Subject: RE: RSA vs. DSA MUST

From: [email-masked] (Peter Gutmann)
Date: Tue, 28 Nov 2000 14:10:56 (NZDT)

"Blake Ramsdell" <[email-masked]> writes:

>I do not care strongly, but the strawpoll at the last IETF indicated a
>preference for "both", and that was the path we were headed down, and that
>Russ summarized.  Personally, I don't implement it, and I haven't had any
>customer complaints telling me I should, and the backwards compatibility
>issues are almost the same as for Diffie-Hellman certs (that is, I have not
>seen anyone using them, so chucking them wouldn't break an installed base of
>significant size, if at all).

In case this is useful as a data point, in my general wandering around looking
for certs on the net the only publicly available DSA certs I've ever found were
some old Thawte ones, presumably created just to show'em (all the standard
Thawte certs are RSA, I don't think I've ever seen the DSA certs actually used
to certify anything).  I've also very occasionally come across them being used
in closed environments (ie ones where interoperability with the masses isn't
really an issue).  I suspect the motivation for a lot of these is that there's
a requirement to use a FIPS algorithm and DSA is the only choice.  I can't see
a MUST RSA, MAY DSA as being any real problem, it's just recognising what has
been reality for the last few years.

Peter.

---

From: "Enzo Michelangeli" <[email-masked]>
Date: Tue, 28 Nov 2000 10:54:43 +0800

----- Original Message -----
From: "Peter Gutmann" <[email-masked]>
To: <[email-masked]>; <[email-masked]>;
<[email-masked]>; <[email-masked]>
Sent: Tuesday, November 28, 2000 2:10 PM
Subject: RE: RSA vs. DSA MUST

> been reality for the last few years.

Well, there is one problem, and it's due to the store-and-forwad nature of
e-mail which prevents negotiation, making it impossible to know whether a
given algorithm is supported by a new recipient (think, e.g., of signed
messages sent to mailing list). The result is that everybody ends up using
ONLY the common denominator, i.e. the "MUST" algorithms. Incidentally, this
was precisely the root of the trouble with 40-bit security in the bad old
days: a sort of Grisham's Law for algorithms...
In my opinion, "MAY" algorithms are pretty useless in non-interactive
contexts, and if DSA is not kept as a "MUST" (my preferred choice), it might
as well be dropped altogether.

Enzo

---

From: [email-masked] (Bob Relyea)
Date: Tue, 28 Nov 2000 08:08:41 -0800

Enzo Michelangeli wrote:

> really an issue).  I suspect the motivation for a lot of these is that
> 
> there's
> 
>> a requirement to use a FIPS algorithm and DSA is the only choice.  I can't
> 
> see
> 
>> a MUST RSA, MAY DSA as being any real problem, it's just recognising what
> 
> has
> 

We have seen a lot of DSA certificates generated by the U.S. Government. 
What we haven't seen is a lot of DH certificates (The government uses 
KEA, which is a form of DH that uses two DH keys and then skipjack to do 
some key mixing).

> messages sent to mailing list). 

It's even worse for asymetric algorithms. Even if you had information to 
allow a negotiated symetric cipher, you are stuck with the asymetric 
cipher based on the user's certificate.

If we were talking DH, I'd say there isn't much point, but I've seen a 
lot of DSA stuff running around, and suspect, because of FIPs, to see 
more of it. I'd vote to make it MUST.

bob