What Is RSA Encryption? How the RSA Algorithm Works

If you’ve ever generated a CSR, you’ve likely picked “RSA 2048” as the key type. Below is what that means: how the RSA algorithm works, a worked example you can check by hand, and which key size to choose. We also cover the September 2026 factoring records, which don’t threaten 2048-bit keys.

This guide covers the RSA algorithm. RSA Security, the security company, is named after the same three inventors.

---

Table of Contents

1. What Is RSA Encryption?
2. What Is an RSA Key?
3. RSA Key Sizes
4. How Does RSA Encryption Work?
5. RSA Encryption Steps: A Worked Example
6. Where Is RSA Used?
7. RSA in Your SSL Certificate
8. RSA vs AES and ECC
9. Advantages and Disadvantages of RSA
10. Is RSA Secure?
11. Is RSA Being Phased Out?
12. RSA Encryption FAQ

---

---

What Is RSA Encryption?

RSA encryption is a form of asymmetric cryptography: it uses a public key to encrypt data and a separate private key to decrypt it. Symmetric ciphers such as AES use one shared key for both.

Its security rests on factoring. Multiplying two large primes is easy. Recovering them from their product, a number called a semiprime, is impractical with any known classical method once that product is 2048 bits long.

Ron Rivest, Adi Shamir and Leonard Adleman published the algorithm in 1977 at the Massachusetts Institute of Technology (MIT). Clifford Cocks at the UK’s GCHQ had found an equivalent system in 1973, but his work stayed classified until 1997.

RSA rarely encrypts your actual data. It’s slow and can only handle a message shorter than its key. Systems use hybrid encryption instead: RSA cryptography protects a short secret key or signs a message, and AES encrypts the data.

What Does RSA Stand For?

RSA stands for Rivest–Shamir–Adleman, the surnames of the three MIT researchers who published it in 1977. It isn’t short for a technical term. You’ll also see it called the RSA algorithm, the RSA cryptosystem or the RSA cipher; all three mean the same thing.

---

What Is an RSA Key?

An RSA key is one half of a mathematically linked pair. The public key is two numbers, (e, n), and the private key is (d, n). Here n is the product of two secret primes, and only someone who knows those primes can compute the private exponent d.

Your RSA public key goes into your Certificate Signing Request (CSR) and then into the issued certificate, where any browser can read it. Your RSA private key stays on your server and never goes to the CA. If it leaks, anyone can impersonate your site, so follow our private key storage practices.

On disk, a key is a text file in PEM format that starts with -----BEGIN PRIVATE KEY-----. Our guides to PEM files and finding your SSL private key explain the format and where servers keep it.

The public exponent e is almost always 65537. It’s prime, large enough to block small-exponent attacks, and equal to 2¹⁶ + 1. That number has only two 1-bits in binary, so encryption and signature checks stay fast.

---

RSA Key Sizes: 2048, 3072 or 4096 Bits?

Use a 2048-bit RSA key for a standard SSL certificate. It’s the smallest size public CAs accept and the fastest of the three. Choose 3072 bits if you need the 128-bit security level that NIST’s draft plan expects after 2030. A 4096-bit key adds strength but slows every handshake on a busy server.

RSA key size	Security strength (NIST SP 800-57)	Public CA status	Use it for
1024 bits	80 bits or less	Not accepted	Nothing. Replace it.
2048 bits	112 bits	Minimum accepted	Most websites
3072 bits	128 bits	Accepted	Keys that must meet a 128-bit policy
4096 bits	Between 128 and 192 bits	Accepted	Policies that require it
ECDSA P-256 (for comparison)	128 bits	Accepted	A smaller, faster alternative

The CA/Browser Forum’s Baseline Requirements (section 6.1.5) set the floor for public certificates: an RSA modulus of at least 2048 bits, with a length divisible by 8. ECDSA keys must use the P-256, P-384 or P-521 curve.

A 2048-bit modulus is about 617 digits long. The largest RSA number factored in public so far has 270 digits (see Short Keys and Factoring Records). If you’re choosing a key type for a new certificate, our ECDSA vs RSA comparison covers compatibility and speed.

---

How Does RSA Encryption Work?

The RSA encryption algorithm works in three stages, step-by-step: key generation, encryption and decryption. Each stage uses modular arithmetic, the clock-style math where numbers wrap around after they reach a modulus, and the link between public and private keys.

RSA Key Generation

1. Pick two large random primes, p and q, from a strong random number generator. For a 2048-bit key, each is about 1,024 bits.
2. Multiply them: n = p × q. This modulus sets the key size.
3. Compute Euler’s totient: φ(n) = (p − 1)(q − 1).
4. Choose the public exponent e, which must share no factor with φ(n) except 1. Real keys use 65537, not the e = 3 of many textbooks.
5. Compute the private exponent d, the modular inverse of e modulo φ(n), with the extended Euclidean algorithm.

