Talk:Digital Signature Algorithm

message: I'm not qualified to do this but would it be possible to have a section to describe the security of DSA? I think it rests on the fact that an attacker cannot derive k or x from a signature or public key because of the hardness of Discrete Logarithm Problem (DLP).  — Preceding unsigned comment added by 159.196.168.4 (talk) 21:15, 13 August 2023 (UTC)
thread_title: DSA Security

message: Recently removed from the article:
 It was designed at the NSA as part of the Federal Government's attempt to control high security cryptography. Part of that policy included prohibition (with severe criminal penalties) of the export of high quality encryption algorithms. The DSS (Digital Signature Standard) was intended to provide a way to use high security digital signatures across borders in a way which did not allow encryption. Those signatures required high security asymmetric key encryption algorithms, but the DSA (the algorithm at the heart of the DSS) was intended to allow one use of those algorithms, but not the other. It didn't work. DSA was discovered, shortly after its release, to be capable of encryption (prohibited high quality encryption, at that) but to be so slow when used for encryption as to be even more than usually impractical.
Is this viewpoint not held by anyone, even a minority? (If so, it should be reinserted into the article in some form). User:Ww? — Matt 22:53, 5 Sep 2004 (UTC)
replies: text: There have been allegations that the government likes the DSA because it is only a digital signature algorithm and can’t be used for encryption. It is, however, possible to use the DSA function call to do ElGamal encryption. — Matt 23:17, 5 Sep 2004 (UTC)
thread_title: DSA and encryption

message: The two links disputing the Schnorr patent claim are 404's:
http://www.privacy.nb.ca/cryptography/archives/coderpunks/new/1998-08/0006.html
http://www.privacy.nb.ca/cryptography/archives/coderpunks/new/1998-08/0009.html
Anyone has another source? Could not find a working archive..
--Tobias 11:18, 20 December 2005 (UTC)
replies: text: NIST claims that they reviewed Schnorr's patent and concluded that DSA is not infriging the patent in http://csrc.nist.gov/publications/nistbul/csl94-11.txt. 24.228.93.22 00:48, 17 February 2006 (UTC)
thread_title: Schnorr patent dispute

message: I don't know squat about math, but when trying to implement DSA signing using the sequence of steps here Digital_Signature_Algorithm#Signing, it was not obvious to me that k-1 = the multiplicative inverse of k mod q.  I had to go to the spec to figure that out.  Does it make sense to add a small bit of verbiage to that effect, or is that something that should be obivous?
--Geechorama 17:15, 4 August 2006 (UTC)
replies: text: You have a good point here. Cryptographers use modular arithmetic so frequently that they forget to include pointers to the relevant pages. I've added links to some articles that should be helpful. 67.84.116.166 15:25, 16 August 2006 (UTC)
thread_title:  A little bit more info for signing description 

message: Calling the variable k a nonce might mislead some readers. Specially the description of a nounce says 
: it should be time-variant (including a suitably granular timestamp in its value) ...
Including a timestamp intok would make some bits of k predictable. This might allow lattice based attacks that can recover the secret key x. k or even parts of k must not be predictable.
67.84.116.166 23:44, 14 September 2006 (UTC)
thread_title:  ''k'' is not a nonce 

message: hey guys....
i just wanted to know the data type in java that can support the global variables in DSS...the length of 'p' cud vary from 512 bits to 1024 bits....i m confused as to how shall i proceed with the project.... —The preceding unsigned comment was added by 125.23.19.220 (talk) 15:27, 8 January 2007 (UTC)
thread_title:  data type.... 

