Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have found this relatively old question about whether RSA or DSA is the preferred algorithm for signing and encrypting with GnuPG.

When using gpg --gen-key, the two relevant choices are either "RSA and RSA" or "DSA and Elgamal". Which is better? What are the pros and cons for each? Has anything changed since 2009?

share|improve this question

closed as too broad by random May 29 at 17:23

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

    
found these posts helpful as well: linuxquestions.org/565242#2986414 and lists.gnupg.org/022764 –  RubyTuesdayDONO Jan 5 at 21:23

2 Answers 2

up vote 38 down vote accepted

Trustworthy Recommendations

When at the time of the last post, there still was debate on changing default algorithms still found in web archive which had rough consensus, the switch to RSA 2k keys as default has been performed.

Debian recommends using a 4k RSA key in their document about using subkeys and debian-keys readme file. A vast majority of about three quarters of keys in debian developers keyring is (still) DSA/Elgamal (counted by grepping through gpg's output).

In an interview with iX (a German computer sciences magazine, issue 11/2013, also available online for free), the inventor of PGP Phil Zimmermann recommends "at least 3k length when using RSA", although 1k keys are not broken yet. But they're "in reach of attackers rich in resources".

Regarding Security

Right now both are said to be secure for adequate key sizes (4k recommended for RSA, 2k necessary for DSA2, otherwise you will use DSA1 which uses SHA-1).

For selecting a RSA key length, have a look at an overview on the actual strength provided by NIST (p. 64). It is easy to see that the strength does not linearly grow with the key length (and computing time), so double size does not mean "double security".

There was a problem with OpenSSL's DSA-implementation on Debian, but this was caused by using bad random data and could have happened with RSA, too.

Choosing Between RSA and DSA2

pro RSA

  • RSA is more wide-spread, though not necessary in OpenPGP standard, all major implementations can deal with it; DSA2 not (yet)
  • RSA offers much faster signature checking

pro DSA2

  • Smaller signatures, but they're small anyway; for e-mail and code signing probably negligible
  • Faster key creation (can be relevant on low power and embedded devices like mobiles and routers)
  • Slightly faster for signing

My own Decision

When recently creating a new OpenPGP key, I decided to go for 8k RSA for primary keys and 4k RSA as subkeys for daily use. RSA signatures are fast to verify anyway and the huge 8k signatures are only used for signing other keys, but 8k should be considered sufficient for a really long time. 4k is fine for a current subkey as it's cheap to revoke it without loosing all your signatures.

Creating that 8k key took about 20 minutes on my Core 2 Duo T9300, so take your time and do some work (for feeding the random source).

share|improve this answer
    
Unfortunately I can't vote you up because I lack the reputation to do so in SuperUser. Thank you for your time and effort! –  The-Q Jan 24 '13 at 18:54

Whereas I opted for a 4K RSA master key with a 3K RSA signing subkey and a 4K El-Gamal encryption subkey. The only reason I haven't gone for a higher master key at this point is because of the prevalence of users with mobile devices which really struggle with the larger keys.

Of course I do have larger keys for certain specific purposes, but that tends not to be for communication with others.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.