FIPS 186 and X9.42: One of these things is not like the other
pgut001@cs.auckland.ac.nz (Peter Gutmann) Sun, 21 November 1999 01:01 UTC
Received: from ns.secondary.com (ns.secondary.com [208.184.76.39]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA19812 for <pkix-archive@odin.ietf.org>; Sat, 20 Nov 1999 20:01:21 -0500 (EST)
Received: from localhost (daemon@localhost) by ns.secondary.com (8.9.3/8.9.3) with SMTP id QAA04539; Sat, 20 Nov 1999 16:59:14 -0800 (PST)
Received: by mail.imc.org (bulk_mailer v1.12); Sat, 20 Nov 1999 16:59:11 -0800
Received: from mail.student.auckland.ac.nz (mail.student.auckland.ac.nz [130.216.35.101]) by ns.secondary.com (8.9.3/8.9.3) with ESMTP id QAA04480; Sat, 20 Nov 1999 16:56:37 -0800 (PST)
Received: from cs26.cs.auckland.ac.nz (pgut001@cs26.cs.auckland.ac.nz [130.216.36.9]) by mail.student.auckland.ac.nz (8.9.3/8.8.6/cs-master) with SMTP id NAA05024; Sun, 21 Nov 1999 13:58:13 +1300 (NZDT) (sender pgut001@cs.auckland.ac.nz)
Received: by cs26.cs.auckland.ac.nz (relaymail v0.9) id <94314589412790>; Sun, 21 Nov 1999 13:58:14 (NZDT)
From: pgut001@cs.auckland.ac.nz
To: ietf-pkix@imc.org, ietf-smime@imc.org
Subject: FIPS 186 and X9.42: One of these things is not like the other
Sender: pgut001@cs.auckland.ac.nz
Reply-To: pgut001@cs.auckland.ac.nz
X-Charge-To: pgut001
X-Authenticated: relaymail v0.9 on cs26.cs.auckland.ac.nz
Date: Sun, 21 Nov 1999 13:58:14 -0000
Message-ID: <94314589412790@cs26.cs.auckland.ac.nz>
Precedence: bulk
List-Archive: http://www.imc.org/ietf-pkix/mail-archive/
List-ID: <ietf-pkix.imc.org>
List-Unsubscribe: mailto:ietf-pkix-request@imc.org?body=unsubscribe
FIPS 186/X9.30 and X9.42 (and by extension RFC 2631) share the same key generation algorithm, and have domain parameters which look identical, however there are two subtle differences between them, one of which is really annoying. The annoying difference is that when writing the domain parameters, the order of q and g is reversed for FIPS 186 and X9.42 keys, so that while DSA domain parameters are written (p, q, g), exactly the same domain parameters when viewed as X9.42 values are written (p, g, q). This isn't helped by the fact that in many fonts lowercase q and g look very similar. Apart from the fact that it's a booby-trap for implementors, it also means that if the domain parameters are identified in the traditional way (SHA-1 hash), identical parameters will appear to be different depending on whether you're interpreting them as DSA/KEA or DH parameters. The second difference is in the allowed range for x: FIPS 186: 0 < x < q (ie x = 1...q-1) X9.42: 1 < x <= q-2 in one place, [2...q-2] in another (ie x = 2..q-2) This looks like a transcription error from FIPS 186, given that using any x < ~2^160 is unsound I can't see why there'd be any difference between 1 and 2 as a lower bound. Perhaps new RFC's which cover this (eg son-of-RFC2459) could include warnings to the effect that although the parameters are the same internally, their external representations differ. Does anyone know why X9.42 decided to reverse the parameter order? (The motivation for this post is that ages ago I solved the problem of the reversed parameters by swapping the pointers for the X9.42 g and q values so they were read and written in the correct order, recently I was looking through the code and wondered why it was working fine for both interpretations of parameter ordering. There's now a big comment block by the code explaining the Bug which Isn't) Peter.
- FIPS 186 and X9.42: One of these things is not li… Peter Gutmann
- RE: FIPS 186 and X9.42: One of these things is no… John C. Kennedy
- Re: FIPS 186 and X9.42: One of these things is no… Ben Laurie
- RE: FIPS 186 and X9.42: One of these things is no… John C. Kennedy
- RE: FIPS 186 and X9.42: One of these things is no… Don Johnson
- RE: FIPS 186 and X9.42: One of these things is no… Russ Housley
- RE: FIPS 186 and X9.42: One of these things is no… Russ Housley
- RE: FIPS 186 and X9.42: One of these things is no… Don Johnson
- RE: FIPS 186 and X9.42: One of these things is no… Russ Housley
- RE: FIPS 186 and X9.42: One of these things is no… John C. Kennedy
- RE: FIPS 186 and X9.42: One of these things is no… Don Johnson
- RE: FIPS 186 and X9.42: One of these things is no… John C. Kennedy
- Re: FIPS 186 and X9.42: One of these things is no… Peter Gutmann
- RE: FIPS 186 and X9.42: One of these things is no… Russ Housley
- RE: FIPS 186 and X9.42: One of these things is no… John C. Kennedy