RSA vs diffie-hellman + polyalphabetic cipher

Question

My basic question is: How does RSA compare to using Diffie-Hellman + <some symmetric key crypto, e.g. a polyalphabetic cipher>

Let's assume that factoring large numbers and computing discrete logs both approximately equally difficult, so diffie hellman is about as secure as RSA. What are the pros and cons of using RSA vs diffie-hellman + symmetric key crypto?

For the latter, for example one might consider using diffie-hellman to agree on a large key (corresponding to say $k$ permutations of the characters in the alphabet, where encryption is done by applying the $(i\text{ mod }k)$th permutation to the $i$th character), and using that to send a message of length $nk$, where $n$ is some small number, so that frequency analysis is not effective ($n = 1$ would give you a "one-time-pad").

(This is a possibly naive question (My background is in algebraic geometry))

Answer 1

RSA allows for signatures. Signatures are a system whereby someone with a private key can "sign" a message, and anyone with the corresponding public key can verify that that private key was used to sign the message.

(Elliptic-Curve) Diffie-Hellman (aka ECDH or DH) allows for exchanging a shared secret value, which is then passed through a Key Derivation Function (KDF) to create a shared symmetric key for use with a symmetric cipher like AES-GCM or ChaCha20-Poly1305. Preferably an Authenticated Encryption with Associated Data (AEAD) cipher instead of just any old symmetric cipher, and certainly not a thoroughly broken classical cipher like a polyalphabetic substitution cipher.

It's possible but inadvisable to use RSA to encrypt short messages directly. The maximum message length is very short: for RSA-2048 with OAEP (a "padding" scheme required for security) at most 190 bytes can be safely encrypted. This process is FAR slower than using ECDH and an AEAD. Also, it's wildly unsafe to re-use RSA keys for more than one purpose. Doing so improperly can leak the message plaintext. So no major protocol uses this.

RSA key generation is MUCH slower than ECDH key generation. RSA key generation consists of randomly generating large numbers and testing if they're prime. ECDH key generation consists of generating a random point on some elliptic curve, which can be as simple as generating a single 32-byte random value and performing some fast bitwise operations.

That speed of (EC)DH key generation enables an important security property: forward secrecy. By generating a new key pair for every new "session" (exchange of messages) the compromise of a past session's keys doesn't compromise future keys. RSA key generation is too slow on many systems (especially embedded systems) for this to be practical.

There's also RSA-KEM, a mode whereby RSA is used to exchange a secret value which is then passed through a Key Derivation Function. This operates a bit like (EC)DH, but it's slower. There's not much reason to use this.

Lastly, there are some more obscure but potentially useful things like Cryptographic Accumulators which are easier to implement using RSA-like operations than (EC)DH-like operations.