== How to fix it in OpenSSL

=== Code examples

include::../../common/fix/code-rationale.adoc[]

==== Noncompliant code example

include::../../common/fix/rsa.adoc[]

[source,cpp,diff-id=31,diff-type=noncompliant]
----
#include <openssl/rsa.h>

void encrypt() {
    RSA* rsa_key_pair = RSA_new();
    BIGNUM* exponent  = BSA_new();

    BN_set_word(exponent, RSA_F4);
    RSA_generate_key_ex(rsa_key_pair, 1024, exponent, NULL); // Noncompliant
}
----

include::../../common/fix/dsa.adoc[]

[source,cpp,diff-id=32,diff-type=noncompliant]
----
#include <openssl/dsa.h>

void encrypt() {
    DSA* dsa_params = DSA_new();
    DSA_generate_parameters_ex(dsa_params, 1024, NULL, 0, NULL, NULL, NULL); // Noncompliant
}
----

include::../../common/fix/dh.adoc[]

[source,cpp,diff-id=33,diff-type=noncompliant]
----
#include <openssl/dh.h>

void encrypt() {
    DH* dh_params = DH_new();
    DH_generate_parameters_ex(dh_params, 1024, DH_GENERATOR_2, NULL); // Noncompliant
}
----

include::../../common/fix/ec.adoc[]

[source,cpp,diff-id=34,diff-type=noncompliant]
----
#include <botan/ec_group.h>

void encrypt() {
    EC_KEY* ec_key = EC_KEY_new_by_curve_name(NID_secp112r1); // Noncompliant
}
----

==== Compliant solution

[source,cpp,diff-id=31,diff-type=compliant]
----
#include <openssl/rsa.h>

void encrypt() {
    RSA* rsa_key_pair = RSA_new();
    BIGNUM* exponent  = BSA_new();

    BN_set_word(exponent, RSA_F4);
    RSA_generate_key_ex(rsa_key_pair, 2048, exponent, NULL);
}
----

[source,cpp,diff-id=32,diff-type=compliant]
----
#include <openssl/dsa.h>

void encrypt() {
    DSA* dsa_params = DSA_new();
    DSA_generate_parameters_ex(dsa_params, 2048, NULL, 0, NULL, NULL, NULL);
}
----

[source,cpp,diff-id=33,diff-type=compliant]
----
#include <openssl/dh.h>

void encrypt() {
    DH* dh_params = DH_new();
    DH_generate_parameters_ex(dh_params, 2048, DH_GENERATOR_2, NULL);
}
----

[source,cpp,diff-id=34,diff-type=compliant]
----
#include <botan/ec_group.h>

void encrypt() {
    EC_KEY* ec_key = EC_KEY_new_by_curve_name(NID_secp224r1);
}
----

=== How does this work?

include::../../common/fix/fix.adoc[]

=== Going the extra mile

include::../../common/extra-mile/pre-quantum.adoc[]
