DSA: why using mod p mod q and not just mod p I'd like to know, in DSA we compute several values modulo $p$ and modulo $q$, like $r = (g^k \bmod p) \bmod q$ or $v = (g^{u_1}h^{u_2} \bmod p) \bmod q$.

As far as I understand, we want to use two different primes $p$ and $q$ instead of just one to make sure that $g$ is of prime order $q$ in order to be able to invert elements (let me know if my understanding is wrong). But once we make sure to have $g^q = 1 \bmod p$, why do we add on top of that another modulo q? After a quick look, all the equations seems to hold if we just work modulo $p$...

The only reason for me that could explain it would be that because $s$ is computed modulo $q$, it's not really useful to store $r \bmod p$, and for "optimization" one can store directly $(r \bmod p) \bmod q$... Is it the reason or did I miss something?

Thanks!
Consider the function $f\colon \mathbb Z \to \mathbb Z$ given by $f(x) = g^x \bmod p$ where $g$ has order $q$ modulo $p$.  If $x \equiv y \pmod q$, then necessarily $f(x) = f(y)$, since by hypothesis $x = y + \ell q$ for some $\ell$, so

\begin{equation}
  g^x \equiv g^{y + \ell q} \equiv g^y g^{\ell q}
  \equiv g^y (g^q)^\ell \equiv g^y 1^\ell \equiv g^y
  \pmod p.
\end{equation}

Note that $f$ is merely a function from integers to integers, but this proposition shows that there is additional periodic structure to its input: $f(x) = f(x + \ell q)$ for any $\ell$.  So if we consider the coset $\overline x = x + q\mathbb Z = \{\dots, x - 2q, x - q, x, x + q, x + 2q, x + 3q, \dots\}$ of $q \mathbb Z$, $f$ is the same on every element of $\overline x$.  Thus we can think of $f$ as being defined on the quotient $\mathbb Z/q\mathbb Z$, the set of all cosets of $q\mathbb Z$, rather than on $\mathbb Z$.  More jargomatically: there is a unique natural $\overline f\colon \mathbb Z/q\mathbb Z \to \mathbb Z$ defined in the quotient $\mathbb Z/q\mathbb Z$ so that $f = \overline f \circ \phi_q$, where $\phi_q\colon \mathbb Z \to \mathbb Z/q\mathbb Z$ is the natural projection $\phi_q(x) = x + q\mathbb Z = \overline x$ onto $\mathbb Z/q\mathbb Z$.

In other words, even if we treat $x \mapsto g^x \bmod p$ as a function on integers, we can always break it down into two steps, the first of which is reduction modulo $q$.  So, whether you like it or not, if you are computing $g^x$ for integers outside $0 \leq x &lt; q$, the function can still always be defined in terms of doing $x \bmod q$ first.

What's much weirder is not reduction modulo $q$—which as above is necessary if you're going to use the result as an exponent—but the chain of reduction modulo $p$ and then modulo $q$.  This was a point of contention in the provable security literature on DSA and ECDSA.  You could imagine computing $g^k \bmod q$ directly, but it wouldn't make a functioning signature scheme.  What you really want is a uniform random map from $\mathbb Z/p\mathbb Z$ to $\mathbb Z/q\mathbb Z$ which has no properties that an adversary could exploit.

It just happens that $h \mapsto (h \bmod p) \bmod q$ sorta kinda seems to work but as far as I know nobody has a good handle on why even in recent analyses like Fersch–Kiltz–Poettering 2016 (paywall-free), which models it roughly as a random oracle while tidying up nearly everything else about the long and sordid history of attempts to prove DSA and ECDSA security.