ECC requires less CPU power, less memory and shorter keys than RSA or any other asymmetric cryptography I came across in the literature (correct me if I am wrong).

Is there a lower cost asymmetric cryptography than elliptic-curves based cryptography?

  • 1
    $\begingroup$ There is no scheme that is universally better than ECC in the same way ECC is better than RSA. However there are trade-off schemes which eg need more RAM and have larger keys and are faster or which are more complex but provide eg shorter signatures. $\endgroup$
    – SEJPM
    Commented Mar 7, 2018 at 18:53
  • $\begingroup$ And RSA is superior to ECC on four counts: speed of encryption; speed of signature verification; size overhead for signature (when using message recovery); simplicity. $\endgroup$
    – fgrieu
    Commented Mar 7, 2018 at 20:03

1 Answer 1


In fact, for public-key operation (message encryption and signature verification, as opposed to message decryption and signature generation), RSA and, even more, the Rabin cryptosystem, outperform ECC. This may matter to, for instance, low-power embedded systems that try to connect to a powerful server with a TLS-like protocol.

In the domain of signatures, signature size can also be an important parameter. A plain signature based on elliptic curves (ECDSA, EdDSA) will use about 512 bits (64 bytes) for the customary "128-bit" security level. The BLS scheme does twice better (256-bit signatures) through the use of pairing-friendly curves, which are a very special kind of curve with complicated mathematics, and a substantially higher computational cost. Some multivariate cryptographic schemes can conceptually yield both even shorter signatures and faster operations.

For asymmetric encryption, it is known that the McEliece cryptosystem offers really fast operations (but public and private keys are much larger).

There is currently a flurry of activity with "post-quantum schemes" that offer various additional performance trade-offs; notably, some Ring-LWE schemes have public-key operations that outperform even RSA.

Asymmetric cryptography performance is not a simple metric; many features are amenable to measurement, such as speed of public-key operations, speed of private-key operations, signature size/overhead, encryption overhead, public key size, private key size, implementation RAM and ROM usage,... Classic elliptic curve cryptography tends to perform well in each of these, but for each category, there are other algorithms that outperform them.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.