RSA is still secure with a few caveats. 1. It isn't secure against quantum computing attacks. Granted neither are elliptical curve based cryptosystems, so this

RSA is still secure with a few caveats. 1. It isn't secure against quantum computing attacks. Granted neither are elliptical curve based cryptosystems, so this isn't the motivation for switching. 2. It requires complicated padding schemes to prevent certain classes of attacks. The padding schemes do succeed at solving this problem, but they add a layer of complexity, and are often done incorrectly by inexperienced crypto users. 3. It is speculated that there are additional attacks based on math that hasn't yet been discovered. There is some speculation that the NSA has/is/will break RSA using these types of attacks. 4. There are a huge number of potential side channel attacks based on weirdness with how RSA key's affect the computation performed during encryption/decryption. Like with #2, there are ways around it, but it can still cause problems. That said, if you use reasonable sized keys (2048 bit or larger), use libraries implemented by professionals with the correct options enabled, and you are worried about garden variety attacks, not the NSA, you are probably fine with RSA. Some people are starting to think that they are a little to much to bear, particularly when elliptic curves solve a lot of the problems and have smaller key sizes and faster computation. Side note: But for a few exceptions, any processor on the market today (including mobile/embedded) could easily establish an SSH session using RSA without it being a significant cost. RSA (and Elliptic curve cryptography) is only used at the beginning of the session to establish a symmetric session key.