DSA
| Digital Signature Algorithm of FIPS 186-4: r = (g^k mod p) mod q and s = k^-1 (z + x*r) mod q over a prime-order subgroup, with the nonce derived from the key and the digest per RFC 6979 and the signature carried as r |
|
s. Verified against the RFC 6979 vectors for both published parameter sets. FIPS 186-5 withdrew DSA for new signatures in 2023; it is here for the standard it defined and for verifying signatures that already exist. |
Properties
| Property |
Value |
| Category |
Asymmetric Ciphers |
| Sub-category |
Digital Signature |
| Security status |
🎓 Educational Only |
| Complexity |
Advanced |
| Inventor |
David Kravitz (NSA) |
| Year |
1991 |
| Origin |
🇺🇸 United States |
| Source |
algorithms/asymmetric/dsa.js |
Parameters
| Parameter |
Supported values |
| Key sizes |
1024 bytes (8192 bits); 2048 bytes (16384 bits); 3072 bytes (24576 bits) |
Security
Status: 🎓 Educational Only
Known vulnerabilities
| Issue |
Description |
Mitigation |
| Nonce Reuse and Bias |
s = k^-1 (z + x*r) mod q is linear in k and in x, so two signatures sharing a nonce, or nonces with a few predictable bits, recover the private key outright |
The nonce here comes from RFC 6979 section 3.2, derived by HMAC-DRBG from the private key and the digest, so no randomness source can go wrong; do not substitute a counter or a value derived from the message alone |
| Withdrawn for Signing |
FIPS 186-5 removed DSA as an approved signature algorithm in 2023, and the 1024-bit parameter set of A.2.1 is below the strength expected of anything still in use |
Sign with ECDSA, Ed25519 or ML-DSA; keep DSA only to verify signatures that already exist |
| Timing and Trace Leakage |
Modular exponentiation here branches on the bits of the nonce, so an attacker able to time or trace the signer learns k and therefore the private key |
Use a constant-time implementation wherever an attacker shares a machine with the signer; this file is a reference for the mathematics, not a hardened signer |
Documentation
References
Test vectors
11 vectors ship with this algorithm and run in the test suite. Byte values are hexadecimal.
Vector 1 — RFC 6979 A.2.1 - DSA 1024/160, SHA-1, message “sample”
| Field |
Value |
p |
94772214835463005053734612688987420745400704367641322402256120323201101201888870137170705373498571313030316679878174804574980244779195907606098768964031739134779278848798229819934901324222106210711842549374102491417296346772453897799554117544442700769168461664359227744193913924495898621041399925210910234489 |
q |
875964080856129786106302881659054003458244253873 |
g |
5401015700248054412670727427618885968561082170092747201289836023587070842129960413909724179237157705995932514206777888947040631335552011708189886180529339953041551030032179217373774180691656086709230043691953506246450665697269251181380801651442389601287318661304902597519067842079816229492516762912476306877 |
x |
371575259833906365510684947508061994685469500919 |
hashAlgorithm |
SHA-1 |
input |
73616d706c65 |
expected |
2e1a0c2562b2912caaf89186fb0f4200 1585da5529efb6b0aff2d7a68eb70ca3 13022253b9a88df5 |
Vector 2 — RFC 6979 A.2.1 - DSA 1024/160, SHA-256, message “sample”
| Field |
Value |
p |
94772214835463005053734612688987420745400704367641322402256120323201101201888870137170705373498571313030316679878174804574980244779195907606098768964031739134779278848798229819934901324222106210711842549374102491417296346772453897799554117544442700769168461664359227744193913924495898621041399925210910234489 |
q |
875964080856129786106302881659054003458244253873 |
g |
5401015700248054412670727427618885968561082170092747201289836023587070842129960413909724179237157705995932514206777888947040631335552011708189886180529339953041551030032179217373774180691656086709230043691953506246450665697269251181380801651442389601287318661304902597519067842079816229492516762912476306877 |
x |
371575259833906365510684947508061994685469500919 |
hashAlgorithm |
SHA-256 |
input |
73616d706c65 |
expected |
81f2f5850be5bc123c43f71a3033e938 4611c5454cdd914b65eb6c66a8aaad27 299bee6b035f5e89 |
Vector 3 — RFC 6979 A.2.1 - DSA 1024/160, SHA-256, message “test”
| Field |
Value |
p |
