4.4.2.1 The DSAKeyValue Element

Identifier

Type=" http//www.w3.org/2000/09/xmldsig#DSAKeyValue"
(this can be used within a RetrievalMethod or Reference element to identify the referent's type)

DSA keys and the DSA signature algorithm are specified in [DSS]. DSA public key values can have the following fields:

P

a prime modulus meeting the [DSS] requirements

Q

an integer in the range 2**159 < Q < 2**160 which is a prime divisor of P-1

G

an integer with certain properties with respect to P and Q

Y

G**X mod P (where X is part of the private key and not made public)

seed

a DSA prime generation seed

pgenCounter

a DSA prime generation counter

Parameters seed and pgenCounter are used in the DSA prime number generation algorithm specified in [DSS]. As such, they are optional but must either both be present or both be absent. This prime generation algorithm is designed to provide assurance that a weak prime is not being used and it yields a P and Q value. Parameters P, Q, and G can be public and common to a group of users. They might be known from application context. As such, they are optional but P and Q must either both appear or both be absent. If all of P, Q, seed, and pgenCounter are present, implementations are not required to check if they are consistent and are free to use either P and Q or seed and pgenCounter. All parameters are encoded as base64 [MIME] values.

Arbitrary-length integers (e.g. "bignums" such as RSA moduli) are represented in XML as octet strings as defined by the ds:CryptoBinary type.

   Schema:

   <element name="DSAKeyValue" type="ds:DSAKeyValueType"/> 
   <complexType name="DSAKeyValueType"> 
     <sequence>
       <sequence minOccurs="0">
         <element name="P" type="ds:CryptoBinary"/> 
         <element name="Q" type="ds:CryptoBinary"/>
       </sequence>
       <element name="G" type="ds:CryptoBinary" minOccurs="0"/> 
       <element name="Y" type="ds:CryptoBinary"/> 
       <sequence minOccurs="0">
         <element name="Seed" type="ds:CryptoBinary"/> 
         <element name="PgenCounter" type="ds:CryptoBinary"/> 
       </sequence>
     </sequence>
   </complexType>

   DTD:

   <!ELEMENT DSAKeyValue (P, Q)?, G?, Y, (Seed, PgenCounter)?) > 
   <!ELEMENT P (#PCDATA) >
   <!ELEMENT Q (#PCDATA) >
   <!ELEMENT G (#PCDATA) >
   <!ELEMENT Y (#PCDATA) >
   <!ELEMENT Seed (#PCDATA) >
   <!ELEMENT PgenCounter (#PCDATA) >