RSA (Rivest-Shamir-Adleman)

RSA, named after Ron Rivest, Adi Shamir and Leonard Adleman, is a public-key cryptosystem whose security rests on the difficulty of factoring the product of two large primes. Its key size is the length of that modulus, for example 2048 bits. RSA can both sign and encrypt. In TLS it signs certificates and handshakes, with PKCS#1 v1.5 or RSA-PSS padding (TLS 1.3 requires RSA-PSS for handshake signatures), and in TLS 1.2 and earlier it could also transport the session secret.

Why it matters

RSA is still the most widely deployed certificate key type, and the Baseline Requirements require RSA keys of at least 2048 bits. A 2048-bit key provides roughly 112-bit security; 3072 bits gives about 128. Compared with ECDSA, RSA keys and signatures are larger and signing is slower. RSA key transport, which offers no forward secrecy, should be disabled: the ROBOT research in 2017 found many servers still exposed to Bleichenbacher-style padding oracles through it. A large quantum computer running Shor's algorithm would break RSA, which drives post-quantum migration.

Example

Generate a 2048-bit RSA key and a CSR for it:

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key
openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com"

Common misconceptions

• "An RSA certificate means RSA key exchange." An RSA certificate works with ECDHE-RSA suites, which are forward secret; RSA key transport is a separate choice you can disable.
• "4096-bit RSA is required for good security." 2048 bits is the accepted minimum. 4096 bits slows every handshake, and ECDSA P-256 gives stronger security at lower cost.
• "RSA has already been broken by quantum computers." No existing quantum computer can factor RSA-2048. The concern is future capability and data recorded today.