94772214835463005053734612688987420745400704367641322402256120323201101201888870137170705373498571313030316679878174804574980244779195907606098768964031739134779278848798229819934901324222106210711842549374102491417296346772453897799554117544442700769168461664359227744193913924495898621041399925210910234489 |
q |
875964080856129786106302881659054003458244253873 |
g |
5401015700248054412670727427618885968561082170092747201289836023587070842129960413909724179237157705995932514206777888947040631335552011708189886180529339953041551030032179217373774180691656086709230043691953506246450665697269251181380801651442389601287318661304902597519067842079816229492516762912476306877 |
x |
371575259833906365510684947508061994685469500919 |
hashAlgorithm |
SHA-256 |
input |
74657374 |
expected |
22518c127299b0f6fdc9872b282b9e70 d07908126837ec18f150d55de95b5e29 be7af5d01e4fe160 |
Vector 4 — RFC 6979 A.2.2 - DSA 2048/256, SHA-256, message “sample”
| Field |
Value |
p |
19909645583840807223358780437970167592202534823379006107885035792419538475865479634902323267972117061317804121245140907173935097113576247399194741785152226721473341873971706960174863553222453637180116749817272214187574419417252230377813268188697148436022094448060828280373741234171052994817209856869762092486200197168931490782986275981033576378920487970537764153121784316581144326224775327105327663318577119263972872968741884172308259878838650474752471323444179687700572140998870076554258831982035947730860777879894193344878919032623496744139163741955731247799586400504772446333993669185664236379647531501121348231771 |
q |
109804365839883466641292640488361553607962427199963407681978507099013790665759 |
g |
11677025274495228368531388931705351941276270981197378167013082520925042650145897357007123759040662572890287432551119789668850626383318879257469005213183514198141788721856243012323002918040574620130042525600950194054527550577325180367858044297078430767134699877394021968284720930902168842382438254395831641331031464162303880953652099483575765742678184099031464141627105500305519635666064246996972456805063363748402821554098857406918795889382637943711108237991127990014964590085960051855076682844828804338369755082460688811625876752331529061205713732743489511070422508652976574290839386562566637575303426327575757127655 |
x |
47845035191780764749941007742373799880035138748548539560289365003993231543740 |
hashAlgorithm |
SHA-256 |
input |
73616d706c65 |
expected |
eace8bdbbe353c432a795d9ec556c6d0 21f7a03f42c36e9bc87e4ac7932cc809 7081e175455f9247b812b74583e9e94f 9ea79bd640dc962533b0680793a38d53 |
Vector 5 — RFC 6979 A.2.2 - DSA 2048/256, SHA-512, message “test”
| Field |
Value |
p |
19909645583840807223358780437970167592202534823379006107885035792419538475865479634902323267972117061317804121245140907173935097113576247399194741785152226721473341873971706960174863553222453637180116749817272214187574419417252230377813268188697148436022094448060828280373741234171052994817209856869762092486200197168931490782986275981033576378920487970537764153121784316581144326224775327105327663318577119263972872968741884172308259878838650474752471323444179687700572140998870076554258831982035947730860777879894193344878919032623496744139163741955731247799586400504772446333993669185664236379647531501121348231771 |
q |
109804365839883466641292640488361553607962427199963407681978507099013790665759 |
g |
11677025274495228368531388931705351941276270981197378167013082520925042650145897357007123759040662572890287432551119789668850626383318879257469005213183514198141788721856243012323002918040574620130042525600950194054527550577325180367858044297078430767134699877394021968284720930902168842382438254395831641331031464162303880953652099483575765742678184099031464141627105500305519635666064246996972456805063363748402821554098857406918795889382637943711108237991127990014964590085960051855076682844828804338369755082460688811625876752331529061205713732743489511070422508652976574290839386562566637575303426327575757127655 |
x |
47845035191780764749941007742373799880035138748548539560289365003993231543740 |
hashAlgorithm |
SHA-512 |
input |
74657374 |
expected |
89ec4bb1400eccff8e7d9aa515cd1de7 803f2daff09693ee7fd1353e90a68307 c9f0bdabcc0d880bb137a994cc7f3980 ce91cc10faf529fc46565b15cea854e1 |
Vector 6 — RFC 6979 A.2.1 - verify the published SHA-256 signature over “sample”
| Field |
Value |
p |
