RSA replacement in Teleport: what changes for IAM and NHI teams?

TL;DR: Switching from RSA to ECDSA and Ed25519 reduced benchmarked CPU usage by 77% and latency by 37%, while also simplifying certificate signing choices across SSH and TLS workflows, according to Teleport. The practical lesson is that algorithm selection is now an identity governance decision as much as a cryptography one, because performance, compatibility, and trust boundaries all move together.

NHIMG editorial — based on content published by Teleport: How Ditching RSA Made Teleport 77% More CPU-Efficient

By the numbers:

• Teleport says the switch from RSA to modern signature algorithms reduced benchmarked CPU usage by 77% and latency by 37%.
• Generating a 2048-bit RSA keypair can take about 10000x longer than an Ed25519 or ECDSA keypair with comparable security.
• Teleport's benchmark dropped proxy CPU usage from 71% to 16% when switching from RSA to ECDSA.

Questions worth separating out

Q: How should security teams migrate identity systems from RSA to modern signature algorithms?

A: Start with an inventory of every client, proxy, browser, database connector, and hardware-backed integration that validates your certificates.

Q: When does RSA create more operational risk than it reduces?

A: RSA becomes a risk when the organisation issues many short-lived identities, has mixed client support, or needs administrators to make repeated choices about hash, padding, and key size.

Q: What do teams get wrong about modern certificate algorithms?

A: They often focus on cryptographic strength alone and ignore operational support.

Practitioner guidance

• Inventory every certificate-issuing dependency Map SSH, TLS, database, and workload consumers that trust issued certificates, then identify which ones still depend on RSA or SHA-1 compatibility.
• Standardise signature choices into managed suites Create a small number of approved algorithm profiles for different operating contexts, such as legacy, regulated, and hardware-backed use.
• Benchmark certificate issuance under real load Measure CPU, latency, and failure rates when access systems generate keys at the pace they do in production, including web logins and database tunnels.

What's in the full article

Teleport's full blog post covers the implementation and benchmarking detail this post intentionally leaves for the source:

• The article's full comparison of RSA, ECDSA, and Ed25519 trade-offs across SSH and TLS signing.
• Benchmark setup details showing how CPU and latency changed under sustained database-connection load.
• The algorithm-suite model Teleport uses to reduce decision fatigue for cluster administrators.
• Compatibility considerations for regulated and hardware-backed environments that still rely on legacy cryptography.

👉 Read Teleport's analysis of RSA replacement and signature algorithm performance →

RSA replacement in Teleport: what changes for IAM and NHI teams?

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →