Subject: Re: [Cfrg] Fwd: Re: Proposal and intent to implement "dsa-sha2-256" SSH key algorithm

From: denis bider <[email-masked]>
Date: Thu, 29 Oct 2015 04:04:18 +0000

Because variety is good. At Bitvise, our software supports ECDSA over NIST curves, and I'm going to implement EdDSA. However, if something turns out to be not-as-great-as-we-expected with elliptic crypto, RSA would be all we have left. 

Everything in elliptic curve is too many eggs in one basket, I reckon.

What's wrong with large-key DSA?

 ----- Original Message ----- From: Tony Arcieri  Sent: Wednesday, October 28, 2015 20:54 To: Stephen Farrell  Cc: [email-masked]  Subject: Re: [Cfrg] Fwd: Re: Proposal and intent to implement  "dsa-sha2-256" SSH key algorithm   Why are you trying to enhance DSA support when SSH has many better options  available? RSA support is ubiquitous, and both ECDSA and EdDSA are pretty common  now.   --    Tony Arcieri     -------- Forwarded Message -------- Subject: Re: Proposal and intent to implement "dsa-sha2-256" SSH key algorithm Date: Thu, 29 Oct 2015 00:25:37 +0000 From: denis bider <[email-masked]> To: [email-masked] CC: [email-masked], [email-masked], [email-masked], [email-masked], [email-masked]   I have whipped up a draft here:   http://www.denisbider.com/draft-dsa-sha2-256.txt

---

From: Damien Miller <[email-masked]>
Date: Sat, 31 Oct 2015 09:27:19 +1100 (AEDT)

On Thu, 29 Oct 2015, denis bider wrote:

> Because variety is good. At Bitvise, our software supports ECDSA over NIST
> curves, and I'm going to implement EdDSA. However, if something turns out to
> be not-as-great-as-we-expected with elliptic crypto, RSA would be all we
> have left.
> 

It breaks in the most catastrophic possible way (private key leak) when a
less-than-perfect PRNG is used.

-d

---

From: Hanno Böck <[email-masked]>
Date: Fri, 30 Oct 2015 23:37:26 +0100

On Thu, 29 Oct 2015 04:04:18 +0000
denis bider <[email-masked]> wrote:

> Because variety is good.

I think this is a dangerous statement with a very weak rationale.
Given what we've seen in the TLS space I think even the opposite is
true: We have a problem with too much complexity in crypto protocols -
and I'd take every chance to reduce it.

DSA has similar security as RSA, except that - as Damien Miller already
mentioned - DSA has a fatal weakness with bad random numbers.

There was a longer discussion about keeping DSA in the TLS WG and
almost everyone agreed that it should be dropped (except some who
argued we should keep it "in case someone needs it" but never could
name that "someone"). I think the rationales for SSH are pretty similar.
It's just one more alg that has no advantages (and one big
disadvantage) over the more widely used RSA that adds additional
complexity and thus attack surface.
Just drop it.

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: [email-masked]
GPG: BBB51E42

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Sat, 31 Oct 2015 08:15:20 +0900

> less-than-perfect PRNG is used.

What if we specify as a requirement the use of deterministic signatures
a la https://tools.ietf.org/html/rfc6979 --  would that relieve your
concern?

(I'm not advocating for DSA myself, but if bad entropy during signing is
the only reason to avoid it, it seems like something fixable)

    --dkg

---

From: Peter Gutmann <[email-masked]>
Date: Sat, 31 Oct 2015 00:55:16 +0000

Hanno Böck <[email-masked]> writes:

>[...]

+1 to all of that.  People who haven't seen the TLS discussion should read
that first, it pretty much covers all the bases why DSA isn't needed.

Peter.