RSA (Rivest-Shamir-Adleman) is a widely used asymmetric encryption algorithm that uses a mathematically linked public and private key pair. Its security rests on the difficulty of factoring the product of two large prime numbers. RSA is used for secure key exchange, digital signatures, and certificates.
RSA is an asymmetric (public key) encryption algorithm named after its inventors, Rivest, Shamir, and Adleman. It uses a public key to encrypt and a private key to decrypt, and its security relies on the fact that multiplying two large primes is easy but factoring the result back is extremely hard. RSA underpins secure key exchange, digital signatures, and TLS certificates across the internet.
Key Takeaways
- RSA is an asymmetric encryption algorithm that uses a public and private key pair, named after Rivest, Shamir, and Adleman.
- Its security rests on the practical difficulty of factoring the product of two very large prime numbers.
- For confidentiality, the public key encrypts and the private key decrypts. For digital signatures, the private key signs and the public key verifies.
- NIST recommends a minimum RSA key length of 2048 bits; RSA-2048 remains secure against classical computers today.
- RSA is quantum-vulnerable: a future quantum computer running Shor’s algorithm could break it. NIST’s draft timeline deprecates RSA after 2030 and disallows it after 2035, with ML-KEM and ML-DSA as the post-quantum replacements.
What Is RSA?
RSA, named after Ron Rivest, Adi Shamir, and Leonard Adleman who described it in 1977, is the most widely used asymmetric encryption algorithm. Asymmetric encryption uses a pair of mathematically linked keys: a public key that can be shared with anyone, and a private key kept secret by its owner. What one key does, only the other can undo. This two-key design is what makes RSA so versatile, because it solves the problem of exchanging keys securely over an untrusted network, which single-key symmetric encryption cannot do on its own.
How Does RSA Work?
RSA supports two distinct operations, depending on which key is used first. Understanding the difference is the key to understanding RSA.
Encryption for confidentiality (public key encrypts)
To send someone confidential data, you encrypt it with their public key. Because only the matching private key can reverse the operation, only that person can decrypt and read the data, even if it is intercepted in transit. This is how RSA protects a secret: anyone can encrypt a message to you using your published public key, but only you, holding the private key, can open it.
Digital signatures for authenticity (private key signs)
The reverse operation proves identity. The sender signs data with their private key, and anyone can verify it with the sender’s public key. If the public key successfully verifies the signature, the data genuinely came from the holder of the private key and has not been altered, because any modification would break the verification. This does not keep the data secret, but it proves who sent it and that it is intact, which is the basis of digital signatures and certificates.
The math behind it
RSA rests on a simple asymmetry in difficulty: it is easy to multiply two large prime numbers together, but extremely hard to factor the resulting product back into those primes. The key pair is generated from two large primes, and the public and private keys are derived from them. An attacker who could factor the public modulus back into its prime factors could reconstruct the private key, but for sufficiently large keys, factoring is computationally infeasible on classical computers. This is why RSA security scales with key length.
RSA Key Lengths
RSA security depends heavily on key length, because a longer key means a larger number to factor. Historically, 1024-bit keys were common, but they are now considered too weak and have been retired. NIST recommends a minimum RSA key length of 2048 bits, and many organizations use 3072-bit or 4096-bit keys for longer-term protection. Against classical computers, RSA-2048 is secure: factoring a 2048-bit key would take far longer than the age of the universe with current technology and known methods. As covered below, quantum computing changes this calculus in a way that adding key length does not solve.
Who Uses RSA?
RSA is embedded throughout modern digital security. Its main applications include:
- Digital certificates and signatures: Certificate authorities have long used RSA to sign certificates, and RSA signatures verify the authenticity of documents and identities.
- Code signing: Software is signed with the developer’s RSA private key so that recipients can verify it is genuine and unmodified.
- TLS/SSL: RSA has been widely used in the TLS handshake that secures HTTPS websites, historically for key exchange and still for authentication.
- Secure email and VPNs: Protocols such as PGP, along with VPNs and secure email, have relied on RSA to exchange keys and verify identity.
RSA Vulnerabilities and Weaknesses
RSA is strong when implemented correctly, but several weaknesses can undermine it, most of them stemming from implementation rather than the core mathematics.
- Insufficient key length: Short keys (such as retired 1024-bit keys) can be factored with enough resources. Key length must keep pace with computing power.
- Weak random number generation: If the primes are generated with a weak random source, they become easier to predict and factor, undermining the key.
- Weak key generation: If the two primes are too close together, or a key parameter is too small, the key becomes much easier to solve for.
- Side-channel attacks: These target the system running RSA rather than the math, using timing, power analysis, or branch prediction to extract the key. Proper implementation and hardware protection (such as an HSM) mitigate them.
