TCP/IP Tutorial and Technical Overview - IBM Redbooks

Digital Signature Standard (DSS)
As mentioned previously, a hash value encrypted with the private key is called a
digital signature and is illustrated in Figure 22-9.
Message
Figure 22-9 Generating a digital signature
One authentication method that can be used with ISAKMP/Oakley is DSS, which
was selected by NIST and NSA to be the digital authentication standard of the
U.S. government. The standard describes the Digital Signature Algorithm (DSA)
used to sign and verify signatures of message digests produced with SHA-1.
The following steps provide a brief description of DSA:
1. Choose a large prime number, p, usually between 512 and 1024 bits long.
2. Find a prime factor q of (p-1), 160 bits long.
3. Compute:
g=h (p-1)/q mod p
Where h is a number less than (p-1) and the following is true:
h (p-1)/q >1
4. Choose another number x, less than q, as the sender's private key.
5. Compute:
y=gx mod p
And use that as the sender's public key. The pair (x,y) is sometimes referred
to as the long-term key pair.
790 TCP/IP Tutorial and Technical Overview
Private key
Hash
Encryption
Message
function Digital
digest
signature
(hash)