RSA Explained: How It Works, Uses, Security, and Limitations

Introduction

Few cryptographic algorithms have shaped the internet as much as RSA.

If you have used HTTPS, verified software updates, or worked with digital certificates, you have almost certainly relied on RSA somewhere in the background. It is one of the best-known public-key cryptosystems and remains deeply embedded in enterprise security, PKI, code signing, and legacy infrastructure.

At the same time, RSA is no longer the default answer for every cryptographic problem. Modern systems often favor elliptic-curve cryptography such as ECC, ECDSA, Ed25519, and X25519 for efficiency, and they use symmetric ciphers like AES or ChaCha20 for actual data encryption. Hash functions such as SHA-256, SHA-3, and Keccak also serve a completely different role.

This guide explains what RSA is, how it works, when it should be used, when it should not be used, and what security practices matter most today.

What is RSA?

Beginner-friendly definition

RSA is a public-key cryptography algorithm used for encryption, digital signatures, and secure key exchange in older designs. It uses two keys:

• a public key that can be shared
• a private key that must be kept secret

That lets one party encrypt data for another or verify that a message or software package was signed by the right party.

Technical definition

RSA is an asymmetric cryptographic algorithm based on modular arithmetic over a composite integer modulus. A standard RSA keypair is built from two large prime numbers. Its security is closely tied to the difficulty of factoring the modulus and to the hardness assumptions used by the specific RSA scheme.

In practice, RSA is not just “the math.” Real security depends on:

• secure key generation
• proper padding
• strong hash functions
• safe implementation
• sound key management

Why it matters in the broader cryptography ecosystem

RSA is foundational, but it is only one part of the cryptography stack.

• AES, ChaCha20, Salsa20, Blowfish, Twofish, Serpent, Camellia, DES, Triple DES, 3DES, RC4, RC5, and RC6 are encryption algorithms, mostly symmetric rather than asymmetric.
• SHA-256, SHA-3, Keccak, Whirlpool, MD5, and SHA-1 are hash functions, not encryption algorithms.
• HMAC and Poly1305 are message authentication mechanisms.
• Bcrypt, Argon2, PBKDF2, and Scrypt are password hashing or key derivation tools.
• Diffie-Hellman, X25519, ECC, ECDSA, and Ed25519 are closely related public-key concepts and alternatives.

RSA still matters because it remains widely supported, well understood, and heavily used in certificates and signatures. But it is no longer the most efficient option for many new systems.

How RSA Works

Step-by-step explanation

At a high level, RSA works by creating a mathematical link between a public key and a private key.

1) Generate two large prime numbers

Choose two large primes, usually called p and q.

2) Multiply them to create the modulus

Compute:

n = p × q

This modulus n is part of both the public and private key.

3) Compute the totient-related value

A common form uses:

φ(n) = (p – 1)(q – 1)

Some implementations use λ(n) instead. The exact formulation depends on the scheme.

4) Choose a public exponent

Pick a number e that is valid relative to φ(n) or λ(n).
A common public exponent is 65537 because it is efficient and has good practical properties.

5) Compute the private exponent

Find d such that:

d × e ≡ 1 mod φ(n)
or mod λ(n), depending on the formulation.

Now you have:

• Public key: (n, e)
• Private key: (d) plus usually the prime factors or CRT parameters for faster decryption/signing

6) Encrypt or verify with the public key

The public key is used to:

• encrypt data in RSA encryption schemes
• verify digital signatures in RSA signature schemes

7) Decrypt or sign with the private key

The private key is used to:

• decrypt data encrypted with the public key
• create signatures that others can verify

Simple toy example

A classic teaching example uses very small primes.

• p = 61
• q = 53
• n = 3233
• φ(n) = 3120
• e = 17
• d = 2753

If the message is represented by the number 65, then:

• encryption gives 2790
• decryption recovers 65

This example is useful for intuition only. Real RSA uses much larger numbers and secure padding. Tiny-key RSA is completely insecure.

Technical workflow in real systems

Modern RSA is almost never used as “raw RSA.”

For encryption

A secure system typically uses RSA-OAEP:

1. Generate a random symmetric session key.
2. Encrypt the actual data with AES or ChaCha20.
3. Encrypt the session key with the recipient’s RSA public key.
4. Send both to the recipient.
5. The recipient decrypts the session key with the RSA private key, then decrypts the data.

This is called hybrid encryption. It is far more practical than trying to encrypt large files directly with RSA.

For signatures

A secure system typically uses RSA-PSS:

1. Hash the message with a function such as SHA-256 or SHA-3.
2. Apply the PSS encoding scheme.
3. Sign with the RSA private key.
4. Verify with the RSA public key.

Important: RSA signs the structured hash input, not the raw message directly in modern practice.

Key Features of RSA

RSA stands out for a few reasons.

