full-disclosure

Open Source and information security mailing list archives

Message-ID: <CAH8yC8=jEoxUOxTz4sv_Qu3+zYkV2COFytznAYngMtT6S3ujJg@mail.gmail.com>
Date: Fri, 26 Oct 2012 16:31:34 -0400
From: Jeffrey Walton <noloader@...il.com>
To: "Thor (Hammer of God)" <thor@...merofgod.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: stealing ssh keys

On Fri, Oct 26, 2012 at 3:58 PM, Thor (Hammer of God)
<thor@...merofgod.com> wrote:
> Actually, the DSA key is used to sign the message in many applications,
> though I've often wondered exactly what reduction in security exists if the
> paired private key is used to sign material instead. Do you have any info on
> that?  I've asked industry leaders in crypto, and while they report it
> should be avoided, I've never received any quantified answer.
>
The place to ask is
http://lists.randombit.net/mailman/listinfo/cryptography or sci.crypt.
sic.crypt is a cesspool, and you will have to wade through the spam.

Private keys always sign. Perhaps you meant the public key?

Jeff

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives