Why is RSA no longer used?

RSA is not "no longer used" in March 2026 — it remains very widely deployed across the internet, TLS certificates, VPNs, code signing, SSH keys, secure email, and countless legacy/enterprise systems.

However, RSA (along with classical elliptic curve cryptography like ECDSA and ECDH) is in the process of being phased out and will eventually be replaced for most security-sensitive applications. Here's the current reality:

Why RSA is on its way out (main reason)

A sufficiently powerful, fault-tolerant quantum computer running Shor's algorithm can efficiently solve the integer factorization problem → directly break RSA (and also break discrete-log-based systems like classic Diffie-Hellman and most ECC).

• No such cryptographically-relevant quantum computer exists today (March 2026).
• Best current estimates for "Q-Day" (when RSA-2048 becomes realistically breakable) still cluster around 2030–2035, though some recent papers (especially from Google Quantum AI in 2025) have lowered the qubit requirements significantly → making the timeline feel more compressed.
• NIST and many governments now treat this as a real migration deadline, not a distant hypothetical.

Official timelines (as of early 2026)

NIST's post-quantum cryptography (PQC) transition guidance (from NIST IR 8547 draft and related documents):

• Deprecated after 2030 — RSA (and ECDSA/EdDSA/DH) at 112-bit security level (roughly RSA-2048 and ECC ~256 bits)
• Disallowed after 2035 — basically all classical public-key cryptography (even stronger parameter sets)

Many organizations (especially US federal systems, financial sector, critical infrastructure) follow similar or stricter timelines:

• NSA / CNSA 2.0 → prefer quantum-resistant algorithms already in 2025–2026 for new systems
• Full migration deadlines around 2033–2035 for national security systems

Current status in practice (2026)

• Most websites still use RSA or ECDSA in TLS certificates (often hybrid setups are starting to appear)
• SSH, PGP, many VPNs, code signing certificates, smart cards, HSMs, etc. → still heavily RSA/ECC
• Hybrid cryptography is increasingly common (classical + post-quantum key exchange in TLS 1.3 experiments by Cloudflare, Google, AWS, etc.)
• New systems and standards (especially in government/finance) are moving to NIST PQC algorithms:
  • Key encapsulation/exchange: ML-KEM (Kyber successor)
  • Signatures: ML-DSA (Dilithium), SLH-DSA (SPHINCS+), and others coming

Summary table of the situation

Aspect	Status in March 2026	Outlook / Deadline
Is RSA broken classically?	No — still very secure against classical attacks	—
Is RSA broken by quantum?	No — no CRQC exists yet	Expected ~2030–2035
Still widely used?	Yes — majority of internet PKI	Declining rapidly after ~2028–2030
NIST status (2048-bit RSA)	Allowed for now	Deprecated ~2030, disallowed ~2035
Recommended action	Inventory RSA usage → plan hybrid → full PQC migration	Urgent for long-lived secrets

Bottom line in 2026: RSA isn't "no longer used" — it's still the most common public-key algorithm in the world — but everyone who handles data that needs to stay confidential for 10+ years is supposed to be actively migrating away from it right now, because the quantum risk window is closing faster than many expected just a few years ago.

If you're asking because of a specific context (TLS, SSH, certificates, banking, etc.), feel free to give more details for a more targeted answer.