Re: I-D ACTION:draft-schaad-dhsign-00.txt

[EKR <[e-mail]>]

"Jim Schaad (Exchange)" <[e-mail]> writes:
> This draft is referenced from the new CMC draft so it should be of interest
> to the readers of that draft.
Jim, 
First, a meta-comment:
Why do we need this at all? DH keys are suitable for computing
DSA signatures. Wouldn't it be simpler just to compute a DSA
signature over the data? This would eliminate the need for a common
group between the sender and recipient.

Secondly, I don't believe that the ephemeral scheme is strong.
Provided that the attacker has access to the triplet
g,p,Ys (sender's public key), it's trivial for him to compute
a private key Xe such that he knows:
  
Ye^Xe = g^(XsXe) 

This allows him to forge any number of signed messages
Remember, computing the DH shared secret requires access
to only one of the DH private keys.

I hesitate to bring this up because I'm sure I'm missing something
really obvious, but I sure can't see what it is.

Confused,
-Ekr

-- 
[Eric Rescorla                                   [e-mail]]