[144963] in cryptography@c2.net mail archive
Re: Possibly questionable security decisions in DNS root management
daemon@ATHENA.MIT.EDU (Alexander Klimov)
Mon Oct 19 11:52:45 2009
Date: Mon, 19 Oct 2009 09:31:38 +0200 (IST)
From: Alexander Klimov <alserkli@inbox.ru>
To: cryptography@metzdowd.com
In-Reply-To: <20091015043907.GB24191@randombit.net>
On Thu, 15 Oct 2009, Jack Lloyd wrote:
> Even plain DSA would be much more space efficient on the signature
> side - a DSA key with p=2048 bits, q=256 bits is much stronger than a
> 1024 bit RSA key, and the signatures would be half the size. And NIST
> allows (2048,224) DSA parameters as well, if saving an extra 8 bytes
> is really that important.
>
> Given that they are attempted to optimize for minimal packet size, the
> choice of RSA for signatures actually seems quite bizarre.
Maybe they try to optimize for verification time.
$ openssl speed
[...]
sign verify sign/s verify/s
rsa 512 bits 0.000823s 0.000069s 1215.2 14493.7
rsa 1024 bits 0.004074s 0.000200s 245.4 5008.0
rsa 2048 bits 0.024338s 0.000663s 41.1 1507.5
rsa 4096 bits 0.159841s 0.002361s 6.3 423.6
sign verify sign/s verify/s
dsa 512 bits 0.000651s 0.000765s 1535.2 1306.6
dsa 1024 bits 0.001922s 0.002322s 520.3 430.7
dsa 2048 bits 0.006447s 0.007551s 155.1 132.4
--
Regards,
ASK
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