94772214835463005053734612688987420745400704367641322402256120323201101201888870137170705373498571313030316679878174804574980244779195907606098768964031739134779278848798229819934901324222106210711842549374102491417296346772453897799554117544442700769168461664359227744193913924495898621041399925210910234489 |
q |
875964080856129786106302881659054003458244253873 |
g |
5401015700248054412670727427618885968561082170092747201289836023587070842129960413909724179237157705995932514206777888947040631335552011708189886180529339953041551030032179217373774180691656086709230043691953506246450665697269251181380801651442389601287318661304902597519067842079816229492516762912476306877 |
y |
65981272545226871808293082206884807809715564184777721368365838833757145153610600281050767521037723462156668187421681385147511924359971290468362554335748909700760731160559242691371027327300057319832175348532904611307937056790357567283070553539180976636914841850698873731865432036638914805503030932393260973883 |
hashAlgorithm |
SHA-256 |
signature |
81f2f5850be5bc123c43f71a3033e938 4611c5454cdd914b65eb6c66a8aaad27 299bee6b035f5e89 |
input |
73616d706c65 |
expected |
01 |
Vector 7 — RFC 6979 A.2.1 - the SHA-256 signature over “sample” must not verify over “test”
| Field |
Value |
p |
94772214835463005053734612688987420745400704367641322402256120323201101201888870137170705373498571313030316679878174804574980244779195907606098768964031739134779278848798229819934901324222106210711842549374102491417296346772453897799554117544442700769168461664359227744193913924495898621041399925210910234489 |
q |
875964080856129786106302881659054003458244253873 |
g |
5401015700248054412670727427618885968561082170092747201289836023587070842129960413909724179237157705995932514206777888947040631335552011708189886180529339953041551030032179217373774180691656086709230043691953506246450665697269251181380801651442389601287318661304902597519067842079816229492516762912476306877 |
y |
65981272545226871808293082206884807809715564184777721368365838833757145153610600281050767521037723462156668187421681385147511924359971290468362554335748909700760731160559242691371027327300057319832175348532904611307937056790357567283070553539180976636914841850698873731865432036638914805503030932393260973883 |
hashAlgorithm |
SHA-256 |
signature |
81f2f5850be5bc123c43f71a3033e938 4611c5454cdd914b65eb6c66a8aaad27 299bee6b035f5e89 |
input |
74657374 |
expected |
00 |
Vector 8 — NIST CAVP FIPS 186-4 SigVer - DSA 2048/256, SHA-384, r carries a leading zero octet
| Field |
Value |
p |
29256606273974765531044720476318025016575042924372853590807509866691659408404022241149940759821980199494248969641028845737450987153476119878252670864878193622215142375852883972099072976055767401709241753239487517717017483905496889667432121445410260804983942741338920523339882306607464227708033639869789971609115172747209478081191983876286410247519310878655797462864174027287102782812624651638606950748652733830695110585545273280955570883884560945091537645778494952933785432643831683114679957400717461536863086646657402270478578133535886259334099493753943464413675728320686630315875429879050479351224729106907621668913 |
q |
64238023367596911329825122116520088682688400887480168086904436075040868653871 |
g |
27794115809645489490714951217028688760057045886209814547968946443020009108527001926730427483410037725267946266787690864314143789471288931592021050301961433724547755543089708071144425310557622677894170770151317430483403137403539924428388393997205355165520540645784492236951962134111687569780416892233754750567195684900716084784767466795825105376949045959724532762962290309204323727598916767689562111249752884116868042587466193697126973018329883268890385784364029803282767974484767820785556436023059191623937969579401817747130494193118500482951766567981549784675897121229425038342860291568272904110381491371026423140142 |
y |
14960000650475783397645173710087207161825932917999954300874825643633745163529922141300731599118867153440095178804885583462127831360420040580738868795849556213878734596138216086844836628940097461516409936907570011420166633211456626924421795558199699933790323536265062818260167454046941435549120372864070484855785171983717025648831474561783578630772977509506276480394602547944683126697093637978563053213183850444630721552471136454587382135358590053896603758651849319430841961656880944118773315106713422425230375173772844879197144830319483984900028005421922431341930035207541539411654982371044360679461001025462350520062 |
