From what I gather from the internet (source), the recommended practice for 2019 and beyond is to avoid RSA and use ECDH and ECDSA.

Is this the general case?

  • $\begingroup$ Do you have any source to these claims? $\endgroup$ Feb 8, 2019 at 10:16
  • $\begingroup$ @AleksanderRas blog.cloudflare.com/how-expensive-is-crypto-anyway would be one example. RSA is still alive, just in minority use. And I wonder whether its usage will continue to dwindle. $\endgroup$
    – Bastien
    Feb 8, 2019 at 10:23
  • $\begingroup$ From what I can gather by just quickly reading the article is that the RSA although secure is apparently not as efficient as other asymmetric systems (ECDH & ECDSA) that have around the same security, therefore more and more people will leave RSA and change to a more efficient algorithm. I don't have the actual knowledge for efficiency of different algorithms though... $\endgroup$ Feb 8, 2019 at 13:15
  • $\begingroup$ Also this related question might help $\endgroup$ Feb 8, 2019 at 13:23

3 Answers 3


RSA for key exchange is declining rapidly and is not recommended because it does not provide forward secrecy. Without forward secrecy, if someone breaks into the server and obtains the private key, they will be able to fully retroactively decrypt all recorded traffic encrypted under that key. ECDH does not have that problem because the private and public keys are generated on-the-fly, and discarded after use. This is possible because ECDH (and DH) key generation is light and easy on the CPU, whereas RSA is not. Generating a new RSA key pair for each key exchange would be absolutely prohibitive.

RSA for certificates, on the other hand, is still alive and well, and is still considered industry standard. There are some benefits that ECDSA has, though, such as smaller public key and signature sizes, which equates to reduced network usage, but verification with ECDSA is a little slower than with RSA.

  • 1
    $\begingroup$ As a side remark, the 2014 recommendations of the French security agency (ANSSI) only mention RSAES-OAEP as a secure asymmetric encryption system, and RSA-SSA-PPS, ECDSA, ECKCDSA for signatures. (sections 2.2.2 and 2.2.3) So the avoidance of RSA is not present everywhere. $\endgroup$
    – Mariuslp
    Sep 9, 2019 at 12:05
  • 1
    $\begingroup$ @Mariuslp: you meant PSS (Probabilistic Signature Scheme). And FWIW TLS1.3 (a standard that applies to more people than ANSSI does) last year allows PSS ECDSA EdDSA but not RSASSA-PKCS1v1_5 or modp-DSA for protocol signatures, although certificates can still be signed with PKCVS1v1_5 (with SHA256 or better if possible). $\endgroup$ Sep 10, 2019 at 2:24
  • $\begingroup$ Sorry for the typo! And good point. $\endgroup$
    – Mariuslp
    Sep 10, 2019 at 9:36

Yes, nowadays RSA is not considered the de facto algorithm for all public key cryptography needs we have nowadays. BUT, it is still omnipresent and this is not likely to change soon.

For instance, TLS 1.3 has dropped the RSA key exchange because of its lack of forward secrecy. So you might think RSA is loosing some traction, however this doesn't mean certificates cannot use RSA keys anymore, but simply that TLS servers and clients can now only use the RSA algorithnm for signing, and that it is not possible anymore for the clients to send to the server an RSA encrypted premaster secret key. (See Forest's answer on that topic as well.)

It is true that RSA has some downsides:

  • RSA is slower than ECDSA for signing, which is typically what is important for TLS servers that are supposed to many requests at the same time, and not just marginally so, it is way slower for signing. Here are some numbers using openssl speed on my device:
                       sign/s  verify/s
    ecdsa (nistp256)    37232.9    9515.5
    rsa 2048             1441.4   48517.4
    rsa 3072              438.3   21926.7  

You can also find some benchmark here. But as mentioned in a comment to another answer, notice RSA verification remains faster than ECDSA's (or EdDSA's).

That doesn't mean RSA has disappeared already, a research run on public keys found in the wild in 2017 has shown that 94.48% of the public keys one can find on the internet are still RSA keys. (However this might be biased since it's considering collections of TLS certificates, and these are still overwhelmingly using RSA keys.)
Although most Certificate Authorities have now implemented support for ECDSA-based certificates, there are still many legacy systems relying on RSA, and this is definitively not going to change quickly.

Also, it is worth saying that over the years, the RSA algorithms have received way more scrutiny from both the academia and the industry, and there are a lot of countermeasures to run RSA on specific hardware so that it is protected against fault attacks or side channels, while "newer" schemes such as ECDSA and EdDSA are still often found vulnerable to such attacks.

Finally, you should definitively read Thomas' answer to a related question ("Why is elliptic curve cryptography not widely used, compared to RSA?"), since it is (as usual with him) very thorough.


RSA is susceptible to Unpadded Message Recovery Attack, which can be a problem for poorly engineered systems. Elliptic Curve Cryptography is faster in terms of key generation. Generating them shall become more difficult in the future. By which I mean that, as computers get faster, the size of the primes must increase. Finding bigger primes shall be more difficult, courtesy, Prime Number Theorem.

Performance Based Comparison Study of RSA and Elliptic Curve Cryptography Rounak Sinha, Hemant Kumar Srivastava, Sumita Gupta might be of help.

  • $\begingroup$ "Elliptic Curve Cryptography is faster" [citation needed]. RSA is (sadly) still faster for signature verification. $\endgroup$ Sep 10, 2019 at 8:27
  • 1
    $\begingroup$ "Generating them shall become more difficult in the future." - you might want to clarify what that means, for example, what are you referring to as "them"? $\endgroup$
    – poncho
    Sep 12, 2019 at 12:40
  • 1
    $\begingroup$ The difficulty of finding larger and larger primes has little to do with the prime number theorem. Yes, 2048-bit primes are twice as rare as 1024-bit primes; but generating 2048-bit primes is much more than twice as hard as generating 1024-bit primes. $\endgroup$
    – TonyK
    Sep 12, 2019 at 23:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.