sshkeygen
defaults to creating RSA keys, but gpg genkey
prefers DSA/ElGamal.
Which one  RSA or DSA  is better for GPG?
Which one  RSA or DSA  is better for GPG? 


The GPG maintainers are thinking of changing the default to RSA (source: Dealing with weakness in SHA1 [LWN.net]). So, it seems they think RSA is currently the better option (and they should know more about it than you or me). 


RSA and DSA  misconceptions and useful information
In 2003, RSA vs DSA Signatures  The Winner is...  RSA.
Recent IETF Draft: DSA with SHA2 for DNSSEC, Expiring Jan 7, 2010.
But, this is only a draft at the moment. Everyone loves the verification speed of RSA(!). 


RSA. There were some weaknesses discovered in SHA1, which is the hash used by DSA. Debian are migrating all their keys from DSA to RSA. 


Also the use of SHA2 algorithms is possible and allowed since current revision of DSS; but I was unable to find out which revision GPG follows. Concerning to the current DSS specification (FIPS1863, p. i) any hash function specified in the SHS (FIPS1803, p. iv) may be used: DSS:
SHS:
To the question: Both algorithms are based on mathematical problems which are not proven to be secure (RSA uses the problem of factorizing numbers and DSA uses the discrete logarithm problem), you cannot say one is more secure than the other, because not the one problem nor the other has ever been solved. But by using DSA with SHA1 you may have a security problem, as already said by pgs. 


Quoting a forum discussion:
I think that if you're using it in a standard way (i.e. you don't encrypt a huge amount of data) they'll both do well. I would personally choose RSA because I've learned the algorithm, and it's one of the most beautiful algorithms I've ever seen. 


The fact is it probably doesn't matter much to you :) As part of preparing to generate a keypair and as part of maintaining existing keypairs  regardless of what asymmetric crypto you choose you should be : 1) checking current recommended key lengths 2) chose a base/modulo to optimize for signing, or verification  depending on what will be doen more often (keys to be used in issuing TLS/SSL server certificates should be optimized for verification since every web browser will check the signature... keys used to be used in signing software should be similarly optimized) 3) make sure you age your keys  been using the same key for sshauth for a few years, might be time to regen even if you chose a key size that is still reasonable for the application today. Both RSA and DSA have been substantially evaluated; if you are using a realiable code base (RSAREF, RSA commercial, Mozilla/Netscape, Microsoft, OpenSSL, ...) then you probably don't care which cryptosystem you use so long as you use it correctly and utilize current best practices 

