724038 - 2048-bit primes are now valid for DSA certificates

Status: RESOLVED FIXED

(CA Program :: CA Certificate Root Program, task)

Description

[Wan-Teh Chang]

In Mozilla CA Certificate Inclusion Policy (Version 2.0)
(http://www.mozilla.org/projects/security/certs/policy/InclusionPolicy.html),
Section 4, the following examples of certificate problems are listed:

    * ASN.1 DER encoding errors;
    * invalid public keys (e.g., DSA certificates with 2048-bit primes, or RSA certificates with public exponent equal to 1);
    * duplicate issuer names and serial numbers;
    ...

I suggest that "DSA certificates with 2048-bit primes" be removed from
the second bullet item.

In FIPS 186-2, DSA primes must be 512 ~ 1024 bits long, so 2048-bit primes
are invalid.

But in FIPS 186-3, DSA primes must be 1024, 2048, or 3072 bits long.  So
under the new standard, 2048-bit primes are valid for DSA certificates,
even though NSS doesn't support them yet.

Note: FIPS 186-2 and 186-3 mean the second and the third revision of FIPS 186.

So it is now wrong to call such DSA public keys with 2048-bit primes "invalid".

Comment 1

[Kathleen Wilson]

Thanks for pointing this out.

I have updated 
https://www.mozilla.org/projects/security/certs/policy/WorkInProgress/InclusionPolicy.html
to indicate that this text should be removed...

DELETE (bug #724038): , DSA certificates with 2048-bit primes, or

means that the text in bold should be deleted as per this bug.

Comment 2

[Kathleen Wilson]

Fixed in http://www.mozilla.org/projects/security/certs/policy/InclusionPolicy.html