Re: [pkix] Question about Curve P-192

[Ernst G Giessmann <[e-mail]>]

Am 2018-05-11 um 12:09 schrieb Denis:
> Michael,
>
> I don't see how RFC 5480 can be used to obtain an *identifier* for a
> cryptographic *suite* for both P-192 and
> a SHA-256 hash function truncated to 192 bits.
>
> In between, I got a response why the leftmost bits shall be used.
>
> Close to the end of section 6.4NIST FIPS 186-4
> <http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf> states:
>
>     When the length of the output of the hash function is greater than
>     the bit length of /n/, then the *leftmost **/n/**bits* of the hash
>     function
>     output block *shall be used* in any calculation using the hash
>     function output during the generation or verification of a digital
>     signature.
>
>     A hash function that provides a lower security strength than the
>     security strength associated with the bit length of n ordinarily
>     *should not*
>     be used, since this would reduce the security strength of the
>     digital signature process to a level no greater than that provided
>     by the hash function.
>
Yes, and therefore you can use any hash function (in the sense of ISO),
because the output of a hash function is **always** a bit string.
/Ernst.