# Changing minimum RSA Key size

**URL:** <https://forum.opensearch.org/t/changing-minimum-rsa-key-size/6417>\
**Category:** Security\
**Created:** [July 5, 2021, 12:51pm UTC](https://forum.opensearch.org/t/changing-minimum-rsa-key-size/6417 "2021-07-05T12:51:17Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [July 7, 2021, 1:28pm UTC](https://forum.opensearch.org/t/changing-minimum-rsa-key-size/6417/2 "2021-07-07T13:28:31Z")

</div>

Hello @user123

Based on the answer from the mentioned thread, I find that issue is not related to security plug-in but to Apache CXF. 2048 limit is defined in Apache code.

> [@OIDC Authentication troubleshooting issue: unable to view log details](https://forum.opensearch.org/t/oidc-authentication-troubleshooting-issue-unable-to-view-log-details/2800/4):
>
> The message is not very clear “INVALID\_KEY” but as it has been raised by checkSignatureKeySize, I’ve been able to find that the minimum key length authorized is 2048 ( see code [cxf/JwsUtils.java at main · apache/cxf · GitHub](https://github.com/apache/cxf/blob/master/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/JwsUtils.java) ). So we have to change the rsa key of our keycloak server which is a 1024 bit length.

In that case, the only solution is to change the key size in your OIDC IdP.

---

_[View the full topic](https://forum.opensearch.org/t/changing-minimum-rsa-key-size/6417)._