Subject: Re: Encoding of hash in El-Gamal signatures

From: "Michael Young" <[email-masked]>
Date: Fri, 1 Dec 2000 14:04:19 -0500

-----BEGIN PGP SIGNED MESSAGE-----

The specification already mentions precautions in ElGamal
signature handling, and provides a reference.

The original question is still valid, though, and I'd also
be interested in seeing clarification.  If the specification
includes ElGamal signatures, it should provide sufficient
definition to achieve interoperability.  For other
algorithms, there is a discussion of how the hash is padded
(where applicable) and what the algorithm-specific fields in
the signature should be.  One might guess that the same
PKCS-1 padding scheme should be used, and that the MPIs
should be the "r" (=g^k mod p) and "s" (=(h-r*x)/k mod p)
values, in that order.  Is that right?  Yes, I could use the
GnuPG source as the specification, but that shouldn't be
necessary.

If you want to argue that OpenPGP shouldn't support this
algorithm, and that it should be removed from the
specification entirely, I wouldn't object.