Public-key design

It solves a core problem symmetric cryptography cannot solve by itself: how to communicate securely without sharing a secret key first.

Supports both encryption and signatures

Some algorithms are mainly for encryption, some for key exchange, and some for signatures. RSA can support multiple roles, though not always as the best choice in each.

Deep ecosystem support

RSA is supported by:

• PKI systems
• TLS certificates
• enterprise HSMs
• smart cards
• code signing tools
• major cryptographic libraries

Mature standards and interoperability

RSA has decades of analysis, implementation experience, and standards guidance. That does not make it mistake-proof, but it does make it familiar.

Larger keys and slower performance

RSA security comes with relatively large key sizes and slower operations compared with many ECC-based systems.

Types / Variants / Related Concepts

RSA is often discussed too broadly. It helps to separate the actual variants and nearby concepts.

RSA encryption

Used to protect small pieces of data, usually symmetric keys rather than full files or streams.

RSA signatures

Used to prove authenticity and integrity. Common in certificates, document signing, and software distribution.

RSA-OAEP

The preferred padding method for RSA encryption in modern designs.

RSA-PSS

The preferred modern scheme for RSA signatures.

PKCS#1 v1.5

A legacy padding/signature format still seen in compatibility scenarios. It should be handled carefully and avoided for new designs where stronger options exist.

RSA key exchange

Historically used in older TLS designs. It is now largely replaced by ephemeral Diffie-Hellman and X25519 because those provide forward secrecy.

Related algorithm families

To avoid confusion:

• AES, ChaCha20, Salsa20, Blowfish, Twofish, Serpent, and Camellia are for symmetric encryption.
• SHA-256, SHA-3, and Whirlpool are hash functions.
• Keccak is the algorithm family behind SHA-3; in blockchain discussions, “Keccak-256” may refer to a variant distinct from standardized SHA-3-256.
• MD5 and SHA-1 are legacy hashes that should not be used for new RSA signature designs.
• HMAC and Poly1305 provide authentication, not public-key signatures.
• Bcrypt, Argon2, PBKDF2, and Scrypt are for password hashing and key derivation.
• ECC, ECDSA, Ed25519, and X25519 are modern elliptic-curve approaches often preferred for new systems.

Benefits and Advantages

RSA still offers real value when used correctly.

Strong interoperability

If you need compatibility across enterprise products, legacy infrastructure, or certificate ecosystems, RSA is often the easiest option.

Good fit for digital identity systems

RSA works well in environments where public keys must be widely distributed and trusted through certificate chains.

Mature operational tooling

Security teams already know how to:

• issue RSA certificates
• store RSA keys in HSMs
• audit RSA usage
• revoke and rotate RSA credentials

Practical for signatures and key wrapping

RSA remains useful for:

• code signing
• document signing
• certificate signing
• wrapping symmetric keys in controlled environments

Helpful in crypto infrastructure, even if not on-chain

Most blockchains do not use RSA for wallet signatures. But exchanges, custodians, validators, and wallet companies may still use RSA in off-chain enterprise security, internal PKI, admin access, and software release workflows.

Risks, Challenges, or Limitations

RSA is powerful, but it has clear drawbacks.

It is inefficient for bulk encryption

RSA is too slow and too size-constrained for large data encryption. Use AES or ChaCha20 for the data itself.

Key sizes are large

RSA needs much larger keys than ECC-based systems to reach comparable practical security levels. That means larger certificates, signatures, and more computational overhead.

Padding mistakes can be catastrophic

Textbook RSA is insecure. Incorrect padding or legacy handling can introduce vulnerabilities, including padding oracle attacks.

Legacy hashes create signature risk

Using MD5 or SHA-1 with RSA in new systems is a bad idea. Collisions in those hashes undermine trust in signature workflows.

No forward secrecy in static RSA key transport

Older RSA-based TLS key exchange did not provide the same forward secrecy properties as ephemeral Diffie-Hellman or X25519-based designs.

Implementation risk

Even mathematically sound RSA can fail because of:

• weak random number generation
• poor prime generation
• side-channel leakage
• bad key storage
• unsafe library use
• missing blinding or constant-time protections

Quantum risk

A sufficiently capable fault-tolerant quantum computer could break RSA using Shor’s algorithm. The timeline for real-world impact is uncertain, so organizations should monitor post-quantum guidance and verify current source for policy decisions.

Limited relevance for most blockchain wallets

Bitcoin, Ethereum, Solana, and many other crypto ecosystems rely on elliptic-curve signatures, not RSA. That is because RSA is typically less efficient and less practical for constrained transaction formats and high-volume verification.

Real-World Use Cases

Here are practical places where RSA appears today.

1. HTTPS certificates and web PKI
   RSA is still widely used in certificate chains and server authentication, even as key agreement has shifted toward ECDHE and X25519.

