Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Windows abandoned DSA rather than extend it to support > 1024 bits; but otherwise I cannot find a reason why DSA would be less desirable. I see in SSH the disabling it by default with a completely unsubstantiated claim that it is inherently weaker. But on the other hand GPG says that DSA is well-regarded.

My understanding is both the prime factorization problem and the discreet logarithm problems must hold for RSA to hold but only the discreet logarithm problem must hold for DSA to hold.

share|improve this question
up vote 3 down vote accepted

One disadvantage of DSA as conventionally implemented is that the key can be compromised if signatures are created on machines with poor random number generators.

In the wake of the Debian openssl fiasco this meant that any DSA key that had been used in an openssh client on an affected machine was potentially compromised. With RSA keys only keys generated on machines with the bad random number generator were affected (and were dealt with by a blacklist).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.