[ pycrypto-Bugs-1112191 ] DSA with MD5

Bugs item #1112191, was opened at 2005-01-29 13:54
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=120937&aid=1112191&group_id=20937

Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: seth hardy (thirdson)
Assigned to: Nobody/Anonymous (nobody)
Summary: DSA with MD5

Initial Comment:
in the demo of digital signatures, you use MD5 as the
hash algorithm for using DSA. i don't know if this is
promoted elsewhere in the library, but i've seen people
using your code use MD5 for DSA because it seems to be
implied as the proper means of use? not sure, but i've
seen it out there.

either way, using MD5 as the hash algorithm breaks the
DSA spec as defined in FIPS 186. so basically if you
use MD5, you're not really using DSA, you're using
something similar to DSA. the problem is that you are
using the hash to get a 160 bit value; SHA-1 gives a
160 bit value, while MD5 only gives 128 bit. in
addition to breaking spec, you also get a weaker
digital signature because of a smaller intermediate
value used. (this is in addition to any debates of how
badly MD5 is broken, what with the recent collisions
found and all.)

at the very least, you should change the demo so you're
actually using DSA as is implied/intended by the
code... since you're not doing the hashing in the
actual DSA implementation code itself there's nothing
to fix there, just be advised that using MD5 means
you're not using DSA anymore.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=120937&aid=1112191&group_id=20937


-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl