ECDSA vs RSA. What and why?

The never-ending debate over whether ECC or RSA is superior always remains. Here’s a quick rundown of what ECDSA and RSA are.

ECDSA (Elliptic Curve Digital Signature Algorithm) and RSA (Ron Rivest, Adi Shamir, and Leonard Adleman) are commonly used asymmetric algorithms. The main difference between these two methods is in how they create keys and how they work.

Asymmetric encryption encrypts and decrypts data using a key pair that is mathematically connected

What is RSA?

RSA is an asymmetric encryption algorithm that is widely used. Based on modular exponentiation, discrete logarithms, and the computational difficulties of the RSA problem, the RSA public-key cryptosystem provides a digital signature mechanism.

RSA is based on the ease with which a number may be generated by multiplying two sufficiently large numbers together, but factorizing the numbers back to their primes is incredibly difficult.

RSA keys are typically 2048 or 4096 bits long, making factorization extremely difficult. Despite the fact that 1024-bit keys are thought to be breakable.

image: working of RSA

What are the vulnerabilities of RSA?

• RSA depends on the infeasibility to solve the prime factorization problem. It relies on the key size to maintain its integrity. The longer the key, the more secure it is. Prime factorization was used to crack a key with a value of 768 bits. As a result, the National Institute of Standards and Technology (NIST) recommends a minimum key length of 2048 bits, but many businesses prefer 4096 bits.
• Using weak random number generators(take less processing power and/or do not use the precious, finite, entropy sources on a system) produces weak prime numbers making it easier for an attacker to crack the algorithm.
• The key becomes easier to solve if the prime numbers are too close together.
• Side channel attacks are a kind of attack that take advantage of the system running the encryption algorithm, as opposed to the algorithm itself. Attackers can analyze the power being used, use either branch prediction analysis or timing attacks to find ways to ascertain the key used in the algorithm, thus compromising the data.

Does this mean ECDSA is a better choice?

ECDSA is a cryptographically secure digital signature scheme, based on the elliptic-curve cryptography and an underlying function that’s known as a trapdoor function, a function that is easy to compute in one direction, yet difficult to compute in the opposite direction (finding its inverse). ECDSA is an elliptic curve which represents the set of points that satisfy a mathematical equation y^2 = x^3 + ax + b.

ECDSA keys and signatures are shorter than in RSA for the same security level. A 256-bit ECDSA signature has the same security strength like 3072-bit RSA signature.

Basically, if we have a mathematical equation which draws a curve on a graph, and we choose a random point on that curve and consider that as the point of origin. We then generate a random number, this becomes the private key. Performing some mathematical equation (y² = x³ + ax + b) using the random number and the point of origin which gives the second point on the curve, that’s the public key.

credits: https://jun-wang-2018.github.io/MyBlog/en/ECDSA-and-Bitcoin-I/multi.png

So is ECDSA really more reliable than RSA?

• As pointed out earlier, ECDSA (ECC) requires much shorter key lengths to give the same level of security provided by long keys of RSA.
• RSA is easier to implement (because of the prime factorization method) compared to ECDSA.
• RSA is the most widely used asymmetric encryption algorithm compared to ECDSA.
• RSA requires longer keys to provide a safe level of encryption protection slowing down the performance, contrary to which ECDSA achieves the same protection level with smaller keys.

Whatever the dispute, RSA and ECDSA remain two of the most common asymmetric encryption algorithms that give a high level of security, despite the fact that they are both distinctive in their own ways. Their precise implementation provides the most benefit and security. ECC is recommended for newer applications. But if you are using RSA there is no reason to upgrade it yet. It is still secure and have a reasonably performance. RSA and ECDSA are based on computational infeasibility by current computing systems, but someone with a big enough quantum computer can trivially break both of the systems.