RSA in 2026: Still Secure Now, but Quantum-Vulnerable
Is RSA still safe to use? Against today’s classical computers, yes: RSA-2048 and above remain secure, and no quantum computer capable of breaking RSA exists yet. But RSA is fundamentally vulnerable to quantum attack. Shor’s algorithm, run on a large enough fault-tolerant quantum computer, can factor RSA’s modulus efficiently and break the algorithm.
A crucial and often misunderstood point: increasing key length is not a defense against quantum attack. Shor’s algorithm breaks RSA at every key size; moving from RSA-2048 to RSA-4096 only modestly increases the quantum resources required and does not change the outcome or the timeline. The only real fix is to migrate to post-quantum algorithms.
NIST’s draft transition guidance (IR 8547) proposes deprecating quantum-vulnerable public-key algorithms such as RSA after 2030 and disallowing them after 2035. The designated replacements are ML-KEM (FIPS 203) for key establishment and ML-DSA (FIPS 204) for signatures. Because data encrypted today could be captured and decrypted once quantum computers mature (a harvest-now-decrypt-later attack), planning the RSA migration is a present-day task, not a future one.
RSA vs the Post-Quantum Replacements
| Property | RSA | ML-KEM / ML-DSA (post-quantum) |
|---|---|---|
| Type | Asymmetric, factoring-based | Lattice-based (ML-KEM key exchange, ML-DSA signatures) |
| Classical security | Secure at 2048-bit and above | Secure |
| Quantum security | Broken by Shor’s algorithm | Designed to resist quantum attack |
| Standard | Long-standing, widely deployed | FIPS 203 and FIPS 204 (finalized 2024) |
| NIST status | Deprecated after 2030 (draft IR 8547) | Recommended replacement |
For the full picture of the transition, see EC’s resources on post-quantum cryptography, ML-KEM (FIPS 203), and ML-DSA (FIPS 204).
How Encryption Consulting Helps
RSA is deployed almost everywhere, which makes finding and migrating it the central challenge of the post-quantum transition. Encryption Consulting’s Encryption Advisory Services help organizations assess where and how RSA is used, ensure current deployments follow strong key-length and implementation practices, and build a migration plan to post-quantum algorithms aligned to the NIST timeline. Combined with cryptographic inventory, this turns an abstract deadline into a concrete, prioritized roadmap. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.
Frequently Asked Questions
What is RSA in simple terms?
RSA is a widely used encryption method that relies on a pair of keys: a public key that anyone can use to encrypt a message to you, and a private key that only you hold and can use to decrypt it. It is named after its inventors, Rivest, Shamir, and Adleman. RSA’s security comes from the fact that multiplying two large prime numbers is easy, but working backward to find those primes is practically impossible for big enough numbers.
How does RSA encryption work?
RSA works with a mathematically linked public and private key pair. For confidentiality, the sender encrypts data with the recipient’s public key, and only the recipient’s private key can decrypt it. For digital signatures, the sender signs with their private key, and anyone can verify it with the sender’s public key. The security rests on the difficulty of factoring the product of two large prime numbers back into those primes.
Is RSA symmetric or asymmetric?
RSA is asymmetric, meaning it uses two different but mathematically related keys: a public key and a private key. This is different from symmetric encryption like AES, which uses a single shared key for both encryption and decryption. RSA’s asymmetry is what lets it solve the key distribution problem and support digital signatures, though it is much slower than symmetric encryption, so it is typically used to exchange a symmetric key rather than to encrypt large amounts of data.
What key length should RSA use?
NIST recommends a minimum RSA key length of 2048 bits, and many organizations use 3072-bit or 4096-bit keys for longer-term protection. Older 1024-bit keys are considered too weak and have been retired. Against classical computers, RSA-2048 remains secure. However, no RSA key length is safe against a sufficiently powerful quantum computer, so increasing key size is not a substitute for migrating to post-quantum algorithms.
Is RSA still secure in 2026?
Against classical computers, yes. RSA-2048 and larger keys remain secure today, and no quantum computer capable of breaking RSA currently exists. However, RSA is fundamentally vulnerable to quantum attack through Shor’s algorithm. NIST’s draft guidance proposes deprecating RSA after 2030 and disallowing it after 2035. Because encrypted data can be captured now and decrypted later, organizations should begin planning their migration to post-quantum algorithms today rather than waiting.
What will replace RSA?
NIST has standardized post-quantum algorithms to replace RSA. ML-KEM (FIPS 203) replaces RSA for key establishment and key exchange, and ML-DSA (FIPS 204) replaces RSA for digital signatures. These are based on lattice cryptography, which is designed to resist attacks from both classical and quantum computers. During the transition, many systems use hybrid modes that combine RSA with a post-quantum algorithm, so that the connection is protected even if one algorithm is later broken.
Plan Your Move Beyond RSA
RSA is secure today but on a clear countdown, and it is deployed in more places than most organizations realize. Explore Encryption Consulting’s Encryption Advisory Services to find where RSA lives in your environment and build a post-quantum migration plan aligned to the NIST timeline.