In hybrid encrytion, I still see that some site's use RSA in their https connection, so now I wonder, why do they not use ECC instead of RSA, ECC requires less computational power and encrypt's and decrypt's faster (atleast that's what I read). I know that there have been smiliar question's about this but none of these answered specfically why rsa is still used. The only two reasons what I can think of is that some hardware may not support it or that there are some web administrators that are being to lazy to upgrade, but im not sure if that is the case. I hope someone could explain this to me and shed some light on it :) .
$\begingroup$
$\endgroup$
9
-
2$\begingroup$ Likely there are old computers (and phones) in some countries that have old browsers that haven't been upgraded to support newer crypto. I heard a talk by a Facebook higher-up talking about how phones being sold in India, for example, have this problem. Another problem is a lot of the tutorials on the internet for how to setup TLS show RSA cert generation. $\endgroup$– mikeazoJun 22, 2016 at 12:06
-
$\begingroup$ but i thought clients always communicate to eachother by negotiating over what algorithm or key to use, as in which cipher suits are supported by both the client and the server and than choosing the most secure one. $\endgroup$– blacklightJun 22, 2016 at 12:10
-
1$\begingroup$ Are you talking about RSA certificates or RSA key exchange here? $\endgroup$– SEJPMJun 22, 2016 at 12:12
-
$\begingroup$ im talking about the key exchange $\endgroup$– blacklightJun 22, 2016 at 12:13
-
$\begingroup$ This would probably be a better fit for Security.SE, since which alogirthm to use is ultimately a matter security policy. $\endgroup$– fkraiemJun 22, 2016 at 13:06
|
Show 4 more comments