0
$\begingroup$

TLS_DHE_DSS_AES256_CBC_MAC / TLS_DHE_RSA_AES256_CBC_MAC

Hi, I have been studying to learn about various cipher suites and their performances. I gathered that DSS is efficient when compared with RSA. Is it correct and please anyone explain me about their performances and differences?

$\endgroup$
  • 1
    $\begingroup$ Nobody uses DSS suites/certificates. If you want better performance, go with the elliptic curve equivalent, ECDHE_ECDSA $\endgroup$ – CodesInChaos Mar 22 '15 at 9:30
  • $\begingroup$ Can anyone please explain in detail about the two ciphersuites given above by comparing it? $\endgroup$ – chris Mar 24 '15 at 1:47
  • $\begingroup$ Often DH/DSA implementations are also constrained to relatively small key sizes. RSA implementations seem less reluctant to support larger sizes (probably because they are easier to configure - all the parameters are specific to the key and of course because most certificates use RSA). $\endgroup$ – Maarten - reinstate Monica Mar 29 '15 at 16:41
2
$\begingroup$

Ok so first thing, RSA is a signature algorithm where DSS is a signature standard that currently uses the DSA algorithm with fixed parameters. For more details, see this great explanation.

So what we are actually comparing is RSA and DSA. The main difference is, that they rely on completely different hardness assumptions. I will try to explain them in a simplified manner as the underlying math is very complex, so please forgive me some abstractions.

DSA (as ElGamal) relies on the assumption that the discrete logarithm is hard in some special (sub)groups, meaning in those groups dlog is believed to be computationally hard. In contrast, RSA bases its security on the (assumed) hardness of factoring, meaning given only a large number N that is the product of 2 primes p and q, it is hard to compute p and q from N.

So in the unlikely case that researchers find an effective factoring algorithm for example, RSA is broken but DSA is still fine. In contrast, if dlog is easy, DSA can not be used anymore and RSA is still secure.

Given that, it seems to be a good idea to have several algorithms which rely on different assumptions just for the case that one is not true.

I hope this gives you a rough idea of the conceptual difference of those two signature algorithms.

$\endgroup$
  • 1
    $\begingroup$ I would say seemingly different hardness assumptions. Both problems are attacked by the same algorithm GNFS. $\endgroup$ – 111 Mar 29 '15 at 18:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.