Cybersecurity glossary
What is RSA?
Learn what RSA is, how public and private exponents enable encryption and signatures, why padding matters, and how RSA fits modern TLS and PKI practice.
Definition
RSA is a public-key cryptosystem based on the practical difficulty of factoring large composite numbers; it supports encryption and digital signatures using a public exponent and modulus paired with a closely held private exponent.
Why RSA still matters in 2026
RSA made public-key cryptography practical for the Internet. Even as ECDHE and modern curves dominate handshakes, countless certificates, code-signing keys, and enterprise tokens still use RSA subject keys. Knowing what RSA does—and which modes are obsolete—prevents insecure PKCS#1 v1.5 leftovers and oversized expectations about bulk encryption.
Core RSA building blocks
Modulus n
Product of secret primes; published as part of the public key.
Public exponent e
Commonly 65537; used for encryption or signature verification.
Private exponent d
Secret value used for decryption or signing.
Padding scheme
OAEP/PSS turn raw modular exponentiation into a safe cryptosystem.
Typical RSA signature verification flow
Hash the message
A digest such as SHA-256 represents the content being signed.
Sign with private key
The signer applies RSA-PSS (or another approved scheme) using d.
Distribute public key
Often via an X.509 certificate issued under a trusted CA.
Verifier checks signature
Using e and n, the verifier validates the signature against the digest.
Bind to protocol context
TLS, code signing, or JWT verification applies additional identity checks.
RSA usage patterns to prefer or avoid
Algorithm presence is not the same as safe configuration.
| Pattern | Status | Note |
|---|---|---|
| RSA-PSS signatures | Preferred | Modern default for many new signature uses |
| RSA-OAEP encryption | Preferred | For key wrapping when RSA encryption is required |
| PKCS#1 v1.5 encryption | Avoid | Padding-oracle history; remove when possible |
| RSA key transport in TLS 1.2 | Legacy | No forward secrecy; disable on modern servers |
| Raw textbook RSA | Forbidden | Malleable and unsafe without padding |
Operational checklist
- Generate RSA keys in a CSPRNG-backed library or HSM—never hand-roll primes.
- Prefer 2048-bit minimum; choose larger sizes for long-lived roots and archives.
- Use OAEP for encryption and PSS for signatures unless a standard forces otherwise.
- Store private keys in KMS/HSM modules with audited decrypt/sign permissions.
- Disable TLS RSA key-transport cipher suites; keep RSA certificates only if needed for auth.
- Monitor for weak keys, shared primes, and accidental private-key commits.
- Plan hybrid or PQ signatures for long-horizon trust anchors.
- Document whether each RSA key is for signing, decryption, or both—and split roles when possible.
RSA failures are usually operational
Factoring a well-generated 2048-bit modulus remains impractical classically. Real incidents more often involve leaked private keys, bad padding implementations, insufficient key sizes on ancient appliances, or misunderstanding RSA as a bulk file cipher. Treat RSA as one asymmetric tool inside hybrid designs—not as the entire security architecture.
The practical takeaway
RSA remains a foundational public-key system for signatures and legacy encryption. Use approved padding, adequate key sizes, strong key custody, and modern TLS key agreement—while preparing for post-quantum transition.
Related security terms
Asymmetric Cryptography
The public-key model RSA helped popularize.
Elliptic-Curve Cryptography (ECC)
A common modern alternative with smaller keys.
X.509 Certificate
Certificates frequently carry RSA subject public keys.
TLS 1.3
TLS 1.3 removes RSA key transport but still allows RSA signatures.
Public Key Infrastructure (PKI)
Ecosystems that still issue large numbers of RSA certificates.
Frequently asked questions
What is RSA in simple terms?
RSA is a public-key algorithm. Anyone can encrypt to your public key or verify your signatures; only your private key can decrypt or create those signatures.
Is RSA still used in HTTPS?
Yes for signatures and certificates. TLS 1.3 no longer uses RSA to encrypt session keys directly; key agreement is ephemeral (often ECDHE) while certificates may still be RSA.
What RSA key size should I use?
Modern guidance commonly starts at 2048 bits for compatibility, with 3072-bit or larger keys for longer-term strength. Follow current NIST and industry baselines for your risk profile.
Why is padding important in RSA?
Raw RSA is unsafe. Use OAEP for encryption and PSS for signatures (or carefully reviewed library defaults) to prevent malleability and oracle attacks.
How does RSA compare with ECC?
ECC usually offers similar classical security with smaller keys and faster operations. RSA remains widespread because of legacy PKI and tooling.
Is RSA quantum-safe?
No. Shor’s algorithm would break RSA and ECC. Plan post-quantum migration for long-lived trust.
Can I encrypt large files directly with RSA?
No. Hybrid encryption wraps a symmetric key with RSA (or a KEM) and encrypts bulk data with AES-GCM or similar.
References
Explore authoritative guidance and frameworks related to rsa.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.