[guardian-dev] DSA

Jacob Appelbaum jacob at appelbaum.net
Fri Aug 16 16:51:56 EDT 2013


Abel Luck:
> Tom Ritter:
>> As a long term strategy, it'd be nice to migrate... well every single
>> damn thing that uses DSA, to deterministic DSA to eliminate the
>> massive gaping vulnerability that is the k value.
>> https://tools.ietf.org/html/rfc6979
> 
> wrt OTR it would be nice to support RSA or perhaps ECC, Jake has
> proposed the former before, but I'm not sure of the status.
>

I tend to think that supporting RSA is a fine thing at this point. I
also think that using something like djb's tricks for the k value in our
current DSA would also be a good idea. In an ideal world, we could also
add ECC.

If someone wants to add RSA to libotr/pidgin-otr, I'll review the
patches. I'm probably going to put my time into ECC related protocol
improvements. Currently, a few of us are working on an informational RFC
about the current OTR protocol. Once the RFC is done, we'll move on to
improving the protocol.

All the best,
Jake


More information about the Guardian-dev mailing list