Re: SSH non-compliance with FIPS 186

[nisse%lysator.liu.se@localhost (Niels Möller)]

pgut001%cs.auckland.ac.nz@localhost (Peter Gutmann) writes:

>>Should this include the hash algorithm too? You could figure it out from the
>>lengths of r and s, but things could become ambiguous if a future DSA spec
>>lists new hashes with 160 or 256 bit digest lengths.

Agree, I was just about to suggest that.

And if r and s are coded as mpint, rather than fixed size strings,
then you can't infer the hash size from the sizes of r and s in a 100%
reliable manner, only with a very high probability...

> At the moment there's only SHA-1 and SHA-256 specified, so I'd
> suggest:
>
>   "ssh-dsa"        // Implies the traditional "with SHA-1"

I'm not sure it makes much sense to introduce this alternative to the
old "ssh-dss" now, even if we all agree the old way is ugly. And if
you really want to introduce it, why not use "ssh-dsa-sha1", to be
explicit?

>   "ssh-dsa-sha256" // Self-explanatory

This makes a lot of sense, and seems like a useful addition.

And about the details of the naming (one of the great unsolved
problems in CS ;-), the "ssh-"-prefix seems somewhat redundant, but
maybe it's good for consistency.

/Niels