    {
+      fprintf(stderr, "** Note: Please use the --sec-param instead of --bits\n");
+    }
+  else
+    {
+      if (info.sec_param)
+        {
+          info.bits = gnutls_sec_param_to_pk_bits(key_type, str_to_sec_param(info.sec_param));
+        }
+      else info.bits = gnutls_sec_param_to_pk_bits(key_type, GNUTLS_SEC_PARAM_NORMAL);
+    }
+
   fprintf (stderr, "Generating a %d bit %s private key...\n", info.bits,
 	   gnutls_pk_algorithm_get_name (key_type));
 
diff --git a/src/certtool.gaa b/src/certtool.gaa
index 9a835ad3ab..9b778645ea 100644
--- a/src/certtool.gaa
+++ b/src/certtool.gaa
@@ -117,6 +117,9 @@ option (outraw) { $outcert_format=1 } "Use RAW/DER format for output certificate
 #int bits;
 option (bits) INT "BITS" { $bits = $1 } "specify the number of bits for key generation."
 
+#char* sec_param;
+option (sec-param) STR "PARAM" { $sec_param = $1 } "specify the security level [low|normal|high|ultra]."
+
 #int quick_random;
 option (disable-quick-random) { $quick_random = 0; } "Use /dev/random for key generationg, thus increasing the quality of randomness used."
 
@@ -160,10 +163,10 @@ option (h, help) { gaa_help(); exit(0); } "shows this help text"
 
 option (v, version) { certtool_version(); exit(0); } "shows the program's version"
 
-init { $bits = 2048; $pkcs8 = 0; $privkey = NULL; $ca=NULL; $ca_privkey = NULL; 
+init { $bits = 0; $pkcs8 = 0; $privkey = NULL; $ca=NULL; $ca_privkey = NULL;
 	$debug=1; $request = NULL; $infile = NULL; $outfile = NULL; $cert = NULL; 
 	$incert_format = 0; $outcert_format = 0; $action=-1; $pass = NULL; $v1_cert = 0;
 	$export = 0; $template = NULL; $hash=NULL; $fix_key = 0; $quick_random=1; 
 	$privkey_op = 0; $pkcs_cipher = "3des"; $crq_extensions=1; $pkcs11_provider= NULL;
 	$pkcs11_url = NULL; $pkcs11_type = PKCS11_TYPE_PK; $pubkey=NULL; $pkcs11_label = NULL; 
-	$pkcs11_trusted=0; }
+	$pkcs11_trusted=0; $sec_param = NULL; }