ietf-openpgp
[Top] [All Lists]

Re: Comments on draft - Long.

1997-12-03 14:49:00
DSS/DSA is only specified for key lengths between 512 and 1024, but OpenPGP 
should be free to do longer keys, even though the standard doesn't actually 
support them.
 
There's no point in moving to p > 1K bits if q is only 160 bits because it'll 
be vulnerable to a small-exponent attack.  Since q is governed by the hash 
function associated with DSA, you then need to define a new hash function with 
a larger output block size, and suddenly things get very messy.  At the moment 
I don't think it's sensible to use keys > 1K bits, all it'll do is lead to 
confusion about the amount of security offered.
 
Peter.