Why DSA cannot be used for encryption?

Here it is mentioned that DSA cannot be used for encrypt. But Both RSA and DSA can be used to generate public and private keys, right? (Or am I wrong?). Then why can't I use the DSA public key to encrypt?

-

migrated from stackoverflow.comMay 11 '12 at 10:59

This question came from our site for professional and enthusiast programmers.

You can sue Diffie-Hellman keyexchange to achieve something similar to encryption. –  CodesInChaos May 11 '12 at 9:00
Ron Rivest (the R in RSA) showed that one can encrypt using a MAC using a technique called "Chaffing and Winnowing". It possible to use also special signature schemes, but to my knowledge, not DSA. The purpose of "Chaffing and Winnowing" is not to be practical, but to show that the export restrictions that the US had in the 90s were nonsense (for a cryptologist). –  j.p. May 11 '12 at 15:55

DSA stands for "Digital Signature Algorithm" - and is specifically designed to produce digital signatures, not perform encryption.

The requirement for public/private keys in this system is for a slightly different purpose - whereas in RSA, a key is needed so anyone can encrypt, in DSA a key is needed so anyone can verify. In RSA, the private key allows decryption; in DSA, the private key allows signature creation.

The fact that RSA also can be used for signatures is a result of the textbook algorithm being a trapdoor permutation - in simple terms, this means the ciphertext and the plaintext are part of the same set space. It is not a requirement of a public key algorithm for this to be the case - public key algorithms just require trapdoor functions.

-
Thanks. But theoretically is it possible to encrypt using DSA ? –  Lunar Mushrooms May 11 '12 at 9:16
@LunarMushrooms That's a nonsensical question. It's a signature algorithm. You can't use RSA signature algorithms for encryptions either. You'd need to ask if the mathematical structure underlying DSA can be used for encryption. AFAIK it can't, but it can be used for key-exchange, which is very similar to encryption. –  CodesInChaos May 11 '12 at 9:26
@CodeInChaos: Ron Rivest doesn't agree with your "That's a nonsensical question.", see my comment to the OP. –  j.p. May 11 '12 at 15:57
@jug That scheme is certainly not asymmetric encryption. It's not even real encryption, it's just a way to transmit secret information without using "real" encryption. –  CodesInChaos May 11 '12 at 17:37
@CodeInChaos: I'm well aware that Rivest's scheme is neither practical nor asymmetric. Lunar asks the encryption scheme neither to be asymmetric nor practical ("But theoretically is it possible..."). –  j.p. May 12 '12 at 14:04

I don't know about the math, but without encryption, DSA is not subject to encryption law. It can be used in a product and that product can be exported.

-
This might answer the question "Why would one use an algorithm which can only sign, not encrypt", but this is not really the question asked here. Welcome to Cryptography Stack Exchange, by the way. –  Paŭlo Ebermann May 11 '12 at 12:27