Windows abandoned DSA rather than extend it to support > 1024 bits; but otherwise I cannot find a reason why DSA would be less desirable. I see in SSH the disabling it by default with a completely unsubstantiated claim that it is inherently weaker. But on the other hand GPG says that DSA is well-regarded.

My understanding is both the prime factorization problem and the discreet logarithm problems must hold for RSA to hold but only the discreet logarithm problem must hold for DSA to hold.


1 Answer 1


One disadvantage of DSA as conventionally implemented is that the key can be compromised if signatures are created on machines with poor random number generators.

In the wake of the Debian openssl fiasco this meant that any DSA key that had been used in an openssh client on an affected machine was potentially compromised. With RSA keys only keys generated on machines with the bad random number generator were affected (and were dealt with by a blacklist).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.