Subject: NIST publishes new DSA draft

From: David Shaw <[email-masked]>
Date: Tue, 14 Mar 2006 10:58:39 -0500

In the OpenPGP context, probably the most interesting bit is that the
160-bit hash limit has been removed.  The sizes supported are:

* 1024-bit key, 160-bit hash (the current DSA)
* 2048-bit key, 224-bit hash (presumably aimed at SHA-224)
* 2048-bit key, 256-bit hash (presumably aimed at SHA-256)
* 3072-bit key, 256-bit hash (presumably aimed at SHA-256)

It also adds the concept of using a larger hash than will fit by
taking the leftmost bits.

http://csrc.nist.gov/publications/drafts.html

David

---

From: James Couzens <[email-masked]>
Date: Tue, 14 Mar 2006 13:31:57 -0800

> We might want to think about making SHA-256 be another MUST algorithm.
> The only MUST hash now is SHA-1.  Making SHA-256 be a MUST would make
> these new key sizes be more useful, and also give us an easier fallback
> if SHA-1 should be broken.

SHA-1 was broken, last month by three Chinese cryptographers as reported 
by Bruce Schneier through is website.  On February 15, 2006 he wrote of 
a new cryptographic result, an attack faster than brute-force against 
SHA-1.  Two days later he wrote an update to his original post and a 
quote from within it:

> Earlier this week, three Chinese cryptographers showed that SHA-1 is not 
> collision-free. That is, they developed an algorithm for finding collisions
> faster than brute force.
> 
> ...
> 
> They can find collisions in SHA-1 in 2^69 calculations, about 2,000 times
> faster than brute force. Right now, that is just on the far edge of 
> feasibility with current technology. Two comparable massive computations 
> illustrate that point.

Reference URL (02/18/2006): http://tinyurl.com/4rl78
Original post (02/15/2006): http://tinyurl.com/4bmcc

With respect to your suggestion about thinking about making SHA-256 a MUST 
algorithm I couldn't agree more.

Cheers,

James

-- 
James Couzens,
Programmer
 ___ __  __  ___ 
| __|  \/  |/ __| The Electric Mail Company
| _|| |\/| | (__  Managed, Secure Email Services
|___|_|  |_|\___| http://www.electricmail.com
                  Direct Line: 604.482.1111 x152
--------------------------------------------------
PGP Key Fingerprint:
B2EF B741 1807 2F24 8B70  F89B 03D2 6CFF C52F 0052

---

From: [email-masked] ("Hal Finney")
Date: Tue, 14 Mar 2006 14:19:59 -0800 (PST)

Hi, James - I'm afraid you are off by a year on that.  Those reports
were from 2005, not 2006.  They have been intensively discussed here and
elsewhere in the cryptographic community.  Indeed, those findings are a
good part of why I was proposing making SHA-256 a MUST, along with the
fact that this hash will now be able to be used with DSS signatures.

Hal Finney

---

From: James Couzens <[email-masked]>
Date: Tue, 14 Mar 2006 15:00:07 -0800

> fact that this hash will now be able to be used with DSS signatures.

My apologies, you are quite correct.  I recently joined the list a few
months ago, and haven't reviewed it historically, and as such I wasn't
present for the referenced discussion(s) intense or otherwise :-)  

I had thought it a bit strange that someone writing so comprehensively
about something related to digital signatures and to then make the
statement as you did at the end of the paragraph I quoted.  Did you have
some other intended meaning, such as broken by draft explicit
prohibition or otherwise declared deprecated in a future draft?

Cheers,

James