message: DSA article almost entirely contains the Elliptic Curve DSA article. Also the Elliptic Curve DSA article describes Elliptic Curve DSA as a variant of DSA whereas it is the only algorithm described in the DSA article.  —Preceding unsigned comment added by 141.84.28.46 (talk) 13:04, 23 June 2008 (UTC)
thread_title:  DSA vs Elliptic Curve DSA 

message: I cannot see any, it is just more complicated, I think.
It is true, (p-1) must have a large prime factor which is smaller or equal to q= (p-1)/2. But why not choosing a safe prime with q=(p-1)/2 is a prime number? 109.90.224.162 (talk) 17:51, 11 September 2015 (UTC)
thread_title:  Advantage compared to Elgamal 

message: Hello fellow Wikipedians,
I have just modified  on Digital Signature Algorithm. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20130109092551/http://www.certicom.com/index.php/dr-david-kravitz to http://www.certicom.com/index.php/dr-david-kravitz
*Corrected formatting/usage for http://csrc.nist.gov/groups/SMA/ispab/documents/94-rpt.txt
*Added archive https://web.archive.org/web/20140606050814/http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57-Part1-revised2_Mar08-2007.pdf to http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57-Part1-revised2_Mar08-2007.pdf
*Added archive https://web.archive.org/web/20140606050814/http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57-Part1-revised2_Mar08-2007.pdf to http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57-Part1-revised2_Mar08-2007.pdf
When you have finished reviewing my changes, please set the checked parameter below to true or failed to let others know (documentation at ).
Cheers.—InternetArchiveBot (Report bug) 02:24, 13 December 2016 (UTC)
thread_title:  External links modified 

message: Hello fellow Wikipedians,
I have just modified one external link on Digital Signature Algorithm. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20131226115544/http://csrc.nist.gov/publications/fips/fips1861.pdf to http://csrc.nist.gov/publications/fips/fips1861.pdf
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 03:42, 27 July 2017 (UTC)
thread_title:  External links modified 

message: The article used to specify 0<k<q, which was consistent with FIPS 186-4 (see the 'Output' clauses in B.2). Currently the article says 1<k<q, which isn't necessarily a bad idea but isn't consistent with the spec and doesn't tell you what the implementations actually do. I think the article should reflect the spec. Anyone agree/disagree? Ewx (talk) 11:54, 24 November 2017 (UTC)
thread_title:  Range of k 

message: libsodium is listed as an implementation of DSA, however I cannot find any indication that it is. libsodium uses the Ed25519 signature scheme, which is more comparable to an elliptic curve version of Schnorr signatures, though also often considered a variant of ECDSA. But it certainly isn't (multiplicative group of Z_p) DSA. Aragorn2 (talk) 10:29, 14 June 2019 (UTC)
thread_title:  Implementations: libsodium? 

message: I find this revert puzzling. 
The current text says: 
"
A message {\displaystyle m}m is signed as follows:
Choose an integer {\displaystyle k}k randomly from {\displaystyle \{1\ldots q-1\}}{\displaystyle \{1\ldots q-1\}}
Compute {\displaystyle r:=\left(g^{k}{\bmod {\,}}p\right){\bmod {\,}}q}{\displaystyle r:=\left(g^{k}{\bmod {\,}}p\right){\bmod {\,}}q}. In the unlikely case that {\displaystyle r=0}r=0, start again with a different random {\displaystyle k}k.
Compute {\displaystyle s:=\left(k^{-1}\left(H(m)+xr\right)\right){\bmod {\,}}q}{\displaystyle s:=\left(k^{-1}\left(H(m)+xr\right)\right){\bmod {\,}}q}. In the unlikely case that {\displaystyle s=0}s=0, start again with a different random {\displaystyle k}k.
The signature is {\displaystyle \left(r,s\right)}\left(r,s\right)
The calculation of {\displaystyle k}k and {\displaystyle r}r amounts to creating a new per-message key. 
"
That is, first it says that 'k' is chosen randomly and 'r' and 's' are computed. Then it talks about the calculation of 'k' and 'r'. 'k' cannot both be calculated and chosen randomly. 
: You reverted it to say "The calculation of r and s amounts to creating a new per-message key. ". That's incorrect: s is not part of a key. Hence the revert. If you object to the sentence then you need to do more than change k to s.
: In reality k isn't just plucked out of the air; there will normally be some computation involved - running an RBG and (in the B.2.1 strategy) a modular reduction.
: Ewx (talk) 14:41, 7 August 2021 (UTC)
thread_title:  k is not calculated