This question already has an answer here:

In examining the available information on the network, I see an amount of conflicting information concerning the RSA, ECDSA and ED25519 key formats.

I understand that RSA is the most universal at present.

From my reading it looks like in order of security provided, the order is from most to least secure is: ED25519, RSA, ECDSA.

Am I not understanding something here?

I am not looking as to when to use it rather I'm looking for a ranking based on the security of the key. Currently I use a LONG RSA key (>4096 bits).

marked as duplicate by Marcus Müller, grochmal, Steffen Ullrich, Anders, Serge Ballesta Dec 21 '16 at 7:25

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • I'm actually looking for ranking the security of these three key types. – mdpc Dec 20 '16 at 23:10
  • While it's not the only thing addressed in that question, it is one of them (compatibility is the other big one); you'll find useful information on their relative security in those answers. – Xiong Chiamiov Dec 20 '16 at 23:42

"Which is more secure" is not the best question to ask. All of them are sufficiently secure as long as:

  1. They are implemented and used correctly;
  2. They're used with a sufficiently large key size.

ECDSA and Ed25519 are based on elliptic curves. Their advantage is that they can achieve the same security target with shorter keys than RSA requires, which translates to better performance. 256-bit elliptic curve keys are generally understood to provide similar security to 128-bit symmetric ciphers like AES-128. With RSA, 2,048-bit keys are considered the current minimum safe key size, providing something like 112-bit security (which no less secure in practice than 128-bit security).

The KeyLength site has various recommendations for key size for these algorithms.

Ed25519 is newer than ECDSA. Its main advantages are speed, simplicity and foolproofing: both are secure if used correctly, but ECDSA is harder to use correctly. The most famous ECDSA failure is the Sony PS3 signature bug, which was caused because Sony's programmers implemented ECDSA incorrectly. Ed25519 is not vulnerable to the mistake Sony's programmers made, nor to some other "gotchas" that ECDSA implementations are.

So Ed25519 is widely held to be the best of the three, because it provides:

  1. Sufficient security for the near future. (All three will be toast if a practical quantum computer is built.)
  2. Very good foolproofing—less vulnerable to programmer and user mistakes;
  3. Smaller keys and very fast performance.

...but none of these factors should stop you from using ECDSA or RSA if, for example, you're using a system where one of these is available but Ed25519 isn't. Likewise if you have a system that uses RSA or ECDSA, it probably doesn't make sense to upgrade it to Ed25519. Also RSA and ECDSA has NIST and NSA approval and Ed25519 doesn't, so if that matters to you then Ed25519 is out.

Disclaimer: I'm not a cryptographer or a crypto engineer; I've never implemented or broken bad implementations of any of those algorithms.

For ECDSA you need to specify the curve and how sure you are that your CSPRNG does not have any biases. For RSA, you need to specify size of key, and also the padding scheme (is it PKCS #1 v1.5 or PKCS #1 v2 with RSASSA-PSS)?

ECDSA is scary because it requires a higher quality random number generator than any other crypto primitive (an RNG which would be secure with RSA could expose your ECDSA private key).

RSA is scary because it's difficult to implement securely.

Ed25519 should be as secure as 3072 bit RSA with RSASSA-PSS and as secure as ECDSA over NIST P-256. Supposedly, Ed25519 is easier to implement securely, and also it's faster. It's also newer (but old enough that everyone had enough time to try to break it), designed to be better than RSA and ECDSA, and it's by djb and some people think that's important.

I would rate RSA4096 > Ed25519 > ECDSA P-256 for security, if your RSA implementation has been reviewed and battle tested.

I would use Ed25519 > RSA4096 > ECDSA P-256 for average implementations, because of the differences in how difficult it is to implement those things securely.

Not the answer you're looking for? Browse other questions tagged or ask your own question.