Is there a situation where RSA cannot be replaced with ECC + symmetric algorithms? If no, why do we still use it? RSA is both an asymmetric encryption algorithm and a digital signature algorithm.  However, in recent years, many cryptographic protocols (TLS, for example) have moved away from the use of RSA to instead prefer ECC because of forward secrecy.

So, my question is, do we still need RSA?  Is there any situation where it cannot be replaced by an ECC scheme instead?

More specifically, if the answer to the above is no, are there any circumstances in which RSA is better suited than the ECC counterpart?  Why is it still in use from a practical point of view?
Summary: ECC+symmetric algorithms can do almost anything RSA+symmetric algorithms commonly do (plus forward secrecy where RSA struggles). But RSA is often preferred, sometime rightly so, in particular due to it's superior performance for the public-key side.



At common security levels, the public-key RSA operation (used for signature verification, and on the encryption side of public-key encryption) remains significantly more compute-efficient than anything ECC-based has to offer. That's an advantage in some applications, including:


For the signature of a digital certificate: it can be verified many millions times in its active lifetime, when it is generated only once; the cost of its signature can be neglected entirely, while the power or/and time saving by the users of the certificate becomes sizable. That is part of why CAs typically use RSA public/private key pairs.
For data (including code) signature verification by underpowered devices (IoT).
For asymmetric encryption by underpowered devices (IoT), complemented by symmetric crypto for large ciphertext.


To illustrate: with $e=3$, on a CPU with 32×32→64-bit multiplication, a straightforward RSA signature verification with $n$-bit public modulus uses about $4(n/32)^2$ multiplications (e.g. &lt;17k multiplications for $n=2048$), while ECC-based crypto in field $\Bbb Z_p$ with $n$-bit $p$ requires about $k\,n(n/32)^2$ multiplications for some integer $k$ typically 12 or more (e.g. 200k multiplications for $n=256$). In practice, even when using RSA with $e=65537$ (like 8 times slower than $e=3$) perhaps due to diktat by authorities, RSA typically keeps a sizable advantage because it is easier to optimize.



Also, RSA signature with message recovery is sometime what minimizes the size overhead of signing. E.g. for a 350-octet payload to be conveyed signed, the signed message is


384-octet with RSA-3072 per ISO/IEC 9796-2 scheme 3 and SHA-256
398-octet with ECPVS (ANS X9.92-1) and SHA-256
414-octet with ECDSA/EdDSA and SHA-256


Thus when size is a hard limit, RSA signature with message recovery might be the only option. Admittedly, that applies only for a narrow interval of size: the gain is a fraction of the hash size thus becomes proportionally negligible with larger payloads, and ECC wins for smaller ones (because RSA cryptograms have the size of the public modulus). It happens that the interval where RSA wins is close to the maximum practical capacity of a 2D-code (e.g. QR-code).



That answer points another rather specialized use case of RSA where it shines: deterministic, size-preserving public-key encryption.

That answer points yet other practical reasons why RSA remains widely used.