Replace 3DES encryption

[nthuemmel]

Replace 3DES encryption

[karlo1941]

CA private keys should be stored only encrypted

[phoerious]

Hi, sorry for abusing this thread for questions, but which cipher is used internally for the database? I noticed that all exports are done with 3DES in 1.4, which apparently changed with 94c3835, but it's not entirely clear to me which cipher is used internally in either 1.4 or 2.x. Could you give me a short hint please? Thanks!

EDIT: I just found this which suggests 3DES is used:

xca/doc/xca.sgml

Line 992 in eb5db6f

All keys are stored encrypted in the database using the 3DES algorithm.

Is that information still valid?

[chris2511]

The documentation is outdated.
Commit 431076c changed the internal storage type of private keys to PKCS#8 with AES_256:

xca/lib/pki_evp.cpp

Line 598 in c238d0a

i2d_PKCS8PrivateKey_bio(bio, key, EVP_aes_256_cbc(),

[phoerious]

Okay, thanks. Unfortunately, that means that 1.4 is still 3DES and it's the only version that's in Ubuntu 18.04 and below. 18.10 also still has an older version with 3DES.

Have you ever thought about release an AppImage for Linux? That would be immensely helpful, since I could run the most recent version everywhere.