-----BEGIN PGP SIGNED MESSAGE-----
From: "Jon Callas" <jon(_at_)callas(_dot_)org>
Can someone who is an implementer answer this? What do I need to do to put
in the next draft? I'm going to put out another draft in the next couple of
days -- there's time here at HAL -- and if I can clarify, I will.
I haven't implemented it yet, but I've asked a few times, and for
lack of an answer, I've looked over the GnuPG code.
GnuPG computes:
a=g^k mod p); and,
b=(h-a*x)/k mod (p-1))
where k is random and h is the (padded) message hash.
It seems to apply the same PKCS padding as for RSA signatures.
The two MPIs are encoded in that order (a,b).
The computation matches that found in the Handbook of Applied
Cryptography, among others. I can't comment on whether the PKCS
padding is the usual treatment for ElGamal signatures, though.
-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.3
iQEVAwUBO3Vm6WNDnIII+QUHAQEUMwgArXuSzEwh/5JrUyfb824IvMwW1nT6nj0X
+RWMVWhDhij63kT95qo0yf/zNgSJ0qIuz0SSCwsTq2R8C6wknL//iIIU4IWDbNrf
S1q6128GA9blwyJ4bWdfxnFABUSpPiUl7g5A+LBWPe5o1Q2wSAYKBLDiVJtL9AHG
Db3R3++gnUo4ligmGCbzcU0dNepn0BEmAWAXmR3zH8xC2mNOPtIWBjm2JIUojZzX
99cB4hLjhw06I8H563eCo9avmc/2CTti+R9RNFWbu/CnKfSDL+++KhsgbkKIv7+M
NdzpdJoKM6EmwPVbt8f9ZEZBRyMzotw9my9YiqVQaeybX4ZJFQ9O7g==
=5/KR
-----END PGP SIGNATURE-----