From what I gather from the internet (source), the recommended practice for 2019 and beyond is to avoid RSA and use ECDH and ECDSA.
Is this the general case?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
RSA for key exchange is declining rapidly and is not recommended because it does not provide forward secrecy. Without forward secrecy, if someone breaks into the server and obtains the private key, they will be able to fully retroactively decrypt all recorded traffic encrypted under that key. ECDH does not have that problem because the private and public keys are generated on-the-fly, and discarded after use. This is possible because ECDH (and DH) key generation is light and easy on the CPU, whereas RSA is not. Generating a new RSA key pair for each key exchange would be absolutely prohibitive.
RSA for certificates, on the other hand, is still alive and well, and is still considered industry standard. There are some benefits that ECDSA has, though, such as smaller public key and signature sizes, which equates to reduced network usage, but verification with ECDSA is a little slower than with RSA.
Yes, nowadays RSA is not considered the de facto algorithm for all public key cryptography needs we have nowadays. BUT, it is still omnipresent and this is not likely to change soon.
For instance, TLS 1.3 has dropped the RSA key exchange because of its lack of forward secrecy. So you might think RSA is loosing some traction, however this doesn't mean certificates cannot use RSA keys anymore, but simply that TLS servers and clients can now only use the RSA algorithnm for signing, and that it is not possible anymore for the clients to send to the server an RSA encrypted premaster secret key. (See Forest's answer on that topic as well.)
It is true that RSA has some downsides:
openssl speedon my device:
sign/s verify/s ecdsa (nistp256) 37232.9 9515.5 rsa 2048 1441.4 48517.4 rsa 3072 438.3 21926.7
You can also find some benchmark here. But as mentioned in a comment to another answer, notice RSA verification remains faster than ECDSA's (or EdDSA's).
That doesn't mean RSA has disappeared already, a research run on public keys found in the wild in 2017 has shown that 94.48% of the public keys one can find on the internet are still RSA keys. (However this might be biased since it's considering collections of TLS certificates, and these are still overwhelmingly using RSA keys.)
Although most Certificate Authorities have now implemented support for ECDSA-based certificates, there are still many legacy systems relying on RSA, and this is definitively not going to change quickly.
Also, it is worth saying that over the years, the RSA algorithms have received way more scrutiny from both the academia and the industry, and there are a lot of countermeasures to run RSA on specific hardware so that it is protected against fault attacks or side channels, while "newer" schemes such as ECDSA and EdDSA are still often found vulnerable to such attacks.
Finally, you should definitively read Thomas' answer to a related question ("Why is elliptic curve cryptography not widely used, compared to RSA?"), since it is (as usual with him) very thorough.
RSA is susceptible to Unpadded Message Recovery Attack, which can be a problem for poorly engineered systems. Elliptic Curve Cryptography is faster in terms of key generation. Generating them shall become more difficult in the future. By which I mean that, as computers get faster, the size of the primes must increase. Finding bigger primes shall be more difficult, courtesy, Prime Number Theorem.
Performance Based Comparison Study of RSA and Elliptic Curve Cryptography Rounak Sinha, Hemant Kumar Srivastava, Sumita Gupta might be of help.