pkcs11 — archive

[Robert Burns]

Oscar, Having looked at this in a bit more detail, I think I have a way forward. Basically, if you "squint at it" and ignore the issue surrounding supported key sizes (which I'll argue below), we could just update the text to indicate that DSA is FIPS 186 compatible and leave out the version information. The reason being that the implementation of DSA is consistent between all the documents (even if the nomenclature has evolved somewhat). And generally speaking, the later versions provide additional options (for prime generation), along with mandating certain key size restrictions, but do not "break" compatibility, (e.g. a FIPS 186-2 DSA implementation is compatible with a FIPS 186-4 standard in every way except supported key sizes below 1024 bits). But given that PKCS #11 is really just an interface, I feel it is probably ok to describe functionality with respect to a standard without having to take on the key size restrictions of that standard. It should be relatively easy to come up with language which indicates how the mechanism operates versus asserting compliance to a specific standard. What do you think -- does anyone else have any strong opinions (heck, even weak ones?) either way? Thanks, Bob P.S. Here are some 'back of the napkin' notes about DSA in the standards: In 186-2, -3, and -4 -- the DSA algorithms are all compatible (as you'd expect). If we concern ourselves about supported key sizes, then we have to worry about the following: In 186-2, the supported bit lengths of the various attributes are: L >= 512 and <= 1024 in 64 bit increments, N = 160 In 186-3/4, the supported bit lengths of the various attributes are: L = 1024, N = 160 L = 2048, N = 224 L = 2048, N = 256 L = 3072, N = 256 For Keygen, they are compatible with the 186-2 standard only describing probabilistic prime identification, and requiring >= 50 rounds of M-R, whereas 186-3/4 only requires 40, or alternatively, less when combined with a Lucas test for primality. Furthermore, there are additional options for prime generation (e.g. provably prime), etc. So realistically, the 186-2 standard is more rigorous than the later ones with respect to required rounds of M-R. >