Part 1: General - Computer Security Resource Center - National ...

March, 2007
cryptographic operations, then the same key shall not be used for both the MAC and encryption
operations.
4.2.3.2 MACs Using Hash Functions
[FIPS198] specifies the computation of a MAC using an Approved hash function. The algorithm
requires a single pass through the entire data. A variety of key sizes are allowed for HMAC; the
choice of key size depends on the amount of security to be provided to the data and the hash
function used. See Section 5.6 for guidance in the selection of key sizes.
4.2.4 Digital Signature Algorithms
Digital signatures are used to provide authentication, integrity and non-repudiation. Digital
signatures are used in conjunction with hash algorithms and are computed on data of any length
(up to a limit that is determined by the hash algorithm). [FIPS186-3] specifies algorithms that are
Approved for the computation of digital signatures. It defines the Digital Signature Algorithm
(DSA) and adopts the RSA algorithm as specified in [ANSX9.31] and [PKCS#1] (version 1.5
and higher), and the ECDSA algorithm as specified in [ANSX9.62].
4.2.4.1 DSA
The Digital Signature Algorithm (DSA) is specified in [FIPS186-3] for specific key sizes 3 : 1024,
2048, and 3072 bits. The DSA will produce digital signatures 4 of 320, 448, or 512 bits. Older
systems (legacy systems) used smaller key sizes. While it may be appropriate to continue to
verify and honor signatures created using these smaller key sizes 5 , new signatures shall not be
created using these key sizes.
4.2.4.2 RSA
The RSA algorithm, as specified in [ANSX9.31] and [PKCS#1] (version 1.5 and higher) is
adopted for the computation of digital signatures in [FIPS186-3]. [FIPS186-3] specifies methods
for generating RSA key pairs for several key sizes for [ANSX9.31] and [PKCS#1]
implementations. Older systems (legacy systems) used smaller key sizes. While it may be
appropriate to continue to verify and honor signatures created using these smaller key sizes 6 , new
signatures shall not be created using these key sizes.
4.2.4.3 ECDSA
The Elliptic Curve Digital Signature Algorithm (ECDSA), as specified in [ANSX9.62], is
adopted for the computation of digital signatures in [FIPS186-3]. [ANSX9.62] specifies a
3
For DSA, the key size is considered to be the size of the modulus p. Another value, q, is also important when
defining the security afforded by DSA.
4 The length of the digital signature is twice the size of q (see the previous footnote).
5 This may be appropriate if it is possible to determine when the digital signature was created (e.g., by the use of a
trusted time stamping process). The decision should not depend solely on the cryptography used.
6 This may be appropriate if it is possible to determine when the digital signature was created (e.g., by the use of a
trusted time stamping process). The decision should not depend solely on the cryptography used.
37