I am currently reading about how more efficient and ''light'' is ECC compairing to RSA as far as key generation is concerned. My question is simple, why does RSA continue to be used today (ex.SSL) while the ECC can be used instead, which has advantages over RSA?


1 Answer 1


Now, you highlighted key generation - no one really cares about key generation time (unless you are generating ephemeral keys, that is, a fresh key pair for each connection - we generally don't). Instead, we might generate a fresh key pair maybe once a day or once a month (usually far less frequently), and so we don't care whether it takes perhaps a second (RSA) or submillisecond (ECC).

Now, while the key performance delta between RSA and ECC is the most extreme, ECC still outperforms RSA in most other measures, just not by as wide of a margin. You can still ask "why do people still use RSA in spite of those other metrics by which ECC is better":

  • Inertia (we've been using RSA for decades, why should we switch?); this lends itself to trust. And, this is not a spurious concern - we generally like to use crypto which has been published a long time ago, and vetted by a number of crypanalysts - the more, the better, and it's really hard to think of something more vetted than RSA.

  • RSA is easier to understand; it's not difficult for someone with a little bit of mathematical background to get the basics. In contrast, to understand ECC, you need to dig into more number theory than most people have encountered. This ease of understanding also lends itself into trust.

  • Backwards compatibility; there are a number of people running older browsers that just don't understand ECC certificates; if you're a server and all you have are ECC certificates, you've just disqualified those people from talking to you. Now, you could have both an RSA certificate and an ECC certificate (TLS 1.2 and on allows you to select the certificate based on client capability); however if you have an RSA cert, why do you need a second cert?

  • Performance (which sounds like it contradicts what you read - it really doesn't). For TLS, clients generally don't care about the performance of RSA vs ECC - they usually make a handful of connections per second, and either is fine for that. For servers (which may need to make thousands of connections per second), they often have crypto accelerators. And, at least in my limited experience, RSA crypto accelerators are rather more common than ECC ones, and RSA with a crypto accelerator does go faster than ECC in software.

  • Intellectual property; not that long ago, there was a company (Certicom) which claimed to have patent rights over most of ECC, and threatened lawsuits against companies which used ECC without paying them (and did file in at least one case). Now, that was several years ago, and people are not concerned about them now. However it did delay things, at least for those companies large enough to be concerned about Certicom suing them...

  • 2
    $\begingroup$ Also it's sometimes nice how RSA signature verification is much faster than that for any ECC scheme... $\endgroup$
    – SEJPM
    Commented Aug 17, 2019 at 17:35
  • 1
    $\begingroup$ @SEJPM: if people were so concerned with verification time, why don't they go with a Rabin-based scheme :-) $\endgroup$
    – poncho
    Commented Aug 18, 2019 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.