There have been horrible implementation flaws in RSA too. For all we know, we're a survey away from finding tens of thousands of factor collisions in RSA keys. I really don't think it matters much whether you use RSA or DSA.
I think the intuition was more that RSA is a simpler algorithm to understand and implement, so the "goof surface" is lower. But yeah, someone somewhere will screw up everything.
It's actually the opposite. RSA is more complex and has more failure modes; the discrete log problem that DSA/DH/ElG use is about as simple as it gets.
Again: I don't think it matters. The Debian fiasco was a devastating fuckup in the core of the most important Unix crypto library, did not just affect DSA, and didn't itself have anything to do with DSA.
Not sure I follow. DSA requires a modular inverse algorithm which RSA doesn't (beyond that both are reliant on modular exponentiation and prime generation as the only "hard parts"). DSA has more algorithm parameters. It's just a more complicated scheme to implement any way you slice it. DSA requires more "units of mistake", and is more likely to be screwed up by the programmer.
Ah, I see where you're coming from. I have a mental shorthand that basically says "DSA is the one that works like DH", and you're right, you need the inverse for DSA.
But regarding failure modes, I'm thinking of (as a starting point) things like:
http://www.ams.org/notices/199902/boneh.pdf
There are a lot of implementation errors that happen with RSA. What's a comparable list for DSA? Failure to generate good nonces, and then...?
