FIPS 186 and X9.42: One of these things is not like the other

pgut001@cs.auckland.ac.nz (Peter Gutmann) Sun, 21 November 1999 01:01 UTC

Received: from ns.secondary.com (ns.secondary.com [208.184.76.39]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA19812 for <pkix-archive@odin.ietf.org>; Sat, 20 Nov 1999 20:01:21 -0500 (EST)
Received: from localhost (daemon@localhost) by ns.secondary.com (8.9.3/8.9.3) with SMTP id QAA04539; Sat, 20 Nov 1999 16:59:14 -0800 (PST)
Received: by mail.imc.org (bulk_mailer v1.12); Sat, 20 Nov 1999 16:59:11 -0800
Received: from mail.student.auckland.ac.nz (mail.student.auckland.ac.nz [130.216.35.101]) by ns.secondary.com (8.9.3/8.9.3) with ESMTP id QAA04480; Sat, 20 Nov 1999 16:56:37 -0800 (PST)
Received: from cs26.cs.auckland.ac.nz (pgut001@cs26.cs.auckland.ac.nz [130.216.36.9]) by mail.student.auckland.ac.nz (8.9.3/8.8.6/cs-master) with SMTP id NAA05024; Sun, 21 Nov 1999 13:58:13 +1300 (NZDT) (sender pgut001@cs.auckland.ac.nz)
Received: by cs26.cs.auckland.ac.nz (relaymail v0.9) id <94314589412790>; Sun, 21 Nov 1999 13:58:14 (NZDT)
From: pgut001@cs.auckland.ac.nz
To: ietf-pkix@imc.org, ietf-smime@imc.org
Subject: FIPS 186 and X9.42: One of these things is not like the other
Sender: pgut001@cs.auckland.ac.nz
Reply-To: pgut001@cs.auckland.ac.nz
X-Charge-To: pgut001
X-Authenticated: relaymail v0.9 on cs26.cs.auckland.ac.nz
Date: Sun, 21 Nov 1999 13:58:14 -0000
Message-ID: <94314589412790@cs26.cs.auckland.ac.nz>
Precedence: bulk
List-Archive: http://www.imc.org/ietf-pkix/mail-archive/
List-ID: <ietf-pkix.imc.org>
List-Unsubscribe: mailto:ietf-pkix-request@imc.org?body=unsubscribe

FIPS 186/X9.30 and X9.42 (and by extension RFC 2631) share the same key
generation algorithm, and have domain parameters which look identical, however
there are two subtle differences between them, one of which is really annoying.

The annoying difference is that when writing the domain parameters, the order
of q and g is reversed for FIPS 186 and X9.42 keys, so that while DSA domain
parameters are written (p, q, g), exactly the same domain parameters when
viewed as X9.42 values are written (p, g, q).  This isn't helped by the fact
that in many fonts lowercase q and g look very similar.  Apart from the fact
that it's a booby-trap for implementors, it also means that if the domain
parameters are identified in the traditional way (SHA-1 hash), identical
parameters will appear to be different depending on whether you're interpreting
them as DSA/KEA or DH parameters.

The second difference is in the allowed range for x:

  FIPS 186: 0 < x < q (ie x = 1...q-1)
  X9.42: 1 < x <= q-2 in one place, [2...q-2] in another (ie x = 2..q-2)

This looks like a transcription error from FIPS 186, given that using any
x < ~2^160 is unsound I can't see why there'd be any difference between 1 and 2
as a lower bound.

Perhaps new RFC's which cover this (eg son-of-RFC2459) could include warnings
to the effect that although the parameters are the same internally, their
external representations differ.

Does anyone know why X9.42 decided to reverse the parameter order?

(The motivation for this post is that ages ago I solved the problem of the
 reversed parameters by swapping the pointers for the X9.42 g and q values so
 they were read and written in the correct order, recently I was looking
 through the code and wondered why it was working fine for both interpretations
 of parameter ordering.  There's now a big comment block by the code explaining
 the Bug which Isn't)
 
Peter.