Not logged in
Log in now
Create an account
Subscribe to LWN
LWN.net Weekly Edition for May 23, 2013
An "enum" for Python 3
An unexpected perf feature
LWN.net Weekly Edition for May 16, 2013
A look at the PyPy 2.0 release
Well, yes, but that's true of just about any encryption system's keys. The whole point of them
is that they're meant to be unpredictable (hence random). If the randomness is bad, so is the
Posted May 14, 2008 13:40 UTC (Wed) by tialaramex (subscriber, #21167)
Presumably (please, someone who remembers how this actually works chime in!)
Suppose you create two signing keys, R (using RSA) and D (using DSA) on your nice RHEL 4
It seems like Debian's security people are saying that if you copied these good keys to a
Debian system, and then used them to sign documents, the R key is still fine but the D key is
compromised by the signing process, due to it having poor entropy. That is, a sophisticated
attacker (or a script kiddie with software developed by someone else) could use your old
signatures generated on Debian systems to figure out your DSA private key.
It's certainly true that DSA's signature method explicitly requires unique cryptographically
secure random numbers for each message to be signed. But I don't know whether these numbers
protect the DSA private key, or just the signature itself. If the former, then Debian's
advisory is correct. If we don't know, then we must act as if it is correct and invalidate the
Although DSA and RSA often appear interchangeable to us as end users, they are quite different
in terms of their mathematical properties, so it could easily be true that this problem
affects only DSA.
Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds