Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 1 down vote favorite

Here it is mentioned that DSA cannot be used for encrypt. But Both RSA and DSA can be used to generate public and private keys, right? (Or am I wrong?). Then why can't I use the DSA public key to encrypt?

share|improve this question
1  
You can sue Diffie-Hellman keyexchange to achieve something similar to encryption. – CodesInChaos May 11 '12 at 9:00
Ron Rivest (the R in RSA) showed that one can encrypt using a MAC using a technique called "Chaffing and Winnowing". It possible to use also special signature schemes, but to my knowledge, not DSA. The purpose of "Chaffing and Winnowing" is not to be practical, but to show that the export restrictions that the US had in the 90s were nonsense (for a cryptologist). – jug May 11 '12 at 15:55

migrated from stackoverflow.com May 11 '12 at 10:59

2 Answers

up vote 6 down vote accepted

DSA stands for "Digital Signature Algorithm" - and is specifically designed to produce digital signatures, not perform encryption.

The requirement for public/private keys in this system is for a slightly different purpose - whereas in RSA, a key is needed so anyone can encrypt, in DSA a key is needed so anyone can verify. In RSA, the private key allows decryption; in DSA, the private key allows signature creation.

The fact that RSA also can be used for signatures is a result of the textbook algorithm being a trapdoor permutation - in simple terms, this means the ciphertext and the plaintext are part of the same set space. It is not a requirement of a public key algorithm for this to be the case - public key algorithms just require trapdoor functions.

share|improve this answer
Thanks. But theoretically is it possible to encrypt using DSA ? – Lunar Mushrooms May 11 '12 at 9:16
@LunarMushrooms That's a nonsensical question. It's a signature algorithm. You can't use RSA signature algorithms for encryptions either. You'd need to ask if the mathematical structure underlying DSA can be used for encryption. AFAIK it can't, but it can be used for key-exchange, which is very similar to encryption. – CodesInChaos May 11 '12 at 9:26
@CodeInChaos: Ron Rivest doesn't agree with your "That's a nonsensical question.", see my comment to the OP. – jug May 11 '12 at 15:57
@jug That scheme is certainly not asymmetric encryption. It's not even real encryption, it's just a way to transmit secret information without using "real" encryption. – CodesInChaos May 11 '12 at 17:37
@CodeInChaos: I'm well aware that Rivest's scheme is neither practical nor asymmetric. Lunar asks the encryption scheme neither to be asymmetric nor practical ("But theoretically is it possible..."). – jug May 12 '12 at 14:04
up vote -1 down vote

I don't know about the math, but without encryption, DSA is not subject to encryption law. It can be used in a product and that product can be exported.

share|improve this answer
2  
This might answer the question "Why would one use an algorithm which can only sign, not encrypt", but this is not really the question asked here. Welcome to Cryptography Stack Exchange, by the way. – Paŭlo Ebermann♦ May 11 '12 at 12:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.