Hi, I have been studying to learn about various cipher suites and their performances. I gathered that DSS is efficient when compared with RSA. Is it correct and please anyone explain me about their performances and differences?

  • 1
    $\begingroup$ Nobody uses DSS suites/certificates. If you want better performance, go with the elliptic curve equivalent, ECDHE_ECDSA $\endgroup$ Mar 22, 2015 at 9:30
  • $\begingroup$ Can anyone please explain in detail about the two ciphersuites given above by comparing it? $\endgroup$
    – chris
    Mar 24, 2015 at 1:47
  • $\begingroup$ Often DH/DSA implementations are also constrained to relatively small key sizes. RSA implementations seem less reluctant to support larger sizes (probably because they are easier to configure - all the parameters are specific to the key and of course because most certificates use RSA). $\endgroup$
    – Maarten Bodewes
    Mar 29, 2015 at 16:41

1 Answer 1


Ok so first thing, RSA is a signature algorithm where DSS is a signature standard that currently uses the DSA algorithm with fixed parameters. For more details, see this great explanation.

So what we are actually comparing is RSA and DSA. The main difference is, that they rely on completely different hardness assumptions. I will try to explain them in a simplified manner as the underlying math is very complex, so please forgive me some abstractions.

DSA (as ElGamal) relies on the assumption that the discrete logarithm is hard in some special (sub)groups, meaning in those groups dlog is believed to be computationally hard. In contrast, RSA bases its security on the (assumed) hardness of factoring, meaning given only a large number N that is the product of 2 primes p and q, it is hard to compute p and q from N.

So in the unlikely case that researchers find an effective factoring algorithm for example, RSA is broken but DSA is still fine. In contrast, if dlog is easy, DSA can not be used anymore and RSA is still secure.

Given that, it seems to be a good idea to have several algorithms which rely on different assumptions just for the case that one is not true.

I hope this gives you a rough idea of the conceptual difference of those two signature algorithms.

  • 1
    $\begingroup$ I would say seemingly different hardness assumptions. Both problems are attacked by the same algorithm GNFS. $\endgroup$
    – 111
    Mar 29, 2015 at 18:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.