I am using client-side certificate authentication (mutual authentication) in my IoT prototype. we acquire client side certificates using embedded PKI through a CA. There are the provisions of acquiring ECC or RSA certificates. I was wondering which one is more apt to use to ensure stronger security! while I understand that RSA is a widely used algorithm, ECC claims to provide higher level of security and also faster also probably due to its shorter key length size. but ECC is a newer algorithm and likely to have undiscovered vulnerabilities.

Could you guide how do I make a right decision here, if ensuring security is prominant criteria. IoT device that is being used is MCU based and is not a low footprint device. (consider its a telematics gateway unit in an connected vehicle).


RSA and ECC are equally secure. They are both secure if implemented and used correctly, and both prone to similar amount and gravity of mistakes in implementation and use. The only reason why security would be a consideration is if you happen to have a poor implementation of one and a good implementation of the other.

ECC does not claim to have a higher level of security. (If you read that, it's misinformed.) ECC has a higher level of security divided by the key size, i.e. an N-bit ECC key is in some sense “more secure” than an N-bit RSA key against brute force, but that's irrelevant: RSA key sizes are larger than ECC keys for this reason, and in both cases, you would pick a key size that's large enough for brute force to be infeasible. The weakness in cryptography is not brute force attacks (except when passwords are involved), it's misuse and bad impementations.

RSA signature verification is faster than ECC (ECDSA or EdDSA) signature verification. RSA signature calculation is slower than ECC signature calculation. RSA signatures are larger than ECC signatures. (All of this is comparing things that it makes sense to compare, i.e. at equivalent levels of security, not at equal key sizes which would be meaningless.)

There are two common families of ECC signatures: ECDSA and EdDSA. To choose between them, security is slightly relevant, but it doesn't clearly point one way or the other. EdDSA is newer so implementations are less mature and may be buggier, but on the other hand EdDSA is a more mature design which is easier to implement correctly.

Both RSA and ECC will be broken by quantum cryptanalysis if it turns out to work the way many computer scientists hope. If your device needs to last for a long time, make sure that you can update your whole infrastructure to support post-quantum crypto (PQC) in a few years, once it has become more mature. Note that this is a difficult task, since it means much larger keys and signatures, and stateful signatures. You don't have to support PQC yet (and you should not use PQC in production yet as it hasn't received enough cryptanalysis), but now is a good time to start thinking about key storage and algorithm agility.

  • Thanks much Gilles for a detailed insight! I am not using RSA or ECC certificates for code signing / digital signature; rather as IoT device certificate for mutual authentication to server in TLS comunication. just to ensure, your explanation holds equally good there as well! May 17 '21 at 15:17
  • @AkhileshGupta TLS authentication uses a signature as well. May 17 '21 at 15:26
  • Thanks Gilles! another point wrt poor implementation or correct implementation: do you mean its implementation as done in the underlying library (openSSL, wolfSSL, ...) that is used? in the app layer we leverage a crypto library usually via making API calls! May 18 '21 at 2:59
  • @AkhileshGupta Yes. Use a high-quality crypto library, and make sure to keep it up-to-date. May 18 '21 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.