RSA (Rivest-Shamir-Adleman)
Public-key encryption and digital signatures
How it works
RSA's security rests on the difficulty of factoring the product of two large primes. A public key encrypts or verifies; the matching private key decrypts or signs. It is slow, so in practice it protects small values such as a session key or a hash, and it must be used with padding: OAEP for encryption and PSS for signatures.
Sizes: 2048-bit minimum modulus; 3072 bits for about 128-bit security; 4096 also common
Status: Sound at 2048+ bits with proper padding, but vulnerable to future quantum computers.
Strengths
- Mature, universally supported and FIPS-approved.
- One key pair can provide both encryption and signatures (though separate keys are better practice).
- Signature verification is fast.
Weaknesses and known attacks
- Bleichenbacher padding oracle attacks against PKCS #1 v1.5 encryption (revived in TLS as ROBOT).
- 'Textbook' RSA without padding is deterministic and malleable.
- RSA key transport gives no forward secrecy, which is why TLS 1.3 removed it.
- Shor's algorithm on a large quantum computer would break it.
Use it for
- Certificate signatures and code signing
- Legacy key transport where ECDHE is not available
Don't use it for
- Bulk data encryption
- Keys smaller than 2048 bits
- New long-lived systems without a post-quantum migration plan
Exam tip
RSA = factoring. Encrypt with the recipient's public key; sign with your own private key. It is far slower than AES, which is why real systems are hybrid.
References
Go deeper
Crypto lab: practise encryption, hashing and signatures
Glossary: Asymmetric encryption
DH / DHE
Key agreement
ECDSA
Digital signatures
Sign vs encrypt
Choosing the right key for confidentiality or authenticity
Quantum threat
Why cryptography is migrating to post-quantum algorithms
TLS 1.3
Secure transport protocol