The public key is (e, n) and the private key is (d, n). Keep p and q as secret as d, since anyone holding them can rebuild the private key.

The PKCS #1 standard defines d with Carmichael’s function, λ(n) = lcm(p − 1, q − 1), instead of φ(n). It can produce a smaller d that works just as well. In the example below, both give d = 23.

RSA Encryption and Decryption

To encrypt, turn the message into a number M smaller than n, then compute the ciphertext C with modular exponentiation:

C = Mᵉ mod n

To decrypt, apply the private key:

M = Cᵈ mod n

Only the holder of d can reverse the first operation, so two parties who’ve never met can exchange a secret over an open network. Real systems add padding before encrypting (see Improper Padding).

RSA Digital Signatures

RSA signatures run the same math in reverse. You hash the message and raise the hash to the power d with your private key. Anyone can raise the signature to the power e with your public key and compare the result with their own hash.

A match proves the message came from the key holder and hasn’t changed. Modern RSA signatures use the PSS padding scheme, which TLS 1.3 requires for handshake signatures.

---

RSA Encryption Steps: A Worked Example With Small Numbers

With p = 17 and q = 11, RSA turns the message 88 into the ciphertext 11 and back into 88. Every step is small enough to check on a calculator.

1. Primes: p = 17 and q = 11.
2. Modulus: n = 17 × 11 = 187.
3. Totient: φ(n) = 16 × 10 = 160.
4. Public exponent: e = 7, valid because gcd(7, 160) = 1.
5. Private exponent: find d so that 7 × d mod 160 = 1.

The extended Euclidean algorithm takes two divisions: 160 = 7 × 22 + 6, then 7 = 6 × 1 + 1. Working backward, 1 = 7 − 6 = 7 − (160 − 7 × 22) = 7 × 23 − 160. So d = 23. Check: 7 × 23 = 161, and 161 mod 160 = 1.

That gives a public key of (7, 187) and a private key of (23, 187). Now encrypt the number 88. In a real system, text is first converted to numbers, for example with ASCII codes.

• To encrypt: C = 88⁷ mod 187 = 11
• To decrypt the RSA encrypted message: M = 11²³ mod 187 = 88

Carmichael’s version gives the same d: λ(187) = lcm(16, 10) = 80, and 7 × 23 = 161 = 2 × 80 + 1.

Notice that 88 encrypts to 11 every time. Textbook RSA is deterministic, so an attacker who guesses a likely message can encrypt it with your public key and compare. That’s why real RSA always adds random padding.

Real keys follow the same steps with primes hundreds of digits long. Someone who intercepts the ciphertext can’t reverse it without p, q or d.

RSA encryption example with p = 17 and q = 11: key generation, encryption of 88 to 11 and decryption back to 88

---

---

Where Is RSA Used?

RSA authenticates servers in HTTPS, signs software and certificates, encrypts email, and secures SSH and VPN connections. Those jobs make it one of the most common algorithms in network security. What it rarely does today is encrypt bulk data or, in modern TLS, exchange session keys.

RSA in SSL/TLS Certificates and HTTPS

Your SSL certificate, an X.509 certificate, holds your RSA public key. In a modern TLS handshake, that key proves your server’s identity. It no longer encrypts the session key.

When a browser connects over HTTPS with TLS 1.3:

1. Browser and server agree on a session key with an ephemeral key exchange (ECDHE). Chrome uses a hybrid of X25519 and post-quantum ML-KEM here.
2. The server sends its digital certificate, and the browser checks the CA’s signature and the certificate’s validity.
3. The server signs the handshake with its RSA private key, and the browser verifies it with the certificate’s public key.
4. Both sides encrypt the session with a symmetric cipher such as AES.

Older TLS 1.2 setups could use RSA key exchange instead: the browser encrypted a secret with the server’s public key. TLS 1.3 removed that mode in 2018 because it lacks forward secrecy. Anyone who later stole the private key could decrypt recorded traffic.

RFC 10015, published in July 2026, now forbids RSA key exchange in TLS 1.2 as well. Clients must not offer it, and servers must not select it.

Digital Signatures, Code Signing and Certificate Authorities

RSA enables digital signatures, which prove that a message or file came from the sender and hasn’t been changed. When developers sign software, they use their private key, and the operating system checks the signature with the matching public key.

The same mechanism builds trust in SSL/TLS connections. You send your public key in a Certificate Signing Request (CSR), and the Certificate Authority (CA) signs your certificate with its own private key. Browsers store the CA’s root certificates, so they can verify that signature.