hashAlgorithm |
SHA-384 |
signature |
003e5c16f064edf41abfb1ef53ff2e87 c22feac955fad9dfb36660055bf0df10 7fa8834b03784afec0d645eb3d33e15a 622b751a0170731936e8de5d2273d927 |
input |
674d691ddac961e3cb49deb36943bc8f 4924877f2bda30c62902c65575525e61 61bdd0b5108d737c8c5aace62aabc008 0495345ad4a52fa9a3d1bed8686a31cb 0247519cde350076976ec166e85b20ec 3e1f8c3d7c184d9142a67a642cbace70 dcb010f1d4c99e68182383fab0a84bd5 5567a5f3a47cceda4164d435059881e1 |
expected |
01 |
Vector 9 — RFC 6979 A.2.1 - the SHA-256 signature over “sample” must not verify under another key
| Field |
Value |
p |
94772214835463005053734612688987420745400704367641322402256120323201101201888870137170705373498571313030316679878174804574980244779195907606098768964031739134779278848798229819934901324222106210711842549374102491417296346772453897799554117544442700769168461664359227744193913924495898621041399925210910234489 |
q |
875964080856129786106302881659054003458244253873 |
g |
5401015700248054412670727427618885968561082170092747201289836023587070842129960413909724179237157705995932514206777888947040631335552011708189886180529339953041551030032179217373774180691656086709230043691953506246450665697269251181380801651442389601287318661304902597519067842079816229492516762912476306877 |
y |
44697323022345607623636189183702374081119759300733066308205740702350806983893 |
hashAlgorithm |
SHA-256 |
signature |
81f2f5850be5bc123c43f71a3033e938 4611c5454cdd914b65eb6c66a8aaad27 299bee6b035f5e89 |
input |
73616d706c65 |
expected |
00 |
Vector 10 — NIST CAVP FIPS 186-4 SigVer - DSA 3072/256, SHA-256, valid signature
| Field |
Value |
p |
4247015197236400559879681727052176110637827143395385554109492820325978635925413625010944121400995874988148698312485905618650745342794108439476910502156030229500138781734059310419738942565304946277103010282358464466734392713016714461341927297186004705219756101063045822736904583979923498878075560155549467463404329516253902160887225344114805087907202037214376239929967533909268160117079754989469798387865338037796365668465893777548123693265323515163825467631190887175735403859704584726077823977853431424861431916920794913325211459122906281886457239656416117088884085552379272829410452940436671621426877167765650174421350751647606068145438521197191287644858461372430526314787611944505037109890118206438525074472897513027954376861900135382851133665696071634152933313629146977977201996526071775728795334312352449307624072873451814439679461175787274385792075027292382481052928748073363605992996970002310167833115802015593380464857 |
q |
102472175883208680794759546491793870282217386140803752469424565173764687465121 |
g |
3781411756541831334524608173232390763192149990142804099720692359023088485742785232910689582204692679971550997722690617527078099614343609327460708592351589907447745072313270781167927872876382327888456620146665775594413839624827014289980618514678166671216826626948212118995128402137545220065086694042895103439290538679537150361999384100862268329155951281040186454380681045354827569509170287996206610481312153307093300373598705114397504128186861599232332008116250866884370124649241925326437831293346436517500378732231780069473990330426868619748078718494399348614609048131721043938426965949288240461060456407722092019890145407468547214931183271628582667412099099007502010882307944065354537291411583628023316899568159857323227180049274568684382154475293542620725980664562022352074379676023762712040422368520493598297465399806710690614391689194390375165225549331162948262804089146015087077581087548144727152525148753310512474928678 |
y |
4140607104665359035965457322232856821453050149309150992542327246294037505467453793654113140375363503193636427085662694533224221353786586951889842684050481902261722717796275116947692463862541024007360465233850751879266133360833535278540935013823235851451180976890158834411933872303006656243973238853630569887941192357307544798573121748187031826831133314522201539212460636649475411425578022507393952195609539157375690742191465821796258316341752094569899312538091859913523502934258006272345181777221703777014023894348894367479820949381810432722133045237273896845106926376531871402114899099331990160294779105062407976195977180071342431094611544189203504987131053303063002286555790490313098592059437387008084336961926186883068754435709790579301181900790239842444630420014863383997246601012157621143903247753366004968202040760813068246122967448783979066672553161183802101656164459597547440369668475013545205651165129535315355766787 |
