Security level of DSA when $q$ is a 224 bit prime?

What is the security level of DSA algorithm when $q$ is a 224 bit prime?

Is it always a simple rule that the security level is the bit length of $q$ divided by two ?

• 112, see page 67 Feb 27 '21 at 0:04
• Thank you for that link. I think you mean page 54.
– Gabi23
Feb 27 '21 at 0:18
• Yes, I've given the pdf page, and you see the doc page, :) Feb 27 '21 at 0:20
• Does 112 mean it takes $2^{112}$ operations to solve the discrete logarithm problem in the DSA algorithm? Feb 27 '21 at 18:15

What is the security level of DSA algorithm when q is a 224 bit prime?

About 112-bit, at most. More precisely, there's an attack recovering the private key from the public key, by solving a Discrete Logarithm Problem, costing roughly $$2^{113}$$ modular multiplications, and little else: the attack can be efficiently distributed and requires little memory. See Paul C. van Oorschot and Michael J. Wiener, Parallel Collision Search with Cryptanalytic Applications, in Journal of Cryptology, 1999.

Is it always a simple rule that the security level is the bit length of $$q$$ divided by two ?

No. That rule applies unless there's another weakness:

• The public prime $$p$$ is too small (or of a special form facilitating attack). As a rule of thumb, size (and requirement to not be too close to an exact power) are comparable to that of $$n$$ in RSA for the desired security level, in order to resist index calculus and GNFS variants. That would make about 2048-bit a minimum. See KeyLength.com for more precise advice on size.
• The random generator used for signing has an exploitable weakness.
• The private key leaks, e.g. by power analysis or timing attack.
• Thank you. Does $2^{113}$ operations refer to the number of operations needed to solve the discrete logarithm problem which cracks the DSA algorithm? Feb 27 '21 at 17:36