Email, SSH and VPNs

Email tools such as Pretty Good Privacy (PGP) and S/MIME use RSA to protect your emails. The sender encrypts a one-time message key with the recipient’s public key, and only the recipient’s private key can recover it.

VPN encryption often relies on RSA certificates during the handshake, so your device can confirm it’s talking to the real VPN server.

SSH uses RSA for host and user keys, though Ed25519 has been the default key type in ssh-keygen since OpenSSH 9.5 (October 2023). Pick Ed25519 for new SSH keys unless an older system only accepts RSA. Our SSH vs SSL guide explains how the two protocols differ.

---

RSA in Your SSL Certificate: Key Type, CSR and Renewal

For most websites, order your SSL certificate with an RSA-2048 key, or ECDSA P-256 if your server and visitors support it. Either way, you generate the private key on your server, and the public key travels to the CA inside your CSR.

RSA or ECDSA?

RSA-2048 works with practically every client still in use, including older devices and embedded systems. ECDSA P-256 gives 128-bit security with a much smaller key, so certificates are smaller and handshakes faster. Choose ECDSA if you serve modern browsers; stay on RSA for legacy devices. Our guide to ECC certificates explains how to get one.

Generate an RSA Key and CSR

One OpenSSL command creates a 2048-bit RSA private key and a CSR:

openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr

It asks for your domain and organization details. Send the .csr file to the CA and keep example.com.key on the server. The -nodes flag leaves the key unencrypted so your web server can read it at startup.

Prefer a form? Our CSR Generator does the same job, and our list of OpenSSL commands covers the rest.

Check the RSA Key in a Certificate

Run openssl x509 -in example.com.crt -noout -text and look for three lines:

• Public Key Algorithm: rsaEncryption
• Public-Key: (2048 bit)
• Exponent: 65537 (0x10001)

The “Signature Algorithm” line, such as sha256WithRSAEncryption, describes how the CA signed the certificate, not your key type. To inspect a CSR before you submit it, paste it into our CSR Decoder.

Shorter Lifetimes Mean More Key Handling

Maximum certificate lifetimes are shrinking under the CA/Browser Forum rules: 200 days since March 15, 2026, 100 days from March 15, 2027, and 47 days from March 15, 2029. Each renewal needs a CSR, so you’ll decide more often whether to reuse your RSA key.

Generate a new key at each renewal unless something forces reuse, such as a pinned key or a hardware security module. Automating renewals with the ACME protocol makes that routine.

---

RSA vs AES and ECC

RSA, AES and ECC do different jobs, and an HTTPS connection uses at least two of them. AES encrypts the data, while RSA or ECC proves who the server is.

	RSA	AES	ECC (ECDSA, ECDHE)
Type	Asymmetric	Symmetric	Asymmetric
Key size for 128-bit security	3072 bits	128 bits	256 bits
Speed	Slow	Fast	Faster than RSA for key generation and signing
Typical job	Certificate signatures	Encrypting data in bulk	Key exchange and certificate signatures

So the answer to “Which is better, RSA or AES?” is both: AES for the data and an asymmetric algorithm to set it up. Our RSA vs AES comparison goes deeper, and ECDSA vs RSA covers the certificate choice.

---

Advantages and Disadvantages of RSA

RSA’s main advantage is that two strangers can communicate securely without sharing a secret first. Its main drawbacks are speed, key size and how easily a careless implementation breaks it.

Benefits of RSA

• No shared secret needed: parties can set up secure communication without meeting in advance.
• Public-key cryptography: anyone can encrypt to you or verify your signature with a key you publish openly.
• Digital signatures: RSA authenticates identities and confirms a message wasn’t altered.
• Broad compatibility: TLS, PGP, S/MIME, SSH and every public CA support it.

Drawbacks of RSA

• Slower encryption speed: RSA is far slower than AES, so it only handles small values such as keys and hashes.
• Large keys: RSA needs 3072 bits for the 128-bit security that ECDSA reaches with 256 bits.
• Small payload: a 2048-bit key with OAEP and SHA-256 encrypts at most 190 bytes.
• Quantum risk: Shor’s algorithm on a large quantum computer would break RSA.
• Fragile implementations: padding, randomness and timing mistakes have broken real RSA deployments.

---

Is RSA Secure? Known Attacks and How to Prevent Them

Yes. RSA cryptography with a 2048-bit or larger key resists every known classical attack. When RSA fails in practice, the cause is almost always the implementation: bad randomness, missing padding, timing leaks or a key that’s too short.

Side-Channel Attacks

A side-channel attack skips the math and measures the computer instead: how long decryption takes, how much power it draws or what signals it emits. Those measurements can leak bits of the private key.