hashAlgorithm |
SHA-256 |
signature |
d69bb325a255a2c6990237d27d871093 f3f9a1cf4bcee333ab01c189abed84e0 562b9e611160320aafe7753b72e1d993 5d128c2f2c0ae76e603c79d1692eefa3 |
input |
8598872b6dd3dbfe3d49369630105ef6 18580afe74d459bafd803d3da76f5ac0 10e0d4aa113b1ee3b4d329e527de99df 3d3bb65dc8e963d2d553afb271d0600c 1fd2d8a36c7e5a58c5ab2838e1b9d362 a60cc70851114471fec89e83f80f1e17 aa4c794ab08c273a47f0c2ae7fe445b0 063fc87e1fc0865482c636899856369d |
expected |
01 |
Vector 11 — NIST CAVP FIPS 186-4 SigVer - DSA 3072/256, SHA-256, r altered so the signature must be rejected
| Field |
Value |
p |
4247015197236400559879681727052176110637827143395385554109492820325978635925413625010944121400995874988148698312485905618650745342794108439476910502156030229500138781734059310419738942565304946277103010282358464466734392713016714461341927297186004705219756101063045822736904583979923498878075560155549467463404329516253902160887225344114805087907202037214376239929967533909268160117079754989469798387865338037796365668465893777548123693265323515163825467631190887175735403859704584726077823977853431424861431916920794913325211459122906281886457239656416117088884085552379272829410452940436671621426877167765650174421350751647606068145438521197191287644858461372430526314787611944505037109890118206438525074472897513027954376861900135382851133665696071634152933313629146977977201996526071775728795334312352449307624072873451814439679461175787274385792075027292382481052928748073363605992996970002310167833115802015593380464857 |
q |
102472175883208680794759546491793870282217386140803752469424565173764687465121 |
g |
3781411756541831334524608173232390763192149990142804099720692359023088485742785232910689582204692679971550997722690617527078099614343609327460708592351589907447745072313270781167927872876382327888456620146665775594413839624827014289980618514678166671216826626948212118995128402137545220065086694042895103439290538679537150361999384100862268329155951281040186454380681045354827569509170287996206610481312153307093300373598705114397504128186861599232332008116250866884370124649241925326437831293346436517500378732231780069473990330426868619748078718494399348614609048131721043938426965949288240461060456407722092019890145407468547214931183271628582667412099099007502010882307944065354537291411583628023316899568159857323227180049274568684382154475293542620725980664562022352074379676023762712040422368520493598297465399806710690614391689194390375165225549331162948262804089146015087077581087548144727152525148753310512474928678 |
y |
698973361718533257529921789426124878135777614652801008713083901769063806127721292150137849506563431854686049493524203842288526718095656960582728011944613519849984635685686295845095004058480835293263088532927263902704546860460095066969944893369965084722316484736096230348190287186448664771345996744408688732014684019111212303652722627736664586874456785834895558269844594371511364129317562461214154726949525315424476382765977933640666267681074856137155167133628446093109367622794395342371018076376749052799767683473369228512817627433121515603203427137686562998941071375363359293186638418122859521760326559661390988648897160371866630109400303394957752559652811605507137682620833365639424700626308846098955694306367639973395943709271548568295013906169861637911287761237035249246185225233595971787489162476641641631790437565429572119132552253572222998315936356538140312340805686829079112753913017928716642479647372212808366639382 |
hashAlgorithm |
SHA-256 |
signature |
bdffd6b0bed0fc36f3e29b25f475b2e8 f78d2b37e1f02c83525bd21228b521de 2ed6571b366942d4d43a143b838c69a1 632282a15d28d69e35ce547dd6ddbb9f |
input |
a9bc778c5f34420f3a6c212b5d9d68fe 333fcbaf0f6f8af7a6ab8ebfa72d22f6 444567db3a2bf8dd6e84e0965dda56fa 291ee40ed739c8656f1f3cdafc143370 4ba6df1f61d8fc4d75ddf84787698190 8f916fec295a35071a593c649a63d1c0 e58fbcab339dad05f738e716dd4c76c0 969cf8ff2bef3ae897d7f2a5ce51f7af |
expected |
00 |
← All algorithms