/ 
Crypt-DSA-1.18-TRIAL UNAUTHORIZED RELEASE
/ Crypt::DSA::Key
Security Advisories (4)
CVE-2026-8700 (2026-05-15)

Crypt::DSA versions before 1.20 for Perl generate seeds using rand. Seeds were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.

CVE-2026-8704 (2026-05-15)

Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified.

CVE-2026-12205 (2026-06-15)

Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it. The first sign() on a Key object picks a nonce, and every later sign() on that same object reuses it, producing an identical "r". Keys used to sign more than once with an affected version should be considered compromised.

CVE-2026-14570 (2026-07-05)

Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery. "Crypt::DSA::Util::makerandom forces the high bit of every value it returns to obtain an exactly N-bit integer for prime search. The signing nonce and the private key are drawn from makerandom. Because the high bit is always set, the result is not uniform: its top bit is fixed, producing insecure values." An attacker who collects a modest number of signatures under an affected key, together with the public key, can recover the private key with a lattice attack. Keys used to sign with an affected version should be considered compromised and new keys should be generated.

NAME

Crypt::DSA::Key - DSA key

SYNOPSIS

use Crypt::DSA::Key;
my $key = Crypt::DSA::Key->new;

$key->p($p);

DESCRIPTION

Crypt::DSA::Key contains a DSA key, both the public and private portions. Subclasses of Crypt::DSA::Key implement read and write methods, such that you can store DSA keys on disk, and read them back into your application.

USAGE

Any of the key attributes can be accessed through combination get/set methods. The key attributes are: p, q, g, priv_key, and pub_key. For example:

$key->p($p);
my $p2 = $key->p;

$key = Crypt::DSA::Key->new(%arg)

Creates a new (empty) key object. All of the attributes are initialized to 0.

Alternately, if you provide the Filename parameter (see below), the key will be read in from disk. If you provide the Type parameter (mandatory if Filename is provided), be aware that your key will actually be blessed into a subclass of Crypt::DSA::Key. Specifically, it will be the class implementing the specific read functionality for that type, eg. Crypt::DSA::Key::PEM.

Returns the key on success, undef otherwise. (See Password for one reason why new might return undef).

%arg can contain:

  • Type

    The type of file where the key is stored. Currently the only option is PEM, which indicates a PEM file (optionally encrypted, ASN.1-encoded object). Support for reading/writing PEM files comes from Convert::PEM; if you don't have this module installed, the new method will die.

    This argument is mandatory, if you're either reading the file from disk (ie. you provide a Filename argument) or you've specified the Content argument.

  • Filename

    The location of the file from which you'd like to read the key. Requires a Type argument so the decoder knows what type of file it is. You can't specify Content and Filename at the same time.

  • Content

    The serialized version of the key. Requires a Type argument so the decoder knows how to decode it. You can't specify Content and Filename at the same time.

  • Password

    If your key file is encrypted, you'll need to supply a passphrase to decrypt it. You can do that here.

    If your passphrase is incorrect, new will return undef.

$key->write(%arg)

Writes a key (optionally) to disk, using a format that you define with the Type parameter.

If your $key object has a defined priv_key (private key portion), the key will be written as a DSA private key object; otherwise, it will be written out as a public key. Note that not all serialization mechanisms can produce public keys in this version--currently, only PEM public keys are supported.

%arg can include:

  • Type

    The type of file format that you wish to write. PEM is one example (in fact, currently, it's the only example).

    This argument is mandatory, unless your $key object is already blessed into a subclass (eg. Crypt::DSA::Key::PEM), and you wish to write the file using the same subclass.

  • Filename

    The location of the file on disk where you want the key file to be written.

  • Password

    If you want the key file to be encrypted, provide this argument, and the ASN.1-encoded string will be encrypted using the passphrase as a key.

$key->size

Returns the size of the key, in bits. This is actually the number of bits in the large prime p.

AUTHOR & COPYRIGHTS

Please see the Crypt::DSA manpage for author, copyright, and license information.