I'm preparing for an examination of an Information Security course at university, but I'm not sure about an explanation I created for a specific exercise. The question is:
There are now DSA versions using a 2048 bit prime number. Which hash function would you choose?
My answer:
The goal of the hash function is to provide enough security, while not being overkill for it's application. DSA works by choosing a prime number p (of length 2048 bits in this case), and a prime number q (160 bits for the 1024 bits case of p, so more than 160 bits for the 2048 bit case). Then the value s is generated by calculating s = [k^-1 * (H(M) + x * r)] mod q (with x being the private key and r being a value that was generated earlier in the process). Now because the generated value is calculated mod q, the result is no longer than q itself.
It is thus pointless (or overkill) to use a hash function that produces values with more than |q| bits. We know that |q| > 160 bits (and it will presumably be no longer than 256 bits). This allows us to choose for SHA-256 as an appropriate hash function, as it is not yet known to be broken, and produces the smallest hash values not known to lower the degree of security of our DSA algorithm.
Is this a correct explanation for this problem? I can't seem to find the rational behind some hash function choices for DSA elsewhere.