Subject: Re: RSA vs. DSA MUST

From: "David P. Kemp" <[email-masked]>
Date: Tue, 28 Nov 2000 12:23:21 -0500 (EST)

Enzo has captured the chicken-and-egg essence of my concern.  The U.S.
Government has a requirement to purchase products which support FIPS
186-2 algorithms (this includes DSA and ANSI X9.31 RSA, but not PKCS-1
RSA).  And, at least in the DoD, we have requirements coming from our
customers to be algorithm independent:

  "PKI must support a variety of public key cryptographic algorithms
   both in the public/private key pairs created and certified by PKI,
   and in the algorithms used to apply digital signatures to certificates
   and other PKI products.  PKI must support the concurrent use of several
   digital signature algorithms for issuing certificates and must be able
   to migrate over time to using new signature algorithms."

           -- DoD PKI Operational Requirements Document, 22 October 2000

There is also the fact that DSA signatures are significantly smaller
than RSA signatures, especially as we move to public keys above 1024 bits
and the signature could be bigger than the entire to-be-signed certificate.
This doesn't matter in many environments, but it does in some.

If vendors look at what certificates have already been issued to decide
what certificates to support in products under development, we will never
evolve.  I favor keeping DSA (in addition to RSA) as a MUST for S/MIME
clients because algorithm independence is valuable in and of itself.

Dave

> From: "Enzo Michelangeli" <[email-masked]>
> 
> Well, there is one problem, and it's due to the store-and-forwad nature of
> e-mail which prevents negotiation, making it impossible to know whether a
> given algorithm is supported by a new recipient (think, e.g., of signed
> messages sent to mailing list). The result is that everybody ends up using
> ONLY the common denominator, i.e. the "MUST" algorithms. Incidentally, this
> was precisely the root of the trouble with 40-bit security in the bad old
> days: a sort of Grisham's Law for algorithms...
> In my opinion, "MAY" algorithms are pretty useless in non-interactive
> contexts, and if DSA is not kept as a "MUST" (my preferred choice), it might
> as well be dropped altogether.
> 
> Enzo

---

From: Aram Perez <[email-masked]>
Date: Tue, 28 Nov 2000 11:29:23 -0800

David Kemp wrote:

[snip]
> clients because algorithm independence is valuable in and of itself.

Was S/MIME not algorithm independent when DSA was a MUST? How would
substituting DSA with RSA change the independence? DOD could mandate S/MIME
with DSA even if S/MIME requires RSA. Someone could write a S/MIME with DSA
document similar to the ones with IDEA, CAST, etc.

Regards,
Aram Perez