2
$\begingroup$

I know there are recommendations of elliptic curve parameters (such as NIST P-xxx).

Are there recommendations of DSA (or DLP such as Schnorr signature) or RSA parameters?

If not, why?

$\endgroup$
  • $\begingroup$ Do you ask for keylengths or for concrete parameters that you can "just use" (like with ECC) $\endgroup$ – SEJPM Mar 17 '17 at 8:00
  • $\begingroup$ @SEJPM I meant concrete parameters. $\endgroup$ – takita Mar 17 '17 at 8:11
  • $\begingroup$ I can't answer right now but the TL;DR is "yes, but" for DSA and "no, but" for RSA. $\endgroup$ – SEJPM Mar 17 '17 at 8:13
2
$\begingroup$

Are there recommendations of DSA[...]?

Yes, but you really want to verify these parameters yourself. DSA uses - as parameters - $(p,q,g)$ such that $q\mid p-1$ and $\operatorname{ord}(g)=q$. Among other things you want to verify that $q$ is prime, that $p$ is prime, that $q\mid p-1$ indeed holds, that $g^q\bmod p=1$ (ie that $g$ has the alleged order), that $p>2^{2047}$ and that $q>2^{255}$.

Are there recommendations of [...] RSA [..]?

No, but you can re-use the public RSA exponent safely. To understand what can be shared and what not, we first need to understand the relevant RSA parameters which are $(N,e,d)$ such that $ed\equiv 1\pmod{\lambda(N)}$ where $\lambda(\cdot)$ is the carmichael function. Now note that $(N,e)$ forms the public key and given just $N$ recovering $e$ or $d$ from each other is equally hard (ie as hard as brute-forcing the value). Note however that given a valid $(N,e,d)$ one can recover the factorization of $N$ (by applying the classical part of Shor's algorithm) using which one can break all other key-pairs $(N,e')$ (by the same way you'd normally find $d$ when generating the key), so sharing $N$ is out, but sharing $e$ is fine and commonly done with the value $e=65537=2^{16}+1=F_4$, where $F_4$ is the fourth fermat number.

| improve this answer | |
$\endgroup$
  • $\begingroup$ I omitted the various attacks that are countered by the requirements for the first part, but can add them if wanted. $\endgroup$ – SEJPM Mar 17 '17 at 12:47
  • $\begingroup$ The parameters in 1 allow the respectable 2048-bit MODP Group with 256-bit Prime Order Subgroup in RFC 5114 section 2.3. $\endgroup$ – fgrieu Mar 17 '17 at 17:31
  • $\begingroup$ Thank you. Then, it seems there is not 'specific' number (such as p = '11', q = '3'), right? $\endgroup$ – takita Mar 18 '17 at 7:40
  • $\begingroup$ @minkyung: in RSA, there are no specific values of $p$ or $q$ recommended, because these numbers must remain secret, even is their product $n=p\cdot q$ is public. It follows that for actual systems, $p$ and $q$ must be large (150 decimal digits is barely adequate). Small $p$ and $q$ like you cite are used in illustrative examples only. $\endgroup$ – fgrieu Mar 18 '17 at 10:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.