Digital Signature Algorithm

Choose an approved ${\displaystyle H}$ with output length ${\displaystyle |H|}$ bits. In the original DSS, ${\displaystyle H}$ was always SHA-1, but the stronger SHA-2 hash functions are approved for use in the current DSS.^[3][14] If ${\displaystyle |H|}$ is greater than the modulus length ${\displaystyle N}$, only the leftmost ${\displaystyle N}$ bits of the hash output are used.

cryptographic hash function

Choose a key length ${\displaystyle L}$. The original DSS constrained ${\displaystyle L}$ to be a multiple of 64 between 512 and 1024 inclusive. NIST 800-57 recommends lengths of 2048 (or 3072) for keys with security lifetimes extending beyond 2010 (or 2030).

[15]

Choose the modulus length ${\displaystyle N}$ such that ${\displaystyle N<L}$ and ${\displaystyle N\leq |H|}$. FIPS 186-4 specifies ${\displaystyle L}$ and ${\displaystyle N}$ to have one of the values: (1024, 160), (2048, 224), (2048, 256), or (3072, 256).

[3]

Choose an ${\displaystyle N}$-bit prime ${\displaystyle q}$.

Choose an ${\displaystyle L}$-bit prime ${\displaystyle p}$ such that ${\displaystyle p-1}$ is a multiple of ${\displaystyle q}$.

Choose an integer ${\displaystyle h}$ randomly from ${\displaystyle \{2\ldots p-2\}}$.

Compute ${\displaystyle g:=h^{(p-1)/q}\mod p}$. In the rare case that ${\displaystyle g=1}$ try again with a different ${\displaystyle h}$. Commonly ${\displaystyle h=2}$ is used. This can be computed efficiently even if the values are large.

modular exponentiation

Botan

Bouncy Castle

cryptlib

Crypto++

libgcrypt

Nettle

OpenSSL

wolfCrypt

GnuTLS

Modular arithmetic

RSA (cryptosystem)

ECDSA

the fourth (and current) revision of the official DSA specification.

FIPS PUB 186-4: Digital Signature Standard (DSS)

NIST Special Publication 800-57, p. 62–63

Recommendation for Key Management -- Part 1: general