1

Lately I did a bit of research about the Digital Signature Algorithm and how it works. My question according to this is of no practical matter for me but of pure interest.

However, I'm curious how to generate the subprime in DSA: Somewhere during the generation of the parameters for the algorithm one chooses a 1024-bit prime p. The next step is to find a 160-bit prime q which is a divisor of p-1. That's where I get stuck. I have no idea how to find that subprime q in time, without having to wait forever. I also couldn't find any documentation about that particular part of DSA on the internet and all the example implementations I've found use library functions to create the parameters.

Does anyone know more about that subprime generation or can lead me to a place where I can read about it?

Thanks in advance.

j0ker
  • 4,069
  • 4
  • 43
  • 65
  • I don't know anything, but have you considered digging into the OpenSSL source code? (or PGP/SSH/etc) Surely you can find the key generation and read the comments/code? – Zoredache Dec 02 '11 at 17:22
  • 2
    FIPS PUB 186 - http://www.itl.nist.gov/fipspubs/fip186.htm – Zoredache Dec 02 '11 at 17:31
  • Thank you! That is exactly what I was looking for. If you had written an answer I could accept you ;) – j0ker Dec 02 '11 at 18:59
  • I did add an answer, but I think it would be a lot better if you would self-answer with the actual details. I don't think a link to the documentation is a good answer. A good summary would be useful to have here. – Zoredache Dec 02 '11 at 19:07
  • Even though it might be interesting to implement an own algorithm to calculate `p` and `q`, a more practical approach would be to use use pre-calculated values. The NSA has made some `p`,`q` and `g` for different key-sizes available as public domain: http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/DSA2_All.pdf – Torben Jun 08 '13 at 20:32

4 Answers4

4

As suggested by Zoredache: The algorithm to create the pair of primes p and q for DSA, found in the Digital Signature Standard.

Let L-1 = 160*n + b, where b,n ∈ ℕ and 0 ≤ b < 160

  1. Choose a random number seed > 2¹⁶⁰. Let g be the length of seed in bits.
  2. U = sha(seed) XOR sha(seed+1 mod 2^g) (where sha is the Secure Hash Algorithm)
  3. q = U OR 2¹⁵⁹ OR 1
  4. Test if q is prime, if not go to step 1.
  5. counter = 0, offset = 2
  6. For k = 0,...,n: V_k = sha((seed + offset + k) mod 2^g)
  7. W = V_0 + V_1 * 2^160 + ... + V_(n-1) * 2^((n-1)*160) + (V_n mod 2^b) * 2^(n*160)
  8. X = W + 2^(L-1)
  9. c = X mod 2*q
  10. p = X - (c-1)
  11. If p < 2^(L-1) go to step 13.
  12. Test if p is prime, if so go to step 15.
  13. counter = counter + 1, offset = offset + n + 1
  14. If counter >= 4096 go to step 1, if not go to step 7.
  15. We have now p and q so that q is a divisor of p-1.

I hope I did not get anything wrong. I didn't understand everything completely yet but the major trick is to calculate p out of q instead of trying the opposite thing.

j0ker
  • 4,069
  • 4
  • 43
  • 65
2

Saying that q divides p-1 is the same as saying that p ≡ 1 mod q.

The FIPS method essentially shifts and adds successive hash outputs to build a pseudorandom chunk of the correct size, and then subtracts a remainder such that p ≡ 1 mod 2q, and finally tests for primality. The only 'real' entropy in the process is the random seed.

Note also that the old FIPS-186 above is 'hardcoded' for 160 bit q

If you have plenty of entropy you can just as easily get a chunk of random from a good source, set the top and bottom bits to 1, subtract ((p mod q)-1) then test that for primality.

Digital_Reality
  • 4,488
  • 1
  • 29
  • 31
ben
  • 21
  • 1
2

I don't know much about it personally, but I did a quick grep through the OpenSSL source code and it mentioned the Federal Information Processing Standards Publication 186 as the document that the implementation was based on.

Zoredache
  • 37,543
  • 7
  • 45
  • 61
-1

I don't think that's right. If you can factor p-1, then you can easily factor the public key, which is really bad.

The usual key generation takes two large primes p and q, of equal bit length; their product n=pq becomes the modulus of the cryptosystem. The totient of n is computed as phi(pq)=(p-1)(q-1). Then two keys are chosen, the encryption key e and the decryption key d, such that de ≡ 1 (mod phi(pq)) and gcd(e, phi(pq)) = 1. E must be odd, is frequently chosen to be prime to force the condition that it is co-prime to the totient, and is generally fairly small; e=2^16+1=65537 is common.

I wrote code for RSA, including key generation, at my blog.

user448810
  • 17,381
  • 4
  • 34
  • 59
  • 1
    That's completely correct. However, I didn't ask for how RSA works since that is clear to me. My question is about DSA which is not an encryption algorithm but an algorithm to create digital signatures. – j0ker Dec 02 '11 at 15:58
  • 1
    Let me try to redeem myself: Choose q first, where q is a random integer in the range 2^159 to 2^160; if q is not prime, try again. Choose k as a random even integer in the range 2^1023/q to 2^1024/q. Multiply q by k and add 1 to compute p, then test if p is prime; if not, try a different k. – user448810 Dec 02 '11 at 19:23