Subject: DH/DSA I-Ds

From: Ben Laurie <[email-masked]>
Date: Wed, 22 Mar 2006 10:25:28 +0000

Here's my review of the DSA/DH I-Ds. You may regret asking for
volunteers in my presence :-)

RFC 2536bis - DSA keys

1. When referring to FIPS 186-2 I believe it is called DSS Digital
Signature Standard), not DSA.

2. I object to Schneier as a reference when Handbook of Applied
Cryptography is a) better and b) freely available on the web.

3. This assumes a 160 bit hash. NIST has just approved all the other
SHAs as appropriate hashes for DSS, so it seems silly not to revise the
I-D to allow for that, especially since we should generally remove hard
dependencies on SHA-1.

4. The prime is limited to 2560 bits, which may be small by modern
standards.

RFC 2539bis - DH

1. See 2 above.

2. The prime/generator pairs described in the appendix are generally
known as Oakley Groups - it would be good to name them properly.

3. 768 bit primes are _weak_ and should be killed.

4. Perhaps larger "standard" primes should be included (the biggest is
currently 1536 bits).

Cheers,

Ben.

-- 
http://www.links.org/

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>