On Fri, Jan 11, 2013 at 09:54:22PM +0100, Vladimir 'φ-coder/phcoder' Serbinenko wrote: > 1) DSA keys only. RSA is more tricky since it needs padding and RSA > should be progressively phased out, not put into new places due to some > vulnerabilities (large classes of semiprimes are factorisable up to the > point when a lot of care has to be taken to avoid them).
This is highly questionable. DSA is particularly sensitive to low-entropy situations and has various other systemic vulnerabilities that RSA doesn't have, mainly to do with the extreme sensitivity of k. For example, when Debian had its notorious OpenSSL vulnerability involving poor random number generation, RSA keys that were generated on a system with the vulnerability were indeed compromised; but DSA keys were compromised even if they were only ever used to generate a single signature on a system with the vulnerability! Knowledge of even a few bits of k is sufficient to recover a DSA private key if you collect a relatively small number of signatures made by that key (say, rather less than the number of modules shipped by GRUB). This is the sort of thing that makes me want to avoid a cipher, particularly for something like GRUB where it's quite possible that you might find yourself needing to sign things in situations where only limited entropy is available, even though the key might well have been generated in better conditions. RSA with a decent key length is perfectly fine and there is no call that I'm aware of to phase it out. Rather to the contrary, DSA is the one that I would normally prefer to avoid except where dictated by compatibility considerations. Assuming that the semiprimes you're referring to are those in https://en.wikipedia.org/wiki/RSA_numbers, nobody appears to have got any further than 768 bits. That would be a tiny key by modern standards; I've been using 4096 bits everywhere for a few years now, and of course the difficulty of factoring scales up much faster than linearly in the key length. I am not aware (and https://en.wikipedia.org/wiki/RSA_%28algorithm%29#Integer_factorization_and_RSA_problem would appear to agree) of any suggestions that >=4096-bit keys might be considered weak any time soon. Please reconsider. -- Colin Watson [cjwat...@ubuntu.com] _______________________________________________ Grub-devel mailing list Grub-devel@gnu.org https://lists.gnu.org/mailman/listinfo/grub-devel