The defense is constant-time code, which takes the same time whatever the input, plus blinding, which randomizes each private-key operation. Branch prediction analysis is a related risk, so code should never branch on secret data.

Weak Random Number Generators

RSA keys are only as good as the randomness used to pick p and q. If the primes are predictable, an attacker can regenerate them and rebuild the private key. Weak prime numbers, such as two primes that sit too close together, are just as dangerous.

Generate keys with the operating system’s random source, such as /dev/urandom on Linux, which draws on high-entropy sources like hardware noise. The Debian OpenSSL bug of 2008 shows what goes wrong otherwise: affected Debian and Ubuntu systems generated predictable keys, and all of them had to be replaced.

Short Keys and Factoring Records

Short RSA keys fall to factoring, and the public record keeps moving: 896 bits as of September 2026. These are the milestones from the RSA Factoring Challenge:

Number	Size	Factored	Notes
RSA-155	512 bits	August 22, 1999	First 512-bit RSA number factored in public
RSA-768	768 bits	December 12, 2009
RSA-250	829 bits	February 28, 2020	The record until 2026
RSA-260	862 bits	September 3, 2026	Eric Lu, Cognition; about 13.5 GPU-years
RSA-896	896 bits	September 19, 2026	Stephen A. Weis; about 30 GPU-years

Both teams used AI coding agents (Cognition’s Devin and Anthropic’s Claude) to port the CADO-NFS factoring software to GPUs. The math itself was the standard general number field sieve (GNFS), the best known classical method.

Neither result used a quantum computer, and both researchers say deployed RSA-2048 keys aren’t affected. Cognition estimates RSA-2048 is roughly a billion times harder to factor than RSA-1024, which nobody has factored either.

Poor parameters break RSA too, such as a private exponent d that’s too small. If you find a 1024-bit key on a server, replace it: no public CA will issue a certificate for it.

Improper Padding

Never encrypt raw data with RSA. Without a padding scheme, identical messages produce identical ciphertext, and attackers can mount chosen-ciphertext attacks. A padding scheme adds random, structured bytes before encryption. RSA uses three, all defined in PKCS #1 (RFC 8017):

• Optimal Asymmetric Encryption Padding (OAEP), for encryption.
• PSS, for signatures. TLS 1.3 requires it for RSA handshake signatures.
• PKCS #1 v1.5, the original scheme, still allowed for certificate signatures.

PKCS #1 v1.5 encryption is why RSA key exchange was retired. Daniel Bleichenbacher published a padding-oracle attack against it in 1998, and the ROBOT attack found the same flaw still live on popular websites in 2017.

Exposure During Key Exchange

If an attacker swaps in their own public key during the handshake, they can read everything that follows. That’s a man-in-the-middle attack. Certificates signed by trusted CAs block it, because your browser checks the certificate’s signature and rejects a fake key. The attack works only when certificate checks are skipped or a user clicks past a browser warning.

---

Is RSA Being Phased Out?

Not yet. RSA certificates are still issued and trusted in 2026, but NIST has proposed retiring RSA within the next decade because of quantum computers. Its draft plan, NIST IR 8547, would deprecate RSA-2048 after 2030 and disallow all RSA after 2035. It is still an initial public draft from November 2024.

The threat is Shor’s algorithm, published in 1994, which factors large numbers quickly on a big enough quantum computer. In May 2025, Craig Gidney of Google Quantum AI estimated that RSA-2048 could fall in under a week to fewer than 1 million noisy qubits. His 2019 estimate needed 20 million, and no machine of either size exists.

NIST finalized the replacements on August 13, 2024: ML-KEM (FIPS 203) for key exchange, and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures.

Key exchange moved first because of “harvest now, decrypt later”: traffic recorded today could be decrypted once a large quantum computer exists. That’s why Chrome already pairs X25519 with ML-KEM. Signatures don’t carry that risk, because a forged signature only matters while the certificate is valid.

For a website, nothing is urgent. Keep using RSA-2048 or ECDSA P-256 certificates, automate renewals, and watch for post-quantum certificates, which public CAs don’t issue yet. Elliptic Curve Cryptography (ECC) faces the same quantum risk, so switching to ECDSA buys speed, not quantum safety. Read more about the post-quantum problem behind SSL validity.

---

RSA Encryption FAQ

---

Secure Your Site with Trusted RSA-Based SSL Certificates

For most sites, a DV certificate with an RSA-2048 key from SSL Dragon is the right starting point. It’s issued in minutes, trusted by 99.99% of browsers, and works with every client. If your server and visitors support it, choose ECDSA instead for smaller, faster handshakes. Compare SSL certificates and pick the validation level your site needs.