Subject: RFC: DSA key lengths; Elgamal type 16 v. type 20

From: "Brian M. Carlson" <[email-masked]>
Date: Sat, 24 Aug 2002 22:05:06 +0000

I'd like to nitpick for a second. Section 12.6 states, "Note that present
DSA is limited to a maximum of 1024 bit keys, which are recommended for
long-term use." Actually, it is DSS (the *standard*), not DSA (the
*algorithm*) that is limited to 1024 bits. I'd like to suggest that we
replace that sentence with, "DSA keys SHOULD NOT exceed a size of 1024
bits." This way, we can maintain backwards compatibility and compliance
with DSS, while providing adequate security for people who really want
it. Might I point out that IEEE P1363 allows for DSA keys longer than
1024 bits, so there is precedent in the cryptographic community.

I'd also like to suggest that we deprecate Elgamal type 16 in favor of
Elgamal type 20 combined with key flags. This is exactly what we did with
RSA types 2 and 3. It encourages implementations to implement key flags,
and it will lessen the usage of an encrypt-only type. It still allows
implementations to maintain backwards compatibility, because it does not
remove the type altogether.

-- 
Brian M. Carlson <[email-masked]> <http://decoy.wox.org/~bmc> 0x560553E7
I will make you shorter by the head.
		-- Elizabeth I

---

From: Jon Callas <[email-masked]>
Date: Sat, 24 Aug 2002 23:47:39 -0700

> 1024 bits, so there is precedent in the cryptographic community.

So far as I know, DSS or DSA, or whatever, mandates SHA-1. What hash
algorithm does P1363 use with longer keys? What semantics does it have to go
with it?

> remove the type altogether.

Well, there are people who believe that Elgamal signatures should be
deprecated, and were a mistake to put in the standard to begin with. I think
it's better to leave it as it is and let gentle persons continue to
disagree.

    Jon

---

From: Werner Koch <[email-masked]>
Date: Sun, 25 Aug 2002 14:41:25 +0200

> deprecated, and were a mistake to put in the standard to begin with. I think

FWIW, the reason I implemented ElGamal for signature and encryption in
GnuPG was simply the fact that at I initially was not aware of the PGP
5 data format and there used to be claims that DSA may lead to similar
patent problems as we had with RSA.

> it's better to leave it as it is and let gentle persons continue to

I agree with Jon.  There are only 28 type 20 keys on the keyservers
and I see see no reason to promote the use of this type.  I'd like to
remove it from GnuPG but some folks more or less convinced me that
type 20 support should stay in GnuPG (in expert mode).

Salam-Shalom,

   Werner

---

From: Len Sassaman <[email-masked]>
Date: Mon, 26 Aug 2002 13:56:07 -0700 (PDT)

> algorithm does P1363 use with longer keys? What semantics does it have to go

P1363 doesn't seem to be linked off of the IEEE site anymore. Does anyone
have a copy they can mirror?

I think Brian is right, though. While DSS (in FIPS 186 and ANSI X9.30)
mandates SHA-1 and limits p to 1024 bits, OpenPGP is specifying DSA, not
DSS.

I understand DSA to be limited to 1024 bits when using a 160 bit hash.
Using a larger hash would allow for larger key sizes. There has been some
speculation that a revised DSS may be specified by NIST using the new
larger SHA hashes. Should we anticipate this and add the new SHAs (at
least SHA-512) to the spec?

FWIW, I believe that one of the "ckt" unofficial builds of PGP used larger
DSA keys with "double width SHA1". (I'm surprised, actually, that RFC 2440
even specifies double-width SHA1, since it's my understanding that most
cryptographers are skeptical that double-width SHA1 is any better than
single-width SHA1 for DSA.) Shouldn't wide SHA1 be deprecated in favor of
one of the newer NIST SHAs?

--Len.

---

From: Jon Callas <[email-masked]>
Date: Mon, 26 Aug 2002 15:35:11 -0700

> mandates SHA-1 and limits p to 1024 bits, OpenPGP is specifying DSA, not

I think quibbling over the differences between DSS and DSA is as productive
as quibbling over the differences between DES and DEA. I have heard it
asserted that 3DES should actually be called 3DEA because the process of
tripling is violates the standard. Whatever. We all know what it means.

We need to figure out what the smart thing to do is, and if I need to edit
an S into an A or vice-versa, it's trivial to do that.

However, I want to quit tweaking and get a new RFC number on it.

> least SHA-512) to the spec?

We anticipated this as of bis03, August 2000. All the wide SHAs are there.

> one of the newer NIST SHAs?

The double-wide SHA work was done pre-2440. It was done pre-me. As I
remember what I was told, it was experimental work done by Colin Plumb and
Derek Atkins, but maybe Hal Finney was involved. In any event, the present
language says, "Reserved for double-width SHA (experimental, obviated)." I
am happy to change that to say merely "Reserved" lest someone get the idea
it is useful. There are also no OIDs for DWSHA.

    Jon

---

From: "Brian M. Carlson" <[email-masked]>
Date: Tue, 27 Aug 2002 01:24:40 +0000

> algorithm does P1363 use with longer keys? What semantics does it have to go

I believe it uses SHA1, because it keeps the size of q the same. You will
have to subscribe to the mailing list to get the password to fetch the
document.

Mailing List:
http://grouper.ieee.org/groups/1363/WorkingGroup/maillist.html

If it doesn't exist anymore, you can email me and ask for it.
 
> it's better to leave it as it is and let gentle persons continue to

My point is not that we enforce the use of Elgamal signatures, but that
we encourage the use of key flags to signal the purpose of the key. I
think sign-only/encrypt-only keys are broken. If someone wants to create
a type 20 key with key flags packet that says it is for encryption only,
then that person should not be required to create that key (rather,
subkey) with the strict additional conditions for signatures. I also
think implementations should accept such keys as they currently accept
type 16 keys (PGP does not, I think).

As an additional benefit, if some implementations just happen to accept
Elgamal signatures, well, ok.

-- 
Brian M. Carlson <[email-masked]> <http://decoy.wox.org/~bmc> 0x560553E7
Now hatred is by far the longest pleasure;
Men love in haste, but they detest at leisure.
		-- George Gordon, Lord Byron, "Don Juan"