| |||||||||||||
HOWTOs please!HOWTOs please!Posted May 14, 2008 0:49 UTC (Wed) by nix (subscriber, #2304)In reply to: HOWTOs please! by man_ls Parent article: Cryptographic weakness on Debian systems
What's wrong with DSA keys anyway?
(Log in to post comments)
HOWTOs please! Posted May 14, 2008 1:34 UTC (Wed) by bboissin (subscriber, #29506) [Link] > What's wrong with DSA keys anyway? Even if they aren't weak, they are compromised if they were used (the ssh client) in a affected system (debian, ubuntu). According to the DSA this is due to the fact that "Digital Signature Algorithm relies on a secret random value used during signature generation".
HOWTOs please! Posted May 14, 2008 11:12 UTC (Wed) by nix (subscriber, #2304) [Link] Well, yes, but that's true of just about any encryption system's keys. The whole point of them is that they're meant to be unpredictable (hence random). If the randomness is bad, so is the key, always.
HOWTOs please! Posted May 14, 2008 13:40 UTC (Wed) by tialaramex (subscriber, #21167) [Link] Presumably (please, someone who remembers how this actually works chime in!) Suppose you create two signing keys, R (using RSA) and D (using DSA) on your nice RHEL 4 machine It seems like Debian's security people are saying that if you copied these good keys to a Debian system, and then used them to sign documents, the R key is still fine but the D key is compromised by the signing process, due to it having poor entropy. That is, a sophisticated attacker (or a script kiddie with software developed by someone else) could use your old signatures generated on Debian systems to figure out your DSA private key. It's certainly true that DSA's signature method explicitly requires unique cryptographically secure random numbers for each message to be signed. But I don't know whether these numbers protect the DSA private key, or just the signature itself. If the former, then Debian's advisory is correct. If we don't know, then we must act as if it is correct and invalidate the affected keys. Although DSA and RSA often appear interchangeable to us as end users, they are quite different in terms of their mathematical properties, so it could easily be true that this problem affects only DSA.
Re: DSA vs RSA Posted May 15, 2008 10:21 UTC (Thu) by ldo (subscriber, #40946) [Link] As I remember, DSA was invented back when the US government was trying to restrict the use of strong cryptography. The key thing about it was that it was supposedly usable only for digital signatures, not for encryption. This was later proven to be false. And yet people still use DSA today. So why bother any more? Why not just stick with RSA for both encryption and signing? Isn't this compromise a reason to stop using DSA altogether?
|
|||||||||||||