)]}'
{
  "commit": "41b290f319b3f6f7cc8a44c47f29b8dd27ce21c0",
  "tree": "11b728a464ade7d5923f9b2533a4989e93944399",
  "parents": [
    "6bb8bebbfb04b6108fbc69cf46e31fa5ac9f726f"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Sun Jan 11 17:57:44 2026 -0500"
  },
  "committer": {
    "name": "Boringssl LUCI CQ",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Mon Jan 12 10:07:32 2026 -0800"
  },
  "message": "Raise the maximum RSA key size back to 16384\n\nThis reverts part of\nhttps://boringssl-review.googlesource.com/c/boringssl/+/80287. Despite\nthe original change landing in July, we encountered an application that\nneeds to support large RSA keys for now.\n\nThe motivation for dropping the limit was three-fold:\n\n1. To avoid risk of hard-to-debug assembly crashes on Windows, because\n   of a subtle requirement on stack access order.\n\n2. To make it possible to comfortably allocate RSA temporaries on the\n   stack.\n\n3. To reduce the DoS exposure for calling applications, that often\n   forget to check RSA key sizes when importing them.\n\nThe first of these turn out to be OK, but hanging by a thread. I\u0027ve\nadded long comments to armv8-mont.pl to explain the preconditions.\n\nA factor of 2 increase for the second is not great, but we can probably\nstill manage 2 KiB per temporary instead of 1 KiB.\n\nThe last of these is unfortunate as nothing changes the quadratic and\ncubic scaling of RSA. We\u0027ll just need to go back to the increased risk\nfor now. We may, in the future, gate these oversized RSA keys on\napplication opt-in, and/or limit them to public keys.\n\nUpdate-Note: Due to b/473446952, the DoS exposure of every application\nthat imports RSA keys had to be increased. Applications that import RSA\nkeys should constrain the size. It is particularly recommended that\napplications *not* allow importing RSA-16384 private keys, as those are\n512x slower than the standard RSA-2048 private keys that applications\nwill typically benchmark against.\n\nBug: 402677800\nBug: 473446952\nChange-Id: Idb1b241a8bf307bac27d278b0e427b0474ffe77f\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/86928\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "59a7e0eb740a8dbaa640997c8df4d489cb76d815",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/bn/asm/armv8-mont.pl",
      "new_id": "44ad3021d4a7946ee66551068836fbde2088a762",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/bn/asm/armv8-mont.pl"
    },
    {
      "type": "modify",
      "old_id": "330d8fabdb8dbd51da9bf397400d10e15b2e4be8",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/bn/internal.h",
      "new_id": "ac636c17388b04b4ee53fe2c827b4ad96eb41898",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/bn/internal.h"
    },
    {
      "type": "modify",
      "old_id": "81ba8893f667b7007b9e1b789f8fce16db4f7192",
      "old_mode": 33188,
      "old_path": "crypto/rsa/rsa_test.cc",
      "new_id": "d20f793b20b5ad22af8bd40b83dadfc088a67564",
      "new_mode": 33188,
      "new_path": "crypto/rsa/rsa_test.cc"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "d6dad8ed04e98a9fde4a37ccc4b951fa26701d3b",
      "new_mode": 33188,
      "new_path": "crypto/rsa/test/rsa16384.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "2bb7f332c822bc05a873b594a588b7e59a408af9",
      "new_mode": 33188,
      "new_path": "crypto/rsa/test/rsa16384pub.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "3279698eba3bfaffbfc935d95577ea269648ba80",
      "new_mode": 33188,
      "new_path": "crypto/rsa/test/rsa16385.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "086cb74bc53733522cbea5a737533cd36f17e126",
      "new_mode": 33188,
      "new_path": "crypto/rsa/test/rsa16385pub.pem"
    },
    {
      "type": "modify",
      "old_id": "f360147fe4a9bc6d3291312b1b1f4d044c2d15bf",
      "old_mode": 33188,
      "old_path": "gen/bcm/armv8-mont-apple.S",
      "new_id": "5e9a8e91218a88a29af5082942259906188da3f8",
      "new_mode": 33188,
      "new_path": "gen/bcm/armv8-mont-apple.S"
    },
    {
      "type": "modify",
      "old_id": "760bd8840f99e1283b555ed77734a16f736cce6e",
      "old_mode": 33188,
      "old_path": "gen/bcm/armv8-mont-linux.S",
      "new_id": "de02424e992d7b21902be1b3ae9c5d15015cfa24",
      "new_mode": 33188,
      "new_path": "gen/bcm/armv8-mont-linux.S"
    },
    {
      "type": "modify",
      "old_id": "40d724962b4ac4add15d97b772f07c9cd1ac6585",
      "old_mode": 33188,
      "old_path": "gen/bcm/armv8-mont-win.S",
      "new_id": "adfdba441de0acd958bb159eb66ad0373330d30d",
      "new_mode": 33188,
      "new_path": "gen/bcm/armv8-mont-win.S"
    },
    {
      "type": "modify",
      "old_id": "f571ea6a730b5d1a4d1b2c4b832aa51e76e20269",
      "old_mode": 33188,
      "old_path": "gen/sources.bzl",
      "new_id": "9177c794a6b02599ed250d9223d4d79d70c18ef8",
      "new_mode": 33188,
      "new_path": "gen/sources.bzl"
    },
    {
      "type": "modify",
      "old_id": "6ac8c58d19bb393e7e061fff417c25334875d7d4",
      "old_mode": 33188,
      "old_path": "gen/sources.cmake",
      "new_id": "2dfeccc3938e549f4d0584c8ba5f4ec4fabe64e7",
      "new_mode": 33188,
      "new_path": "gen/sources.cmake"
    },
    {
      "type": "modify",
      "old_id": "d4774b5990e25f5e1dcf300fe2bbda6cbcf07939",
      "old_mode": 33188,
      "old_path": "gen/sources.gni",
      "new_id": "c1b412c15bad522de180f9525d06cd733f9035fd",
      "new_mode": 33188,
      "new_path": "gen/sources.gni"
    },
    {
      "type": "modify",
      "old_id": "0338f4cf207514c5c8cd5e6d3634cbcecbf6bcfa",
      "old_mode": 33188,
      "old_path": "gen/sources.json",
      "new_id": "594138a9484250d46c0b56ce48a1dc05a42272fb",
      "new_mode": 33188,
      "new_path": "gen/sources.json"
    },
    {
      "type": "modify",
      "old_id": "047dd5f1f0214746e281fb0acefb197ead8a8bd2",
      "old_mode": 33188,
      "old_path": "gen/sources.mk",
      "new_id": "49964216f4e964a3c5f3e65bf10d479a01839870",
      "new_mode": 33188,
      "new_path": "gen/sources.mk"
    },
    {
      "type": "modify",
      "old_id": "7c20dab5b74e99db701c155dde364a9caa072737",
      "old_mode": 33188,
      "old_path": "include/openssl/rsa.h",
      "new_id": "692d50956e04f0762d5cc6b2c45ec137dc7637f9",
      "new_mode": 33188,
      "new_path": "include/openssl/rsa.h"
    }
  ]
}