2. Code signing and software updates
   Wallet applications, exchange apps, desktop clients, and enterprise software may use RSA signatures to prove that a release is authentic.

3. Email security and file protection
   Tools like PGP/GPG and S/MIME can use RSA for encryption and signatures.

4. Document signing
   RSA can be used in digital document workflows where authenticity and non-repudiation matter.

5. Enterprise PKI and internal identity systems
   Large organizations often use RSA in internal certificate authorities, VPN access, device identity, and machine-to-machine trust.

6. Hardware security modules and key management systems
   RSA key wrapping, certificate operations, and controlled signing workflows are common in HSM-backed deployments.

7. SSH and administrative access
   Some environments still use RSA SSH keys, though many teams now prefer Ed25519 for new setups.

8. Crypto exchange and custody infrastructure
   Even when customer wallets use ECDSA or Ed25519, backend services may rely on RSA for certificates, admin authentication, release signing, and segmented internal trust.

RSA vs Similar Terms

Term	Category	Main Purpose	Best Use Case	Key Difference from RSA
RSA	Asymmetric cryptography	Encryption, signatures, legacy key transport	PKI, certificates, code signing, key wrapping	Mature and compatible, but larger and slower than modern elliptic-curve options
AES	Symmetric encryption	Fast bulk data encryption	Disk, database, network, file encryption	AES uses one shared secret key and is not a public-key system
ECC	Public-key cryptography family	Signatures, encryption, key agreement	Modern constrained and high-performance systems	Similar goals to RSA, but typically smaller keys and better efficiency
Diffie-Hellman / X25519	Key agreement	Securely establish shared secrets	TLS, messaging, secure sessions	Designed for key exchange, not direct document-style signatures like RSA
Ed25519	Signature algorithm	Fast, modern digital signatures	Wallets, SSH, software signing, modern protocols	Signature-focused, compact, and widely favored over RSA for new designs

The practical takeaway

• Use RSA, ECC, Ed25519, or ECDSA for identity and signatures, depending on the ecosystem.
• Use Diffie-Hellman or X25519 for key agreement.
• Use AES or ChaCha20 for actual data encryption.
• Use SHA-256 or SHA-3 for hashing.
• Use Argon2, Bcrypt, PBKDF2, or Scrypt for passwords.

Best Practices / Security Considerations

If you use RSA, a few rules matter more than everything else.

Use vetted libraries only

Do not implement RSA from scratch unless you are doing audited research work. Use mature libraries and follow their safe defaults.

Use modern padding

• For encryption: RSA-OAEP
• For signatures: RSA-PSS

Avoid raw RSA. Avoid ad hoc padding. Treat legacy PKCS#1 v1.5 use as compatibility-driven, not ideal.

Use strong hash functions

For new systems, prefer:

• SHA-256
• SHA-384
• SHA-3 variants where appropriate

Do not build new RSA signature flows on MD5 or SHA-1.

Use hybrid encryption

Encrypt the data with AES or ChaCha20, then use RSA to protect the symmetric key. This is standard practice.

Choose sensible key sizes

A 2048-bit RSA key is commonly treated as a practical minimum today. Some environments prefer 3072-bit or higher for longer security margins or compliance reasons. Exact requirements vary by industry and jurisdiction, so verify with current source.

Protect private keys properly

Use:

• HSMs
• KMS services
• hardware tokens
• strict access control
• audited key rotation and revocation

Harden against side channels

Where performance matters, use constant-time implementations, RSA blinding, and hardened runtimes.

Do not use RSA key exchange in new protocol designs

For new transport protocols, prefer ephemeral Diffie-Hellman or X25519 for forward secrecy.

Separate blockchain keys from infrastructure keys

Do not mix customer wallet signing keys with web PKI or internal admin credentials. Even if both involve cryptography, the risk models are different.

Common Mistakes and Misconceptions

“RSA is a hashing algorithm.”

It is not. RSA is a public-key algorithm. SHA-256, SHA-3, and Keccak are hash functions.

“RSA and AES do the same thing.”

They do not. RSA is asymmetric. AES is symmetric. In real systems, they often work together.

“RSA can efficiently encrypt any file directly.”

Not in a sensible modern design. RSA is usually used to encrypt a symmetric key, not the whole file.

“If the key is big enough, RSA is automatically secure.”

No. Bad padding, weak randomness, leaked private keys, side-channel flaws, and old hashes can still break the system.

“RSA is obsolete.”

That is too simplistic. RSA is still widely deployed and useful, especially in PKI and compatibility-heavy environments. But it is no longer the best default for every new project.

Who Should Care About RSA?

Developers

If you build authentication, APIs, wallet software, enterprise backends, or secure update systems, you need to know where RSA fits and where it does not.

Security professionals

RSA still appears in certificate management, incident response, key audits, HSM workflows, and cryptographic migration planning.

