Subject: Re: How to Calculate Signatures?

From: [email-masked] ("Hal Finney")
Date: Sun, 3 Apr 2005 21:36:38 -0700 (PDT)

Ian G writes:
> I'm curious on this point.  Other than the fact that
> "it's broken" why is it that you see it important to
> repair the DSA in OpenPGP?

I'm not sure if you are asking why we worry about using SHA-1 at all given
that the attack is theoretical, or why we don't just abandon DSA keys.

For the first question, my main concern is that the SHA-1 attack
may get worse so that it becomes computationally feasible to find
collisions.  If that happens we could be vulnerable to attacks like
http://eprint.iacr.org/2005/067 which showed two X.509 certificates
with the same hash.  The attacks could become even stronger to where
different userids could collide.

For the second, DSA key users do not presently have the options RSA
key users do to move to other hashes.  As I argued, the additional risk
of giving DSA users more options is not that large.  Letting them use
other hashes would allow them to continue to use their existing keys
and benefit from the signatures they have acquired on those keys.

Hal

---

From: Ian G <[email-masked]>
Date: Mon, 04 Apr 2005 16:16:00 +0100

> that the attack is theoretical, or why we don't just abandon DSA keys.

I'd say it is an open question, so either or both.

> different userids could collide.

I think now I understand this as more an issue for
WoT than documents - is that right?  (I think I'm
deriving that from the last sentance above...)  In
that people who have DSA keys and have lots of sigs
are faced with losing their 'investment'.

OK, I agree that is potentially a larger concern than
document sigs as key signing represents something of
an institution.

> and benefit from the signatures they have acquired on those keys.

OK.  In risk terms it might not be that high.  But
in cost terms, it is significant.  Any changes to
the way signatures have to be dealt with would have
to be promulgated through the community, as, if the
signature verification wasn't standard and acceptable
to all code bases, it loses its value rapidly.

So the analysis needs to question not only the risks
but also the costs and benefits.

The number of people who need to have DSA and keep
using their existing keys for signatures seems to be
quite small.  In order for these people to benefit,
they must be able to create the sigs, and everyone
else must be able to at least read the sigs.  So
any change will take a year or two to filter through
until there is wide enough distribution of verification,
and during that time, I suspect the slow uptake will
be over taken by events.

To me, I don't see the cost-benefit analysis coming
out as favourable;  far better to suggest that people
use RSA keys if they are really very keen to have the
best security in signatures, until the DSS-2 situation
settles out.

(in the 90s, this would have been a very different
situation, as RSA faced patent and cryptoexport
problems, so there would have been a group that
might have been limited to using DSA.)

All IMHO of course!

iang
-- 
News and views on what matters in finance+crypto:
         http://financialcryptography.com/

---

From: Jon Callas <[email-masked]>
Date: Mon, 4 Apr 2005 08:48:35 -0700

> and during that time, I suspect the slow uptake will

Yup. And the same thing applies to V3 keys as well. I've had vocal 
complaints from people about their V3 key and how they're upset about 
losing whatever trust issues there are from it being a decade or more 
old.

I'm not so worried about DSS that I'm going to dump my older key. But I 
might recommend to someone creating a new key that today, RSA is a 
better choice because of SHA-1 issues and lack of wide-DSS. But that 
could change tomorrow or next week.

	Jon

---

From: Ben Laurie <[email-masked]>
Date: Mon, 04 Apr 2005 17:34:07 +0100

Jon Callas wrote:
> losing whatever trust issues there are from it being a decade or more old.

So what's wrong with signing your V4 key with your V3 key and moving on?

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: Jon Callas <[email-masked]>
Date: Mon, 4 Apr 2005 13:32:39 -0700

> So what's wrong with signing your V4 key with your V3 key and moving 

Beats me. People get attached to things. Attachments to things cause 
all sorts of irrational behavior.

I suspect in a lot of cases, people get attached to an old key because 
of the number or quality of certs. It's similar to the, "I'll never 
wash that hand again!" response to shaking hands with a celeb.

	Jon

---

From: David Shaw <[email-masked]>
Date: Mon, 4 Apr 2005 16:50:07 -0400

> So what's wrong with signing your V4 key with your V3 key and moving on?

Because that would make the V4 key One More Hop Away, of course. ;)

David