http://www.linuxquestions.org/questions/linux-security-4/which-is-better-rsa-or-dsa-public-key-12593/
http://leaf.dragonflybsd.org/mailarchive/users/2005-01/msg00140.html
http://www.seedmuse.com/rsa_edit.htm
So, what about "(b) RSA is just a better protocol [(algorighm)]"?
| From: | Adrian Bocaniciu <a.bocaniciu@xxxxxxxxxxxx> |
| Date: | Tue, 18 Jan 2005 20:27:22 +0000 |
I've read a few pieces which recommend RSA over DSA, although most
Re:
RSA vs DSA
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Kris Maglione wrote:
> So, what about "(b) RSA is just a better protocol [(algorighm)]"?
> I've read a few pieces which recommend RSA over DSA, although most
> crypto programs (OpenSSL/SSH etc.) say RSA is depricated/a last resort.
> Any insights?
Neither DSA nor RSA are deprecated. Both algorithms are OK to use
for digital signatures (i.e. the signatures cannot be forged now or in
the near future), if their parameters, i.e. the key lengths, are chosen
correctly.
The RSA algorithm can also be used for public-key encryption, but
that is not recommended, because there are better ways to accomplish
that and also because some older variants of using RSA for encryption
are broken. (Despite that, most HTTPS Web sites are still using obsolete
SSL libraries or configurations, which also use RSA for encryption, not
only for authentication).
DSA and RSA are the only digital signature algorithms that are both
standardized and free from patents. There was a time when RSA was not
recommended because it was covered by a patent, but now that patent has
expired. There are also other digital signature algorithms that are
better for some applications, e.g. Rabin-Williams, which can be verified
much faster than RSA, but they are not standardized (except in IEEE
1363, which is not widely implemented yet). Other algorithms, like
those using elliptic curves, are claimed to be covered by US patents, so
they cannot be recommended while there are free alternatives.
For RSA, a 1536-bit key pair is recommended now for most uses e.g.
SSH public-key authentication, but longer keys shall be used for signing
documents that should not be forged even after many years.
Nevertheless, most Web sites that use HTTPS, have only 1024-bit RSA key
pairs, those are still reasonably secure for now, but in a few years
they will become breakable. An 1536-bit RSA public/private key pair
requires about the same time for breaking as a 90-bit key of a
secret-key algorithm. Nonetheless, in reality 1536-bit RSA is much more
secure than 90-bit, because either a huge memory (much beyond what is
currently possible) is needed for the computation or, if the memory is
unavailable, the computation becomes much slower, so the RSA key will be
equivalent in strength with a longer secret key.
RSA is more appropriate for signing certificates, because it can be
verified faster, but for the authentication of the initial message
exchange in network connection establishments, like in IPsec, TLS/SSL or
SSH, DSA can be better, because there are an equal number of signing and
verification operations, so only the sum of the execution times for
signing and verification matters. DSA has the advantage that it has the
same security as RSA at a shorter key length, i.e. 1280-bit DSA has
about the same security as 1536-bit RSA. For that reason I always use
1280-bit DSA key pairs for SSH authentication, i.e. the keys are
generated with "ssh-keygen -t dsa -b 1280", both for the server host key
and for the users' workstations.
DSA has a disadvantage that is not a property of the algorithm but
only of its implementation in OpenSSL, OpenSSH and other common
programs, it has several parameters that must be increased
simultaneously for better security, but applications like ssh-keygen let
you specify only the key length and they keep the other parameters
unchanged. Because of that it is absolutely useless to increase the DSA
key length beyond 1280-bit, because the security is not improven. On
the other hand, with RSA you can specify 2048-bit, 3072-bit or longer
key pairs, if you so desire.
Best regards !