# Why can’t DSA be used for encryption?

This question at StackOverflow mentions that DSA cannot be used for encryption. But both RSA and DSA can be used to generate public and private keys, right? Then why can't I use the DSA public key to encrypt?

• You can sue Diffie-Hellman keyexchange to achieve something similar to encryption. – CodesInChaos May 11 '12 at 9:00
• Ron Rivest (the R in RSA) showed that one can encrypt using a MAC using a technique called "Chaffing and Winnowing". It possible to use also special signature schemes, but to my knowledge, not DSA. The purpose of "Chaffing and Winnowing" is not to be practical, but to show that the export restrictions that the US had in the 90s were nonsense (for a cryptologist). – j.p. May 11 '12 at 15:55
• @j.p. thanks for the great link! I just read it; it wasn't about export, but about law enforcement. The point was that you can have confidentiality without encryption, so mandating government access to encryption keys is pointless. – Elliot Gorokhovsky Jun 26 '15 at 21:43
• @CodesInChaos If DSA cannot be used for encryption, I think we should sue NIST and not Diffie-Hellman. :) – Jus12 Sep 19 '15 at 21:29

DSA stands for "Digital Signature Algorithm" - and is specifically designed to produce digital signatures, not perform encryption.

The requirement for public/private keys in this system is for a slightly different purpose - whereas in RSA, a key is needed so anyone can encrypt, in DSA a key is needed so anyone can verify. In RSA, the private key allows decryption; in DSA, the private key allows signature creation.

The fact that RSA also can be used for signatures is a result of the textbook algorithm being a trapdoor permutation - in simple terms, this means the ciphertext and the plaintext are part of the same set space. It is not a requirement of a public key algorithm for this to be the case - public key algorithms just require trapdoor functions.

• Thanks. But theoretically is it possible to encrypt using DSA ? – Lunar Mushrooms May 11 '12 at 9:16
• @LunarMushrooms That's a nonsensical question. It's a signature algorithm. You can't use RSA signature algorithms for encryptions either. You'd need to ask if the mathematical structure underlying DSA can be used for encryption. AFAIK it can't, but it can be used for key-exchange, which is very similar to encryption. – CodesInChaos May 11 '12 at 9:26
• @CodeInChaos: Ron Rivest doesn't agree with your "That's a nonsensical question.", see my comment to the OP. – j.p. May 11 '12 at 15:57
• @jug That scheme is certainly not asymmetric encryption. It's not even real encryption, it's just a way to transmit secret information without using "real" encryption. – CodesInChaos May 11 '12 at 17:37
• Everything else I have to say is in the existing answer - a lot of confusion arises from the fact textbook RSA can be used both ways. However, deployed, secure-as-far-as-we-know RSA does not work this way - there are actually separate algorithms (RSA-OAEP and RSA-PSS) for encryption and signing respectively and they are not designed to be interchanged, although they share a similarity in being based on RSA, of course. – diagprov Oct 25 '16 at 12:56

I don't know about the math, but without encryption, DSA is not subject to encryption law. It can be used in a product and that product can be exported.

• This might answer the question "Why would one use an algorithm which can only sign, not encrypt", but this is not really the question asked here. Welcome to Cryptography Stack Exchange, by the way. – Paŭlo Ebermann May 11 '12 at 12:27
• I would not necessarily downvote. DSA was created by NIST and this might well have been one reason in the design -- to make it hard for encryption. – Jus12 Oct 24 '16 at 8:53

To reduce misunderstandings, I modified it, just talking about the very question and the encryption .

I will try to answer this question with the help of OpenSSL commands and add some explanations to them.

# 1. The RSA algorithm can be used for encryption.

There is RSA encrytion command openssl rsautl in OpenSSL.

## 1.1. If encrypted by the public key, and decrypted by secret key , this is called encryption.

This is the encryption procedure by OpenSSL

1.1.1. The content of the file example.txt
 hello,openssl!

1.2.2. Encryption by public key rsa_pub_2048.pub
 openssl rsautl  -inkey rsa_pub_2048.pub -pubin  -in example.txt  -encrypt >example_encrypt.bin

1.3.3. Decryption by rsa_pri_2048.key rsa_pri_2048.key :
 openssl rsautl -inkey  rsa_pri_2048.key -decrypt  -in example_encrypt.bin


# 2. But the DSA algorithm is different from RSA.

## 2.1. The DSA algorithm can theoretically be used for encryption according to its mathematical properties because DSA is based on the discrete algorithm, and it can be used for Diffie–Hellman key exchange.

So a number can be negotiated by the DSA parameters, and we can use this number to encrypt.
(Just by the number itself, not by DES or AES.)

For example, this is one of the ways to encrypt using the negotiated number.
1. Since the number $$K_M$$ is negotiated by the two sides(Alice and Bob), they both know the number.
2. Alice encrypt the message $$x \in Z_p^*$$ , $$y \equiv x \cdot K_M \pmod p$$
3. Bob can decrypt the message $$x \equiv y \cdot K_M^{-1} \pmod p$$
This algorithm is take form the book 《Understanding Cryptography》

## 2.2. But there is no such standard for encryption by DSA in engineering.

So there is no such encryption command in OpenSSL.

## 2.3. So DSA is only used for signing in engineering.

The openssl dgst command can alse be used by RSA and ECDSA key. I just emphasize that there is no similar openssl rsautl command in DSA to encrypt directly.
This is the signature and verification procedure by openssl in DSA.

2.3.1. Sign a file file.txt by secret key dsakey_2048.pem
  openssl dgst -sha256 -sign dsakey_2048.pem  -out signature_2048.sign file.txt

2.3.2. Verify a signature by secret key dsakey_2048.pem
  openssl dgst -sha256 -prverify dsakey_2048.pem  -signature  signature_2048.sign  file.txt

2.3.3. Verify a signature by secret key dsakey_2048.pem
  openssl dgst -sha256 -verify pubkey_2048.pem  -signature  signature_2048.sign  file.txt


# 3. How does encryption is performed in HTTPS using DSA keys?

## 3.2. A symmetric encryption(such as AES) is used to encrypt by the big number.

This is the Cipher Suite by the DSA in HTTPS, it called DH+DSS+AES.

     TLS_DH_DSS_WITH_AES_256_CBC_SHA256 (0x0068)
TLS_DH_DSS_WITH_AES_256_CBC_SHA (0x0036)
TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA (0x0085)
TLS_DH_DSS_WITH_AES_128_GCM_SHA256 (0x00a4)
TLS_DH_DSS_WITH_AES_128_CBC_SHA256 (0x003e)
TLS_DH_DSS_WITH_AES_128_CBC_SHA (0x0030)
TLS_DH_DSS_WITH_SEED_CBC_SHA (0x0097)
TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA (0x0042)


## 3.3 So the encrypt is performed by Diffie–Hellman Algorithm and AES, not by the DSA itself.

• – kelalaka Sep 27 at 9:01
• " (Just by the number itself, not by DES or AES.) " Why is this sentence here? DH agreement followed by a symmetric cipher is called IES, so I don't see why DES / AES cannot be used. – Maarten - reinstate Monica Sep 27 at 12:02
• @MaartenBodewes I mean you can use DES/AES,but this is not the encryption just using DSA parameters. Not using DES/AES , encryption can be done mathematically just by DSA parameters, but there is no standard in engineering. – 孙海城 Sep 29 at 4:02
• @kelalaka Thank you. But from the point of view of easy understanding, not involving the RSA signature standard, just answering the very question, we can say that? – 孙海城 Sep 29 at 4:16