Subject: RE: DNSSEC-RECORDS ISSUE: DSA from Mandatory to Optional

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 25 Sep 2003 14:14:44 -0700

There is a security issue with DSA. It requires a random number to be
generated for each signature. If the random number used in a signature can
ever be guessed the private key can be recovered.

This means that implementations of DSA need to have really good
implementation to avoid a serous compromise. 

I think that should accept is reasonable but not should support.

http://www.lucent.com/press/0201/010205.bla.html

> -----Original Message-----
> From: Loomis, Rip [mailto:[email-masked]]
> Sent: Thursday, September 25, 2003 1:35 PM
> To: [email-masked]
> Subject: RE: DNSSEC-RECORDS ISSUE: DSA from Mandatory to Optional 
> 
> 
> Jim Reid wrote:
> > I agree with Michael. It would be prudent to have a second algorithm
> > as a safety net. No SPoFs and all that. Even though a 
> vulnerability in
> > RSA looks unlikely and DNSSEC wouldn't be top of the list 
> of things to
> > worry about if that happened.
> > 
> > I'd prefer the draft to use 2119 language: MUST, SHOULD, MAY and so
> > on. OPTIONAL is too fluffy.
> > 
> > Count this as another vote for a SHOULD for DSA.
> 
> I agree with Michael R. and Jim R. in that I believe it is acceptable
> to move DSA to an "optional to implement" status, but that it is
> appropriate to use RFC 2119 terminology (in this case a SHOULD,
> to indicate that it's still a Really Good Idea to implement both
> algorithms).  One way to summarize this proposed change:
> 
>   Algorithm:
>     RSA	- Mandatory  (MUST be implemented)
>     DSA	- Optional   (SHOULD be implemented)
> 
> 
>   --Rip
> 
> 
> --
> to unsubscribe send a message to 
> [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>
> 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Michael Richardson <[email-masked]>
Date: Thu, 25 Sep 2003 18:07:22 -0400

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Hallam-Baker," == Hallam-Baker, Phillip <[email-masked]> writes:
    Hallam-Baker> I think that should accept is reasonable but not should
    Hallam-Baker> support.

  Again, I'm not happy with DSA. I'd rather have something we can actually
use. If we never use it, it won't get tested. 

] Train travel features AC outlets with no take-off restrictions|  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian/notebook using, kernel hacking, security guy");  [

---

From: "D. J. Bernstein" <[email-masked]>
Date: 26 Sep 2003 01:32:05 -0000

Hallam-Baker, Phillip writes:
> generated for each signature.

George Barwood and John Wigley solved that several years ago. In short:
generate the random number as SHA-256(z,m) mod q, where z is a secret
kept by the signer, m is the message, and q is the 160-bit DSA prime.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago