The Digital Signature Algorithm (DSA)
The Digital Signature Algorithm Parameters
A DSA digital signature is calculated utilizing a set of domain parameters, a private key x, a permessage secret number k, information to be signed, and a hash function. A digital signature is controlled utilizing the same domain parameters, a public key y that’s mathematically linked with the private key used to generate the digital signature, information to be verified, and the same hash function that was utilized during signature generation.
These parameters are defined as follows:
- p a prime modulus, where 2L-1 < p < 2L, and L is the bit length of p.
- q a prime divisor of (p – 1), where 2N-1 < q < 2 N, and N is the bit length of q.
- g a generator of the subgroup of order q mod p, such that 1 < g < q.
- x the private key that must remain secret; x is a randomly or pseudorandomly generated
integer, such that 0 < x < q, i.e., x is in the range [1, q-1]. - y the public key, where y = gx mod p.
- k a secret number that is unique to each message; k is a randomly or pseudorandomly
generated integer, such that 0 < k < q, i.e., k is in the range [1, q-1].
Selection of Parameter Sizes and Hash Functions for The Digital Signature Algorithm
This Standard stipulates the succeeding options for the pair L and N (the bit lengths of p and q,respectively):
- L = 1024, N = 160
- L = 2048, N = 224
- L = 2048, N = 256
- L = 3072, N = 256
A hash function is mandatory during the generation of digital signatures. The security strength of the hash function utilized shall conform or exceed the security strength of the (L, N) pair. It’s advisable that the security strength of the (L, N) pair and the hash function be the equal unless an accord has been constituted between involved entities to use a stronger hash function; a hash function that provides a lower security strength than the (L,N) pair shall not be utilized.
If the output of the hash function is greater than N (i.e., the bit length of q), then the leftmost N bits of the hash function output block shall be utilized in any computation utilizing the hash function output during the generation or verification of a digital signature.
An (L, N) pair shall be chosen that protects the signed data during the entire anticipated lifetime of that data. For instance, if a digital signature is generated in 2008 for data that requires to be protected for five years, and a particular (L, N) pair is invalid after 2010, then a larger (L, N) pair shall be used that remains valid for the entire period of time that the information needs to be protected.
For instance, a Federal Government entity other than a Certification Authority (CA) should utilize only the first three (L, N) pairs (i.e., the (1024, 160), (2048, 224) and (2048, 256) pairs). A Certification Authority shall use an (L, N) pair that is equal to or greater than the (L, N) pairs utilized by its subscribers. For instance, if subscribers are utilizing the (2048, 224) pair, then the Certification Authority shall utilize either the (2048, 224), (2048, 256) or (3072, 256) pair.
Conceivable exclusions to this rule include cross certification between Certification Authorities, certifying keys for intentions other than digital signatures and transitioning from one key
size or algorithm to another.
Domain Parameter Generation
Domain parameters can be generated by a trusted third party (an entity different than the possessor and verifier that is trusted by the possessor or the verifier or both, such as a Certification Authority) or by an entity different than a Trusted third party. Assurance of domain parameter validity shall be prevailed before key pair generation, digital signature generation or digital signature verification . The input to the generation process is the selected values of L and N ; the output of the generation process is the values for p and q, and optionally, the values of the domain_parameter_seed and counter.
12 Responses to “The Digital Signature Algorithm (DSA)”
How PKI uses digital certificates to protect information ?
Using the following mechanisms:
Authentication
Encryption
Digital signing
Access control
Non-repudiation
What factors to consider for a enterprise PKI solution ?
1) PKI functionality
2) Ease of integration
3) Availability and scalability
4) Security and risk management
5) Expertise
6) Scope of operation
What are the Models for PKI Deployment ?
1) In-House Deployment of Stand-Alone PKI Software
2) Outsourced Deployment to an Integrated PKI Platform
How is te industry leader in Internet security and public key infrastructure ?
Verisign
What are the advantages of VeriSign Managed PKI ?
1) Lower TCO
2) Rapid deployment
3) Proven success
4) Minimum impact on staff
5) Strong security
6) Brand value
What is cryptography ?
Cryptography is the art of enciphering data using functions to ensure the privacy of that data.
Typically, cryptographic functions require keys that are used to encrypt and decrypt the data.
interesting post
a very good article about The Digital Signature Algorithm (DSA)