Asymmetric Cryptography Explained — RSA, ECDSA, and When to Use Each

Core Concepts

RSA (Rivest-Shamir-Adleman)

RSA security is based on the difficulty of factoring large composite numbers. Key sizes: 2048 bits (baseline, ~112-bit security), 3072 (~128-bit), 4096 (~144-bit). RSA can both encrypt (OAEP) and sign (RS256, PS256). Signing is fast, verification is very fast, but RSA key generation is slow (seconds for 4096-bit) and signatures are large.

ECDSA (Elliptic Curve Digital Signature Algorithm)

ECDSA security is based on the discrete log problem over elliptic curves. Key sizes: P-256 (~128-bit security, equivalent to RSA-3072), P-384 (~192-bit), P-521 (~256-bit). Signatures are ~8x smaller and ~10x faster to generate than RSA. P-256 is used by TLS 1.3, WebAuthn, and most JWT deployments going forward.

When to choose RSA vs ECDSA

Choose ECDSA for new projects — smaller keys, smaller signatures, faster signing, no downside. P-256 is enough for 99% of use cases. Choose RSA only if you need compatibility with legacy systems that can't handle EC keys (rare in 2026), or if you need RSA-OAEP encryption (ECDSA is signing-only; EC-DH is encryption, but less widely supported than RSA-OAEP for envelope encryption).

Ed25519 — the third option

Ed25519 uses Edwards curves instead of NIST's Weierstrass curves. It's faster than ECDSA, more resistant to side-channel attacks, has deterministic signatures (no RNG failure risk), and produces shorter keys (32 bytes). Downside: not universally supported in JWT libraries yet (EdDSA is RFC 8037, but many signer/verifier implementations lag behind).

Frequently Asked Questions