Re: SSH non-compliance with FIPS 186

[Damien Miller <djm%mindrot.org@localhost>]

On Tue, 15 Apr 2008, Peter Gutmann wrote:

> The real problem is the problematic use of 'dss_signature_blob', which
> (unlike all other public-key related formats) uses a fixed size for
> the fields, with no provision for specifying length information. Since
> it's unlikely that everyone will change their implementations to limit
> DSA keys to 1024 bits as is required for FIPS compliance when q = 160
> bits, I'd like to propose a correction to the spec with a new DSA sig
> format:
>
>   string    "ssh-dss-fips"    // Or whatever
>   mpint     r
>   mpint     s
> 
> to allow use with with keys generated according to FIPS 186.  Comments?

Should this include the hash algorithm too? You could figure it out from
the lengths of r and s, but things could become ambiguous if a future DSA
spec lists new hashes with 160 or 256 bit digest lengths.

-d