DSS is based on the discrete log problem (see Question 3.4.9)
and derives from cryptosystems proposed by Schnorr and ElGamal. It is for
authentication only.
DSS has, for the most part, been looked upon unfavorably by the
computer industry, much of which had hoped the government would choose
the RSA algorithm as the official standard; RSA is the most widely used
authentication algorithm. Several articles in the press, such as,
discuss the industry dissatisfaction with DSS. Criticism of DSS has
focused on a few main issues: it lacks key exchange capability; the
underlying cryptosystem is too recent and has been subject to too
little scrutiny for users to be confident of its strength; verification
of signatures with DSS is too slow; the existence of a second
authentication standard will cause hardship to computer hardware and
software vendors, who have already standardized on RSA; and that the
process by which NIST chose DSS was too secretive and arbitrary, with
too much influence wielded by NSA. Other criticisms were addressed by
NIST by modifying the original proposal.
In the DSS system, signature generation is faster than signature verification, whereas in the RSA system, signature verification is faster than signature generation (if the public and private exponents are chosen for this property, which is the usual case). NIST claims that it is an advantage of DSS that signing is faster, but many people in cryptography think that it is better for verification to be the faster operation.