DSA and SHA-256 (It works! Or does it?! :))
wk at gnupg.org
Wed Jan 13 10:27:12 CET 2010
On Wed, 13 Jan 2010 17:32:31 +1300, Sam Vilain wrote:
> That being said, I see in the source eg g10/sign.c that this case is
> well described already. I can't find the exact source line where this
> truncation happens, but I assume it does somewhere.
size_t qbytes = gcry_mpi_get_nbits (pk?pk->pkey:sk->skey);
[... check qbytes ... ]
if (gcry_mpi_scan (&frame, GCRYMPI_FMT_USG,
gcry_md_read (md, hash_algo), qbytes, &qbytes))
gcry_mpi_scan does the truncation.
> What is in that subpacket? Pulling it apart (using
> Crypt::OpenPGP::Message), I can see that r is
> 563842300114387388457394839662831482428878447936 and s is
> 377105405312767191687013088546003017320679158753 - definitely both <160 bit.
FWIW, you may use gpg --debug 2 --list-packets to show the MPIs.
> 1. is gpg doing the correct, FIPS-186-3 thing of throwing away the lower
Libgcrypt does not enforce this because FIPS-186-2 does not seem to
require it. Libgcrypt is currently in NIST's evaluation queue but the
project was started far prior to June 2009 when -3 was released.
> 2. is this safe?
We hope so.
Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.
More information about the Gnupg-devel