3

In FIPS 186-1 and 186-2 L could be any number between 512 and 1024 (inclusive) that was a multiple of 64. N was fixed at 160.

FIPS 186-3 changed it so that L and N could be any combination of the following:

  • L = 1024, N = 160
  • L = 2048, N = 224
  • L = 2048, N = 256
  • L = 3072, N = 256

RFC 4253 (SSH Transport Layer Protocol) says the following:

   The resulting signature is encoded as follows:

      string    "ssh-dss"
      string    dss_signature_blob

   The value for 'dss_signature_blob' is encoded as a string containing
   r, followed by s (which are 160-bit integers, without lengths or
   padding, unsigned, and in network byte order).

So I take it this means SSH does not support 2048-bit DSA? Are there no RFCs that add support for them? No vendor extensions?

2

Crossdupe https://crypto.stackexchange.com/questions/15051/why-does-openssh-use-only-sha1-for-signing-and-verifying-of-digital-signatures but probably better here.

A recent answer there links to https://www.openssh.com/txt/release-7.2 (of 2016-02-28) which refers to now-expired https://tools.ietf.org/html/draft-rsa-dsa-sha2-256-03 which despite the name only upgrades RSA to SHA2, with section 6 explaining that DSA was dropped, as does its still-draft replacement https://tools.ietf.org/html/draft-ietf-curdle-rsa-sha2-02 .

You can easily confirm no other RFC has changed this in the IANA registry for SSH.

And OpenSSH since 7.0 has deprecated and disabled by default (all) DSA. There were numerous Qs here and related stacks late last year about this e.g.:
Why OpenSSH deprecated DSA keys
https://unix.stackexchange.com/questions/247612/ssh-keeps-skipping-my-pubkey
https://superuser.com/questions/962918/pubkeyacceptedkeytypes-and-ssh-dsa-key-type
So they aren't likely to implement improvements to DSA, and anyone else who pushes something incompatible with OpenSSH usually finds it unused.

"Sorry, Charlie."

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.