AlgorithmParameterGenerators

Description:

[[need more detail]]

References:

• [Inf] Whitfield Diffie et al,
  "New Directions in Cryptography,"
  IEEE Transactions on Information Theory, vol. IT-22, No. 6, pp. 644-654. November 1976.
• [An] Paul C. van Oorschot, Michael J. Wiener,
  "On Diffie-Hellman Key Agreement with Short Exponents,"
  Advances in Cryptology - EuroCrypt '96. Springer-Verlag.

Parameters:

• BigInteger p [read] - the prime modulus, p
• BigInteger g [read] - the base, g
• BigInteger order [optional, read] - the order of the subgroup generated by g (see comment below)

Comment:

If the order parameter is present, then encryption or key agreement will be done in the subgroup of the given order generated by g. I.e. the random value k used to calculate g^k will be a "short exponent" in the range [1, order]. Implementations MAY exclude 1 and order from this range, if the definition of the encryption or key agreement algorithm allows it (since they occur with negligable probability, this will not affect security).

Security comments:

• p should typically be at least 1024 bits in length.
• order, if present, should be at least 2¹⁶⁰, and preferably prime.

Description:

The parameter generation algorithm described in NIST FIPS PUB 186 for DSA.

Alias:

"1.2.840.10040.4.3"

Length:

The length, in bits, of the modulus p. This can be any integer that is a multiple of 8, greater than or equal to 512.

References:

• [Def] U.S. National Institute of Standards and Technology,
  "Digital Signature Standard,"
  NIST FIPS PUB 186, U.S. Department of Commerce.
  http://www.itl.nist.gov/div897/pubs/fip186.htm and http://www.itl.nist.gov/div897/pubs/186chg-1.htm
• [Inf] Bruce Schneier,
  "Section 20.1 Digital Signature Algorithm (DSA),"
  Applied Cryptography, Second Edition, John Wiley & Sons, 1996.
• [Inf] IEEE,
  IEEE P1363: Standard Specifications For Public Key Cryptography.
  http://grouper.ieee.org/groups/1363/P1363/index.html
• [An] Serge Vaudenay,
  "Hidden collisions on DSS,"
  Advances in Cryptology - Crypto '96, Volume 1109 of Lecture Notes in Computer Science, pp. 83-88. Springer-Verlag, 1996.
  ftp://ftp.ens.fr/pub/reports/liens/liens-96-9.A4.ps.Z

Parameters:

• BigInteger p [read] - the prime modulus, p
• BigInteger q [read] - a prime factor of p-1, q
• BigInteger g [read] - h^(p-1)/q mod p, where h is less than p-1 and g > 1

Parameter defaults:

The following default parameter values are used for lengths of 512, 768, and 1024 bits.

Modulus	Seed	Counter
512 bits	b869c82b 35d70e1b 1ff91b28 e37a62ec dc34409b	123
768 bits	77d0f8c4 dad15eb8 c4f2f8d6 726cefd9 6d5bb399	263
1024 bits	8d515589 4229d5e6 89ee01e6 018a237e 2cae64cd	92

These seed values come from Appendix B of Sun/Javasoft's JCE specification.

Description:

[[need more detail]]

References:

• [Def] Taher Elgamal,
  "A Public-Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms,"
  IEEE Transactions on Information Theory, v. IT-31, n. 4, 1985, pp. 469-472, or
  Advances in Cryptology - CRYPTO '84, pp. 10-18, Springer-Verlag, 1985.
• [Inf] D. Bleichenbacher,
  "Generating ElGamal signatures without knowing the secret key,"
  Advances in Cryptology - EUROCRYPT '96 (corrected version), Volume 1070 of Lecture Notes in Computer Science, pp. 10-18. Springer Verlag, 1996.
  ftp://ftp.inf.ethz.ch/pub/publications/papers/ti/isc/ElGamal.ps

PublicKey parameters:

• BigInteger p [read] - the prime modulus, p
• BigInteger g [read] - the base, g

Comment:

Use of "short exponents" is not supported.

Security comments:

• p and g SHOULD be chosen so that p is a safe prime, i.e. such that (p-1)/2 is prime, and g generates the order (p-1)/2 subgroup of GF(p).
• The paper by Bleichenbacher referenced above shows that if g has only small prime factors, and if g divides the order of the group it generates, then signatures can be forged. Implementations MUST NOT generate parameters that would allow this attack.

Author: David Hopwood <david.hopwood@zetnet.co.uk> Current maintainer: David Hopwood <david.hopwood@zetnet.co.uk> Copyright © 1995-2001 The Cryptix Foundation Limited and David Hopwood. All rights reserved. Cryptix is a trademark of The Cryptix Foundation Limited.