Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Windows abandoned DSA rather than extend it to support > 1024 bits; but otherwise I cannot find a reason why DSA would be less desirable. I see in SSH the disabling it by default with a completely unsubstantiated claim that it is inherently weaker. But on the other hand GPG says that DSA is well-regarded.
My understanding is both the prime factorization problem and the discreet logarithm problems must hold for RSA to hold but only the discreet logarithm problem must hold for DSA to hold.
One disadvantage of DSA as conventionally implemented is that the key can be compromised if signatures are created on machines with poor random number generators.
In the wake of the Debian openssl fiasco this meant that any DSA key that had been used in an openssh client on an affected machine was potentially compromised. With RSA keys only keys generated on machines with the bad random number generator were affected (and were dealt with by a blacklist).
