# What Is RSA (Rivest-Shamir-Adleman)? Definition and Examples

> RSA is a public-key algorithm, published in 1977, that TLS uses for certificate and handshake signatures and, before TLS 1.3, for key transport.

Source: https://ssl.sh/glossary/rsa/
Last updated: 2026-11-10

RSA, named after Ron Rivest, Adi Shamir and Leonard Adleman, is a public-key cryptosystem whose security rests on the difficulty of factoring the product of two large primes. Its key size is the length of that modulus, for example 2048 bits. RSA can both sign and encrypt. In TLS it signs certificates and handshakes, with PKCS#1 v1.5 or RSA-PSS padding (TLS 1.3 requires RSA-PSS for handshake signatures), and in TLS 1.2 and earlier it could also transport the session secret.

## Why it matters
RSA is still the most widely deployed certificate key type, and the Baseline Requirements require RSA keys of at least 2048 bits. A 2048-bit key provides roughly 112-bit security; 3072 bits gives about 128. Compared with [ECDSA](https://ssl.sh/glossary/ecdsa/), RSA keys and signatures are larger and signing is slower. RSA key transport, which offers no forward secrecy, should be disabled: the [ROBOT](https://ssl.sh/glossary/robot/) research in 2017 found many servers still exposed to Bleichenbacher-style padding oracles through it. A large quantum computer running Shor's algorithm would break RSA, which drives [post-quantum](https://ssl.sh/glossary/post-quantum-cryptography/) migration.

## Example
Generate a 2048-bit RSA key and a CSR for it:

```bash
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key
openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com"
```

## Common misconceptions
- **"An RSA certificate means RSA key exchange."** An RSA certificate works with ECDHE-RSA suites, which are forward secret; RSA key transport is a separate choice you can disable.
- **"4096-bit RSA is required for good security."** 2048 bits is the accepted minimum. 4096 bits slows every handshake, and ECDSA P-256 gives stronger security at lower cost.
- **"RSA has already been broken by quantum computers."** No existing quantum computer can factor RSA-2048. The concern is future capability and data recorded today.

## Related terms

- [公钥](https://ssl.sh/zh/glossary/public-key/): 公钥是非对称密钥对中可以公开的一半，写在证书里，供他人验证由对应私钥生成的签名。
- [私钥](https://ssl.sh/zh/glossary/private-key/): 私钥是非对称密钥对中保密的那一半，TLS 服务器用它证明自己拥有证书里的那把公钥。
- [密钥长度](https://ssl.sh/zh/glossary/key-size/): 密钥长度是密钥的位数，其安全含义取决于算法，例如 256 位的 ECDSA 密钥比 2048 位的 RSA 密钥更强。
- [数字签名](https://ssl.sh/zh/glossary/digital-signature/): 数字签名是用私钥对消息计算出的一个值，任何持有对应公钥的人都能验证它，从而确认消息来源和内容未被篡改。
- [ECDSA](https://ssl.sh/zh/glossary/ecdsa/): ECDSA 是基于椭圆曲线的数字签名算法，在 TLS 证书中作为 RSA 的替代方案，密钥和签名更小、签名运算更快。
- [密钥交换](https://ssl.sh/zh/glossary/key-exchange/): 密钥交换是 TLS 握手中客户端与服务器建立共享秘密的步骤，保护连接的对称密钥都由这个共享秘密派生而来。
- [ROBOT](https://ssl.sh/zh/glossary/robot/): ROBOT 是 2017 年公布的研究，发现大量 TLS 实现仍存在 1998 年的 Bleichenbacher RSA 填充预言机，攻击者可借此解密 RSA 密钥交换。
- [后量子密码](https://ssl.sh/zh/glossary/post-quantum-cryptography/): 后量子密码（PQC）是专为抵御大规模量子计算机攻击而设计的公钥密码算法，用来替代可能被量子计算机破解的 RSA 和 ECC。