Re: SSH keys: RSA vs DSA

From: David Goodenough (david.goodenough@btconnect.com)
Date: 06/29/02 

From: David Goodenough <david.goodenough@btconnect.com>
Date: Sat, 29 Jun 2002 15:56:06 +0000 (UTC)

John Thompson wrote:

> In article <3D1B0463.58BD4A47@daimi.au.dk>, Kasper Dupont wrote:
>
>> Ssh protocol version 2 can use RSA as well as DSA keys.
>> What are the advantages and disadvantages of each type
>> of key?
>
> DSA is an old and fairly weak encryption, supported mostly for
> backwards-compatibility with apps that expect to be able to use it.
>
> Use RSA if you have a choice.
>

DSA is the Digital Signature Algorithm, and only does signatures not
encryption. RSA can do both signatures and encryption. It is however
true that DSA keys can be used with some elyptic curve encryption
algorithms to encrypt. Using different keys for encryption and signing
(for certificates and the like) has considerable cryptographic merit,
and while you can use separate keys with RSA, the temptation to use the
same one is frequently overwelming expecially to those who do not
unstand why they should not.

According to Bruce Schneier both DSA and RSA with the same length keys
are just about identical in difficulty to crack. Use the key for
encryption as well as signing and breaking the key gets much easier
simply because there is more data to work with.

SSH uses either DSA or RSA for signing, not encryption, so actually
it makes little difference which you use. As mentioned elsewhere in
this thread US encryption export laws used to mean that DSA was
preferable as it was only for signing and could not be used for
encryption and therefore was allowed to be exported. Following
on from Sept 11 this kind of regulation could come back although
enforcing it would be even harder that it was when implementations
were produced outside the US before the regulations were relaxed.
RSA used to be covered by patent, but that has now lapsed, which
also was a US only problem.

David

Relevant Pages

  • Re: ssh / scp / batch mode
    ... I thought most places used DSA, ... by (RSA1, RSA, DSA) ... Here, ssh checks for RSA keys, DSA ... and offers the DSA public key to the server. ...
    (comp.os.linux.misc)
  • Re: racdcert
    ... which case encryption is not secure, ... the maximum key size enforced by RACF is 1024 for keys generated ... with RSA using software, 2048 for keys generated using a PCI-class ... For IBM-MAIN subscribe / signoff / archive access instructions, ...
    (bit.listserv.ibm-main)
  • Re: Multiple keys in .ssh/authorized_keys file?
    ... It's not necessary but may be useful depending on your configuration. ... provided you have your ssh2 private keys on the nodes you expect to ... DSA is mandatory in the spec while RSA is recommended. ...
    (comp.security.ssh)
  • Re: Re: Strong Encryption
    ... 2048 bits for classical asymmetric ciphers like RSA and ElGamal. ... keys will not give you any more security, ... What does reducing encryption performance mean? ... As of 2003 RSA Security claims that 1024-bit RSA keys are ...
    (comp.security.misc)
  • Re: Laenge des Keys bei X.509 Zertifikaten
    ... Du muesstest die bitlaenge des Modulos des Public Keys auslesen. ... Keys kennen muss (RSA, DSA, etc). ... neben der JCE wuerden mir Helper ...
    (de.comp.lang.java)