| Newsgroups |
gmane.ietf.syslog |
| Message-ID |
<[email protected]> |
Jon Callas wrote:
> Well, the reason it's DSA is that the size of a DSA signature is
> proportional to the size of the hash function rather than the
> key. At the time John Kelsey did the first protocol, we were talking
> about DSA with SHA-1. Now, of course, there are more options.
>
> Nonetheless, if you're going to do syslog-sign over udp, there's a
> real need to keep the signatures small.
Based on quick back-of-the-envelope calculations, it seems the
difference between RSA and DSA isn't that big.
With DSA and SHA-1, you could put ~65 hashes in a Signature
Block (while keeping it under 2048 bytes); with RSA (1024-bit
key) and SHA-1, you could put ~60. Or in other words: the
hash block is much larger than the signature.
Best regards,
Pasi
_______________________________________________
Syslog mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/syslog