Re: [TLS] DSS with other than SHA-1 algorithms

[Nikos Mavrogiannopoulos <[e-mail]>]

On Thu, Feb 10, 2011 at 3:03 PM, Martin Rex <[e-mail]> wrote:
>> "A hash function that provides a lower security strength than the (L, N)
>> pair ordinarily should not be used, since this would reduce the
>> security strength of the digital signature process to a level no greater
>> than that provided by the hash function."
[...]
>> L = 1024, N = 160: SHA-1 or better
>> L = 2048, N = 224: SHA-224 or better
>> L = 2048, N = 256: SHA-256 or better
>> L = 3072, N = 256: SHA-256 or better
>> How does this apply to TLS 1.0 and 1.1 messages
>> "Server Key Exchange" and "Certificate verify"
>> that sign the handshake data? How is the peer
>> going to understand which hash is being used?
> By looking at the AlgId parameters of the DSA public key that
> is involved in the signature operation.  The public prime q, whose
> length (in bits) is described by the Parameter N above, is part of the
> AlgId Parameters of that DSA public key.  (The L refers to the length
> (in bits) of the public prime p, also part of the AlgId Parameters).

The problem is that FIPS-186-3 says you can use SHA-224
if N=224, or SHA-256 and truncate it to 224 bit. So the algorithm
needs to be explicit here...

regards,
Nikos