195
To alleviate this problem, Diffie-Hellman should always be used with some method of authentication, most commonly from another algorithm. This is accomplished by authenticating
the messages containing public values for the Diffie-Hellman agreement. Using signatures, each party would exchange their public keys to use for signing before the conversation begins, and then
sign the public value before sending it. The details will be explained in the following section.
8.3 Digital Signature Algorithm DSA
The DSA algorithm was developed by the National Institute for Standards and Testing NIST and the National Security Agency NSA. It was first proposed in 1991 and stirred up a significant
amount of controversy. Finally, in 1994, it became a standard. As its name implies, the DSA algorithm is useful for computing digital signatures, but that is the only thing for which it can be
used. It is not capable of providing key agreement or encryption without extension.
Using a private key, the user can compute a signature for an arbitrary piece of data. Anyone possessing the public key that corresponds to the private key used to compute a signature can then
verify that signature. The algorithm works in conjunction with the Secure Hash Algorithm SHA. Essentially, the hash of the data to be signed is computed, and the hash is actually signed, rather
than the data itself. The public key that corresponds to the private key used to compute a digital signature can then be used to obtain the hash of the data from the signature. This hash is compared
with the hash computed by the party verifying the signature. If they match, the data is considered authentic. If they dont match, the data is not identical to the data that was originally signed.
A digital signature is useful for verifying the integrity of data, ensuring that it has not been corrupted or tampered with. It also provides non-repudiation since only one person should have
access to the private key used to compute a signature. The utility of a digital signature when combined with a key exchange algorithm such as Diffie-Hellman is easy to see. If the two parties
performing a key exchange trust that the public key actually belongs to the party with which theyre communicating, a digital signature can be used to prevent a man-in-the-middle attack.
8.3.1 The Basics
Similar to the low-level interface to Diffie-Hellman, the low-level interface to DSA provided by OpenSSL consists of a
DSA
structure and a set of functions that operate on that structure. The
DSA
structure and functions are made accessible by including the openssldsa.h header file. The
DSA
structure itself contains many data members that are of little or no interest to us, but five members are important, as shown in the following abbreviated
DSA
structure definition:
typedef struct dsa_st {
BIGNUM p; BIGNUM q;
BIGNUM g; BIGNUM pub_key;
BIGNUM priv_key; } DSA;
The
p
,
q
, and
g
members, known as DSA parameters, are public values that must be generated before a key pair can be generated. Because theyre public values, no harm will come if a potential
attacker discovers them. The same parameters can be safely used to generate multiple keys. In fact, RFC 2459 specifies a mechanism in which DSA parameters for a certificate can be inherited from
the certificate of the issuer. Using parameter inheritance not only reduces the size of certificates, it also enforces the sharing of parameters.
196
The
p
member is a prime number that is randomly generated. Initially, the proposed standard fixed the length of the prime at 512 bits. Due to much criticism, this was later changed to allow a range
between 512 and 1,024 bits. The length of the prime must be a multiple of 64 bits, however. OpenSSL does not enforce the 1,024-bit upper bound, but its not a good idea to use a prime larger
than 1,024 bits—many programs may not be able to use the keys that result from such a large prime. The
q
member is a prime factor of
p-1
. The value of
q
must also be exactly 160 bits in length. The
g
member is the result of a mathematical expression involving a randomly chosen integer, as well as
p
and
q
. Using the three public parameters
p
,
q
, and
g
, the public and private keys can be computed. Public parameters used to compute the keys are required to generate or verify a digital signature.
The parameters must therefore be exchanged along with the public key in order for the public key to be useful. Of course, the private key should never be distributed.
8.3.2 Generating Parameters and Keys
