helpGnuTLS - Support: sr #107520, GnuTLS: certtool accepts invalid...


sr #107520: GnuTLS: certtool accepts invalid DSA modulus sizes

Submitted by:  Jeffrey Walton <noloader>
Submitted on:  Tue 16 Nov 2010 12:39:23 PM UTC
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  None
Privacy:  Public Assigned to:  nmav
Open/Closed:  Closed Operating System:  None
* Mandatory Fields

Add a New Comment (Rich Markup)

Comment Type & Canned Response:


Tue 16 Nov 2010 02:53:13 PM UTC, comment #1: 

Is this really a bug? In the new versions of gnutls (2.11) we suggest the --sec-param option instead of bits. The sec-param has as input low|normal|high|ultra and will use bit numbers allowed by FIPS documents.

Nikos Mavrogiannopoulos <nmav>
Project Administrator
Tue 16 Nov 2010 12:39:23 PM UTC, original submission:  

According to FIPS 186 version 1 and 2, a DSA modulus must be between 512 and 1024 in steps of 64 (512, 576, 640, ..., 960, 1024). See section 4, DSA PARAMETERS, of and

In addition, at version 2, only moduli of 1024 bits were recommended.

At FIPS 186 version 3, moduli of 1024 or higher are required. See

Below, certtool is creating a dsa key with 513 bits without error (not a multiple of 64 bits) nor warning (less than 1024 bits).

$ certtool --dsa --generate-privkey --pkcs8 --outder --bits 513 --outfile dsa-gnutls.der
Generating a 513 bit DSA private key...
Enter password:
Confirm password:


$ uname -a
Linux studio 2.6.32-25-generic #45-Ubuntu SMP Sat Oct 16 19:52:42 UTC 2010 x86_64 GNU/Linux
$ certtool --version
certtool (GnuTLS) 2.8.5
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <>.

Jeffrey Walton <noloader>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by nmav (Posted a comment)
  • -email is unavailable- added by noloader (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.





    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-12-19 nmav Open/ClosedOpen => Closed
        StatusIn Progress => None
    2010-11-16 nmav StatusNone => In Progress
        Assigned toNone => nmav

    Back to the top

    Powered by Savane 3.9