helpGnuTLS - Support: sr #107520, GnuTLS: certtool accepts invalid...

 
 

sr #107520: GnuTLS: certtool accepts invalid DSA modulus sizes

Submitted by:  Jeffrey Walton <noloader>
Submitted on:  Tue 16 Nov 2010 12:39:23 PM UTC
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  None
Privacy:  Public Assigned to:  nmav
Open/Closed:  Closed Operating System:  None
* Mandatory Fields

Add a New Comment (Rich Markup)
   

Comment Type & Canned Response:
       

 

Tue 16 Nov 2010 02:53:13 PM UTC, comment #1: 

Is this really a bug? In the new versions of gnutls (2.11) we suggest the --sec-param option instead of bits. The sec-param has as input low|normal|high|ultra and will use bit numbers allowed by FIPS documents.

Nikos Mavrogiannopoulos <nmav>
Project Administrator
Tue 16 Nov 2010 12:39:23 PM UTC, original submission:  

According to FIPS 186 version 1 and 2, a DSA modulus must be between 512 and 1024 in steps of 64 (512, 576, 640, ..., 960, 1024). See section 4, DSA PARAMETERS, of http://csrc.nist.gov/publications/fips/fips1861.pdf and http://csrc.nist.gov/publications/fips/archive/fips186-2/fips186-2.pdf.

In addition, at version 2, only moduli of 1024 bits were recommended.

At FIPS 186 version 3, moduli of 1024 or higher are required. See http://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf.

Below, certtool is creating a dsa key with 513 bits without error (not a multiple of 64 bits) nor warning (less than 1024 bits).

$ certtool --dsa --generate-privkey --pkcs8 --outder --bits 513 --outfile dsa-gnutls.der
Generating a 513 bit DSA private key...
Enter password:
Confirm password:
$

===================

$ uname -a
Linux studio 2.6.32-25-generic #45-Ubuntu SMP Sat Oct 16 19:52:42 UTC 2010 x86_64 GNU/Linux
$ certtool --version
certtool (GnuTLS) 2.8.5
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
...

Jeffrey Walton <noloader>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nmav (Posted a comment)
  • -email is unavailable- added by noloader (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

     

     

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-12-19 nmav Open/ClosedOpen => Closed
        StatusIn Progress => None
    2010-11-16 nmav StatusNone => In Progress
        Assigned toNone => nmav

    Back to the top


    Powered by Savane 3.9