Why does DSA require that a new $k$ be chosen and the algorithm restarted if $s=0$? DSA is an algorithm used to generate a digital signature, which consists of a pair of values $(r,s)$. The algorithm computes $r$ first and then $s$. However, if we calculate $s=0$, it says to restart the algorithm choosing a different pseudorandom integer $k$ as our starting point.

What is the purpose of this? Is a digital signature $(r,s)$ invalid if $s=0$? If so, why?
The algorithm needs to be restarted because the private key $x$ can be obtained when $s=0$.
From:

$s=[k^{-1}( H(M) + xr)] \mod q$

We can solve for $x$ and get:

$x=\frac{-H(M)}{r} \mod q$