Is RSA in decline across the board?

Question

From what I gather from the internet (source), the recommended practice for 2019 and beyond is to avoid RSA and use ECDH and ECDSA.

Is this the general case?

Answer 1

RSA for key exchange is declining rapidly and is not recommended because it does not provide forward secrecy. Without forward secrecy, if someone breaks into the server and obtains the private key, they will be able to fully retroactively decrypt all recorded traffic encrypted under that key. ECDH does not have that problem because the private and public keys are generated on-the-fly, and discarded after use. This is possible because ECDH (and DH) key generation is light and easy on the CPU, whereas RSA is not. Generating a new RSA key pair for each key exchange would be absolutely prohibitive.

RSA for certificates, on the other hand, is still alive and well, and is still considered industry standard. There are some benefits that ECDSA has, though, such as smaller public key and signature sizes, which equates to reduced network usage, but verification with ECDSA is a little slower than with RSA.

Answer 2

Yes, nowadays RSA is not considered the de facto algorithm for all public key cryptography needs we have nowadays. BUT, it is still omnipresent and this is not likely to change soon.

For instance, TLS 1.3 has dropped the RSA key exchange because of its lack of forward secrecy. So you might think RSA is loosing some traction, however this doesn't mean certificates cannot use RSA keys anymore, but simply that TLS servers and clients can now only use the RSA algorithnm for signing, and that it is not possible anymore for the clients to send to the server an RSA encrypted premaster secret key. (See Forest's answer on that topic as well.)

It is true that RSA has some downsides:

• RSA is slower than ECDSA for signing, which is typically what is important for TLS servers that are supposed to many requests at the same time, and not just marginally so, it is way slower for signing. Here are some numbers using openssl speed on my device:

                       sign/s  verify/s
    ecdsa (nistp256)    37232.9    9515.5
    rsa 2048             1441.4   48517.4
    rsa 3072              438.3   21926.7  

You can also find some benchmark here. But as mentioned in a comment to another answer, notice RSA verification remains faster than ECDSA's (or EdDSA's).

• RSA uses longer keys: elliptic curves typically have keys of 256 bits, whereas the equivalent RSA key size is usually considered to be 3072 (here is why.). This can be critical on embedded (or IOT) devices, which means that on constrained devices elliptic curves might be the way to go. (Although currently the ecosystem still heavily uses RSA.)
• padding is critical for RSA encryption and signature to be secure, but there are many options and only a couple remain secure nowadays.
• there are many instances of flawed implementation of RSA that led to disasters (often in the key generation, that being said).

That doesn't mean RSA has disappeared already, a research run on public keys found in the wild in 2017 has shown that 94.48% of the public keys one can find on the internet are still RSA keys. (However this might be biased since it's considering collections of TLS certificates, and these are still overwhelmingly using RSA keys.)
Although most Certificate Authorities have now implemented support for ECDSA-based certificates, there are still many legacy systems relying on RSA, and this is definitively not going to change quickly.

Also, it is worth saying that over the years, the RSA algorithms have received way more scrutiny from both the academia and the industry, and there are a lot of countermeasures to run RSA on specific hardware so that it is protected against fault attacks or side channels, while "newer" schemes such as ECDSA and EdDSA are still often found vulnerable to such attacks.

Finally, you should definitively read Thomas' answer to a related question ("Why is elliptic curve cryptography not widely used, compared to RSA?"), since it is (as usual with him) very thorough.

Answer 3

RSA is susceptible to Unpadded Message Recovery Attack, which can be a problem for poorly engineered systems. Elliptic Curve Cryptography is faster in terms of key generation. Generating them shall become more difficult in the future. By which I mean that, as computers get faster, the size of the primes must increase. Finding bigger primes shall be more difficult, courtesy, Prime Number Theorem.

Performance Based Comparison Study of RSA and Elliptic Curve Cryptography Rounak Sinha, Hemant Kumar Srivastava, Sumita Gupta might be of help.