Add a New Comment (Rich Markup)
Comment Type & Canned Response: None None
Is this really a bug? In the new versions of gnutls (2.11) we suggest the --sec-param option instead of bits. The sec-param has as input low|normal|high|ultra and will use bit numbers allowed by FIPS documents.
According to FIPS 186 version 1 and 2, a DSA modulus must be between 512 and 1024 in steps of 64 (512, 576, 640, ..., 960, 1024). See section 4, DSA PARAMETERS, of http://csrc.nist.gov/publications/fips/fips1861.pdf and http://csrc.nist.gov/publications/fips/archive/fips186-2/fips186-2.pdf.
In addition, at version 2, only moduli of 1024 bits were recommended.
At FIPS 186 version 3, moduli of 1024 or higher are required. See http://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf.
Below, certtool is creating a dsa key with 513 bits without error (not a multiple of 64 bits) nor warning (less than 1024 bits).
$ certtool --dsa --generate-privkey --pkcs8 --outder --bits 513 --outfile dsa-gnutls.der Generating a 513 bit DSA private key... Enter password: Confirm password: $
===================
$ uname -a Linux studio 2.6.32-25-generic #45-Ubuntu SMP Sat Oct 16 19:52:42 UTC 2010 x86_64 GNU/Linux $ certtool --version certtool (GnuTLS) 2.8.5 Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>. ...
(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)
Attach Files: Comment:
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Only logged-in users can vote.
Please enter the title of George Orwell's famous dystopian book (it's a date):
Follow 4 latest changes.
Copyright © 2022 Free Software Foundation, Inc. Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved. The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team. Source Code
Powered by Savane 3.9