Subject: ElGamal signature values?

From: Ingo Luetkebohle <[email-masked]>
Date: Fri, 3 Aug 2001 22:19:04 +0200

Hello,

I couldn't find a specification for ElGamal signature values in the
RFC or the current (bis-02) draft, even though the current draft
mentions the possibility of such signatures in section 12.5 and gpg
seems to support them.

It would seem logical to use the same values as for public-key
encrypted session keys. Is that correct? Is that what gpg does or is
there something else I need to know?

If its just that I've been too dumb to find the right section in the
spec, pointers are very appreciated :)

Regards

-- 
	Ingo Luetkebohle / [email-masked] / 95428014
/
| Student of Computational Linguistics & Computer Science;
| Fargonauten.DE sysadmin; Gimp Registry maintainer;
| FP: 3187 4DEC 47E6 1B1E 6F4F  57D4 CD90 C164 34AD CE5B

---

From: Jon Callas <[email-masked]>
Date: Fri, 10 Aug 2001 09:25:36 -0700

>there something else I need to know?

Can someone who is an implementer answer this? What do I need to do to put
in the next draft? I'm going to put out another draft in the next couple of
days -- there's time here at HAL -- and if I can clarify, I will.

	Jon

---

From: "Michael Young" <[email-masked]>
Date: Sat, 11 Aug 2001 13:10:30 -0400

-----BEGIN PGP SIGNED MESSAGE-----

From: "Jon Callas" <[email-masked]>
> days -- there's time here at HAL -- and if I can clarify, I will.

I haven't implemented it yet, but I've asked a few times, and for
lack of an answer, I've looked over the GnuPG code.

GnuPG computes:
    a=g^k mod p); and,
    b=(h-a*x)/k mod (p-1))
 where k is random and h is the (padded) message hash.

It seems to apply the same PKCS padding as for RSA signatures.
The two MPIs are encoded in that order (a,b).

The computation matches that found in the Handbook of Applied
Cryptography, among others.  I can't comment on whether the PKCS
padding is the usual treatment for ElGamal signatures, though.

---

From: Werner Koch <[email-masked]>
Date: 13 Aug 2001 15:41:12 +0200

> in the next draft? I'm going to put out another draft in the next couple of

Algorithm Specific Fields for ElGamal signatures:

  - MPI of ElGamal value a = g**k mod p.

  - MPI of ElGamal value b = (h-a*x)/k mod p-1.

The hash h is PKCS-1 padded exactly the same way as for the above
described RSA signatures.

Please add a reference to section 12.5 [ElGamal] and make clear that
the use of ElGamal signatures is not suggested.

> days -- there's time here at HAL -- and if I can clarify, I will.

Hope you had a nice time.

  Werner

-- 
Werner Koch        Omnis enim res, quae dando non deficit, dum habetur
g10 Code GmbH      et non datur, nondum habetur, quomodo habenda est.
Privacy Solutions                                        -- Augustinus

---

From: Jon Callas <[email-masked]>
Date: Fri, 17 Aug 2001 15:03:56 -0700

>the use of ElGamal signatures is not suggested.

I'm a little uncomfortable over proper wording here; if they're so bad,
should they be there at all? I thought the present 12.5 wording was stern
enough to give anyone pause. Nonetheless, I added another wording. Here's
the complete paragraph:

 Details on safe use of Elgamal signatures may be found in [MENEZES], which
 discusses all the weaknesses described above. Please note that Elgamal
 signatures are controversial; because of the care that must be taken with
 Elgamal keys, many implementations forego them.

How's that?

	Jon

---

From: Werner Koch <[email-masked]>
Date: 18 Aug 2001 14:27:59 +0200

> should they be there at all? I thought the present 12.5 wording was stern

Well, we had so many discussions and I guess that there are still some
folks who have concerns about DSA so that they use ElGamal
signatures. Of course, it is there good right to do this.  OTOH this
often triggers long discussions whether there is a bug in PGP or GnuPG
when one can't check the signature.

Removing that optional algorithm is neither good because we willfor
sure start a long discussion again ;-)

> How's that?

That's really nice.

Thanks,

   Werner