# Why use anything other than RSA for transmission encryption?

Being fairly new to the cryptography and data security space, I have sampled a few "Introduction to cryptography" sites/textbooks and they all seem to start in the same general way:

I understand the educational value of explaining older ciphers and ciphers but in reality, if I need secure digital communication over an insecure channel, why would I ever use anything other than RSA?

• Incidentally, the linked post for "RSA is unbreakable" is about key lengths for symmetric crypto. 256-bit RSA is absurdly weak and utterly unsuited for any actual use; best guess is you need at least 3072-bit RSA to get the security of a 128-bit symmetric key, and over a 15,000-bit RSA key to get the security equivalent to a 256-bit symmetric key. Feb 12, 2015 at 8:16
• Related question: Is symmetric encryption no longer necessary? Feb 12, 2015 at 8:17

With other asymmetric schemes (like Diffie-Hellman and DSA), there's an alternative to working in the integers modulo `n`: you can use an elliptic curve, which is believed to give 128-bit security with a 256-bit curve. That means DH and DSA are often used where performance is more important, because ECDH and ECDSA are faster than RSA at the same security level. Furthermore, you often want forward secrecy in communications, which means that if I steal your private key in the future I can't use that to read the messages Mike sent to you. Achieving this involves creating a new keypair for each communication and signing it with your real private key. Creating a strong RSA keypair is time-consuming; creating an EC keypair is cheaper. DH is also more traditional for this sort of key agreement. So, DH or ECDH is typically used for forward secrecy, and in fact that's all TLS offers for that.