Subject: [Cfrg] Fwd: Re: Proposal and intent to implement "dsa-sha2-256" SSH key algorithm

From: denis bider <[email-masked]>
Date: Thu, 29 Oct 2015 01:20:04 +0000

Thanks, Stephen!

I don't mind if those who don't subscribe to the SSH mailing list comment on this list. Others on the SSH mailing list might not read, but I'm here based on Stephen's suggestion, so it will get to me.

denis

----- Original Message -----
From: Stephen Farrell 
Sent: Wednesday, October 28, 2015 18:34
To: [email-masked] 
Subject: [Cfrg] Fwd: Re: Proposal and intent to implement "dsa-sha2-256" SSH key algorithm

FYI, some discussion on ssh list of larger key sizes for dsa
in ssh. Be interested in folks' opinions about this if you
care to express them on the ssh list.

TIA,
S.

-------- Forwarded Message --------
Subject: Re: Proposal and intent to implement "dsa-sha2-256" SSH key
algorithm
Date: Thu, 29 Oct 2015 00:25:37 +0000
From: denis bider <[email-masked]>
To: [email-masked]
CC: [email-masked], [email-masked], [email-masked],
[email-masked], [email-masked]

I have whipped up a draft here:

http://www.denisbider.com/draft-dsa-sha2-256.txt

At this point, I'm most uncertain about whether we should allow the
following option also:

   L = 2048, N = 224

Arguments for:

- No apparent interoperability reason to exclude it.
- Perhaps there are DSA implementations that don't easily support
setting subgroup size, and can only easily generate the N=224 option?
Does anyone know of one?

Arguments against:

- Slightly weaker than N = 256

Any comments? Thoughts?