One major drawback of (EC)DSA is that it requires a good RNG, otherwise the private key may be accidentally exposed. This is also one of the major reasons (I found so far) why no(?) smartcard supports any kind of DSA. In contrast to that, RSA, while usually being used for encryption, can also be used for digital signatures and behaves deterministic, i.e. signing the same message again will yield the same signature everytime. Lacking the requirement of a RNG (other than in key generation) this is why RSA is available on many smartcards, which would make bitcoin much safer without requiring a rather complicated offline-wallet setup.

So, does ECDSA provide anything bitcoin absolutely needs that RSA cannot achieve? Or is it merely bad luck in Satoshi's choice?

  • 1
    This problem has been solved: generate k for signatures deterministically instead of by RNG. See RFC 6979. Dec 22, 2014 at 18:54

3 Answers 3


I'm not sure why you think RSA is much safer than ECDSA. As you can read here: https://crypto.stackexchange.com/questions/3216/signatures-rsa-compared-to-ecdsa

ECDSA offers same levels of security as RSA, but with a much smaller footprint.

In fact, the more you increase the security, the larger the RSA keys become compared to ECDSA. This makes RSA less fit for a system such as bitcoin which requires small packets to be sent around the network all the time (being peer-to-peer).

  • 1
    I didn't claim RSA was safer, merely that it apparently can be implemented more easily on smartcards. The smaller footprint is a severe reason though, due to the blockchain containing all signatures ever made Jan 28, 2014 at 12:49
  • As far as I can tell you claim that RSA is safer, compared to ECSDA, because it doesn't require a good RNG. Not sure this claim is proven in the link you posted. Jan 28, 2014 at 12:55
  • Oh, that was badly phrased, sorry - I merely wanted to use that as a transition on why there appear to exist no ECDSA smartcards Jan 28, 2014 at 12:57

Now with vulnerability found in RSA it looks like a good choice… then in the past https://crocs.fi.muni.cz/public/papers/rsa_ccs17 . With Amazon AWS (Intel E5-2650 v3@3GHz) you can crack 512bit RSA key proximately in 2 hours.

  • 4
    This is not a vulnerability in RSA itself but rather in the way that a certain cryptographic library generates RSA keys. Keys not generated with this library are not vulnerable. Shorter keys (keys with length less than 2048 bits) are generally considered insecure anyways.
    – Andrew Chow
    Oct 18, 2017 at 15:38

Actually, RSA is broken. The Fasterfactor algorithm, is a high speed factorization for very large numbers:

enter image description here

  • 2
    If RSA was broken, I think I'd have heard about it somewhere, probably on the front page of the New York Times or something.
    – Mark
    Dec 7, 2017 at 23:30
  • 1
    Citation needed! If this is your own proposed novel attack, then this is not the place to share it. People will probably not take it seriously until you have released code, cracked well-known challenge messages, or published your attack in a peer-reviewed journal. Your image doesn't seem to contain anything beyond simple algebra and I would bet a lot that the idea has already been considered and shown not to be significant. Dec 8, 2017 at 2:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.