Re: [TLS] DSS with other than SHA-1 algorithms

[Martin Rex <[e-mail]>]

Nikos Mavrogiannopoulos wrote:
> 
>  According to FIPS-186-3 the DSA algorithm might
> be used with hashes other than SHA-1. Moreover
> it mentions:
> "A hash function that provides a lower security strength than the (L, N)
> pair ordinarily should not be used, since this would reduce the
> security strength of the digital signature process to a level no greater
> than that provided by the hash function."
> 
> So what I understand from that is for the parameters
> discussed in the document the SHA variants allowed are:
> 
> L = 1024, N = 160: SHA-1 or better
> L = 2048, N = 224: SHA-224 or better
> L = 2048, N = 256: SHA-256 or better
> L = 3072, N = 256: SHA-256 or better
> 
> How does this apply to TLS 1.0 and 1.1 messages
> "Server Key Exchange" and "Certificate verify"
> that sign the handshake data? How is the peer
> going to understand which hash is being used?

By looking at the AlgId parameters of the DSA public key that
is involved in the signature operation.  The public prime q, whose
length (in bits) is described by the Parameter N above, is part of the
AlgId Parameters of that DSA public key.  (The L refers to the length
(in bits) of the public prime p, also part of the AlgId Parameters).

-Martin