--- title: How Ditching RSA Made Teleport 77% More CPU-Efficient description: Teleport switched from RSA 2048-bit keys to ECDSA and Ed25519 starting in Teleport 17, driven by performance and security concerns with RSA's implementation... canonical: https://daily.dev/posts/how-ditching-rsa-made-teleport-77-more-cpu-efficient-nnrwnenin twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How Ditching RSA Made Teleport 77% More CPU-Efficient | daily.dev og:description: Teleport switched from RSA 2048-bit keys to ECDSA and Ed25519 starting in Teleport 17, driven by performance and security concerns with RSA's implementation... og:url: https://daily.dev/posts/how-ditching-rsa-made-teleport-77-more-cpu-efficient-nnrwnenin og:image: https://api.daily.dev/og/posts/nNrwnENin.png og:image:alt: How Ditching RSA Made Teleport 77% More CPU-Efficient og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How Ditching RSA Made Teleport 77% More CPU-Efficient **[Teleport](https://daily.dev/sources/teleport)** · 13 min read · 0 upvotes · 0 comments ## Summary Teleport switched from RSA 2048-bit keys to ECDSA and Ed25519 starting in Teleport 17, driven by performance and security concerns with RSA's implementation pitfalls (weak key sizes, SHA-1, padding schemes). The change is opt-in for existing clusters via a new 'signature algorithm suite' setting (legacy, balanced-v1, fips-v1, hsm-v1). Benchmarks on a database-connection-heavy workload showed CPU usage on the Proxy service drop from 71% to 16% (a 77% reduction) and average query latency drop from 1.27s to 0.8s (37% reduction). CI test suites also cut RSA key generation by 61%. The post also covers the historical adoption timelines of RSA, ECDSA, and Ed25519 in SSH/TLS, and notes NIST's draft plan to disallow ECDSA and Ed25519 after 2035 in favor of post-quantum algorithms. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How much did switching from RSA to ECDSA improve Teleport's CPU usage? Teleport's Proxy service CPU usage dropped from 71% to 16%, a 77% reduction, when switching from RSA to ECDSA keys in a benchmark simulating many concurrent database connections. Average query latency also dropped from 1.27 seconds to 0.8 seconds, a 37% improvement, after moving to the balanced-v1 signature algorithm suite introduced in Teleport 17. _Teams evaluating cryptography trade-offs for their own infrastructure can track real-world benchmarks like this on daily.dev._ ### Why is Ed25519 not usable for public TLS certificates in browsers? The CA/Browser forum has not approved Ed25519 for use in publicly trusted TLS certificates, so no major web browser accepts Ed25519-based certificates. Most OIDC and SAML implementations, database protocols, and hardware keys, HSMs, and cloud KMS systems also lack Ed25519 support, which is why ECDSA remains the practical choice for TLS despite Ed25519's simplicity and speed advantages. _Developers choosing signature algorithms for TLS versus SSH can compare these compatibility trade-offs on daily.dev._ ### When did OpenSSH stop supporting RSA with SHA-1 by default and what does that mean for compatibility? OpenSSH added support for RSA with the more secure SHA-2 hash in version 7.2, released in 2016, and later deprecated SHA-1 support by default in OpenSSH 8.8, released in 2021. As a result, OpenSSH clients running version 8.8 or newer cannot communicate by default with OpenSSH servers running version 7.1 or older. _Engineers planning SSH upgrades can watch for compatibility breaks like this one on daily.dev._ ## Similar posts on daily.dev - [The Great Certificate Size Explosion – IPsec Series, Part 7](https://daily.dev/posts/the-great-certificate-size-explosion-ipsec-series-part-7-qqoeuqaeo) · Cisco · 1 upvotes · 0 comments - [Cloudflare Measures Origin TLS Preferences, Cutting Handshake Retries from 52% to 3.7%](https://daily.dev/posts/cloudflare-measures-origin-tls-preferences-cutting-handshake-retries-from-52-to-3-7--imenahndh) · InfoQ · 0 upvotes · 0 comments - [Stop managing SSH keys on every server and switch to Teleport](https://daily.dev/posts/stop-managing-ssh-keys-on-every-server-and-switch-to-teleport-zoja48gov) · All Things Open · 0 upvotes · 0 comments - [Why we cannot wait for better post-quantum signature algorithms](https://daily.dev/posts/why-we-cannot-wait-for-better-post-quantum-signature-algorithms-3zasaxenh) · Cloudflare · 1 upvotes · 0 comments --- Tags: [#cryptography](https://daily.dev/tags/cryptography), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/how-ditching-rsa-made-teleport-77-more-cpu-efficient-nnrwnenin) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How Ditching RSA Made Teleport 77% More CPU-Efficient","url":"https://daily.dev/posts/how-ditching-rsa-made-teleport-77-more-cpu-efficient-nnrwnenin","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-ditching-rsa-made-teleport-77-more-cpu-efficient-nnrwnenin"},"datePublished":"2026-08-23T12:19:27.910Z","dateModified":"2026-08-23T12:32:32.736Z","description":"Teleport switched from RSA 2048-bit keys to ECDSA and Ed25519 starting in Teleport 17, driven by performance and security concerns with RSA's implementation...","image":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","thumbnailUrl":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-ditching-rsa-made-teleport-77-more-cpu-efficient-nnrwnenin","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cryptography,ssh","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"How Ditching RSA Made Teleport 77% More CPU-Efficient"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-ditching-rsa-made-teleport-77-more-cpu-efficient-nnrwnenin#faq","mainEntity":[{"@type":"Question","name":"How much did switching from RSA to ECDSA improve Teleport's CPU usage?","acceptedAnswer":{"@type":"Answer","text":"Teleport's Proxy service CPU usage dropped from 71% to 16%, a 77% reduction, when switching from RSA to ECDSA keys in a benchmark simulating many concurrent database connections. Average query latency also dropped from 1.27 seconds to 0.8 seconds, a 37% improvement, after moving to the balanced-v1 signature algorithm suite introduced in Teleport 17. Teams evaluating cryptography trade-offs for their own infrastructure can track real-world benchmarks like this on daily.dev."}},{"@type":"Question","name":"Why is Ed25519 not usable for public TLS certificates in browsers?","acceptedAnswer":{"@type":"Answer","text":"The CA/Browser forum has not approved Ed25519 for use in publicly trusted TLS certificates, so no major web browser accepts Ed25519-based certificates. Most OIDC and SAML implementations, database protocols, and hardware keys, HSMs, and cloud KMS systems also lack Ed25519 support, which is why ECDSA remains the practical choice for TLS despite Ed25519's simplicity and speed advantages. Developers choosing signature algorithms for TLS versus SSH can compare these compatibility trade-offs on daily.dev."}},{"@type":"Question","name":"When did OpenSSH stop supporting RSA with SHA-1 by default and what does that mean for compatibility?","acceptedAnswer":{"@type":"Answer","text":"OpenSSH added support for RSA with the more secure SHA-2 hash in version 7.2, released in 2016, and later deprecated SHA-1 support by default in OpenSSH 8.8, released in 2021. As a result, OpenSSH clients running version 8.8 or newer cannot communicate by default with OpenSSH servers running version 7.1 or older. Engineers planning SSH upgrades can watch for compatibility breaks like this one on daily.dev."}}]} ```