Enterprises

Organizations with large PKI estates, legacy applications, compliance requirements, and cross-vendor compatibility often still depend on RSA.

Crypto businesses

Exchanges, custodians, infrastructure providers, and wallet companies may not use RSA on-chain, but they still encounter it in backend identity, signing, and release security.

Advanced learners

RSA is one of the best algorithms for understanding the difference between encryption, signatures, hashing, and key management.

Investors and power users

If you evaluate custodians, exchanges, or wallet providers, a basic understanding of RSA helps you distinguish real security architecture from vague marketing claims.

Future Trends and Outlook

RSA is unlikely to disappear quickly.

Its installed base is large, especially in certificates, enterprise PKI, and long-lived infrastructure. Many organizations will keep RSA for compatibility for years, even while deploying newer algorithms elsewhere.

At the same time, the direction of modern design is clear:

• ECC, Ed25519, and X25519 are favored in many new applications
• AES-GCM and ChaCha20-Poly1305 dominate practical data encryption
• SHA-256 and SHA-3 remain core hashing choices
• post-quantum migration planning is becoming more relevant

The most realistic outlook is not “RSA vanishes” or “RSA wins forever.” It is a transition story. RSA will remain important in legacy and interoperability-heavy environments, while new systems increasingly choose more efficient alternatives and prepare for post-quantum standards. Exact timelines and policy shifts should be verified with current source.

Conclusion

RSA is one of the most important algorithms in the history of modern cryptography. It introduced a practical public-key model that still powers certificates, signatures, and enterprise trust systems around the world.

But using RSA well requires precision. It is not a hash function, not a password hasher, and not a good tool for bulk encryption. For modern deployments, the right approach is usually RSA for compatibility-heavy identity and signing tasks, AES or ChaCha20 for data encryption, SHA-256 or SHA-3 for hashing, and ECC or X25519-style tools where performance and modern protocol design matter.

If you are building or auditing a system, the next step is simple: identify exactly what role RSA is playing, confirm that modern padding and key management are in place, and decide whether RSA is the right long-term choice for that role.

FAQ Section

1) What does RSA stand for?

RSA stands for Rivest, Shamir, and Adleman, the three researchers who introduced the algorithm.

2) Is RSA encryption or hashing?

RSA is asymmetric cryptography, not hashing. It is used for encryption and digital signatures. Hashing is handled by algorithms like SHA-256 or SHA-3.

3) Is RSA still secure in 2026?

Yes, when properly implemented with modern padding, strong keys, and safe key management. Exact policy requirements and approved key sizes should be verified with current source.

4) What key size should RSA use?

2048-bit is commonly considered the minimum practical size today. Some organizations use 3072-bit or higher depending on risk tolerance, compliance, and system lifetime.

5) Can RSA encrypt large files?

Not efficiently. In practice, RSA encrypts a symmetric session key, and that key is then used with AES or ChaCha20 to encrypt the actual file.

6) What is the difference between RSA and AES?

RSA is asymmetric and uses a public/private keypair. AES is symmetric and uses one shared secret key. They solve different problems and are often used together.

7) How does RSA compare with ECC or Ed25519?

RSA is older, very compatible, and widely supported. ECC and Ed25519 usually provide smaller keys, smaller signatures, and better performance in modern systems.

8) Does TLS still use RSA?

RSA is still used in many certificates and authentication flows, but modern TLS prefers ephemeral key exchange such as ECDHE or X25519 for forward secrecy. TLS 1.3 does not use classic RSA key exchange.

9) What are OAEP and PSS?

OAEP is a modern padding scheme for RSA encryption. PSS is a modern padding/signature scheme for RSA signatures. Both are preferred over older or raw RSA usage.

10) Why do most blockchain wallets not use RSA?

Most blockchains use elliptic-curve signatures such as ECDSA or Ed25519 because they are more compact and efficient for wallet and transaction systems.

Key Takeaways

• RSA is a foundational public-key cryptography algorithm used for encryption, signatures, and certificate-based trust.
• In modern systems, RSA is usually used for signatures or key wrapping, not for encrypting large amounts of data.
• RSA should be paired with modern standards such as OAEP, PSS, and strong hashes like SHA-256 or SHA-3.
• AES and ChaCha20 are for bulk encryption; RSA is not a replacement for them.
• ECC, Ed25519, and X25519 often outperform RSA in new designs, especially where efficiency matters.
• RSA remains highly relevant in PKI, TLS certificates, code signing, HSM workflows, and enterprise infrastructure.
• Weak padding, poor randomness, old hashes like MD5 or SHA-1, and bad key storage are common RSA failure points.
• RSA is generally not the standard choice for blockchain wallet signatures, even if it still appears in off-chain crypto infrastructure.
• Quantum computing is a long-term strategic risk for RSA, so organizations should monitor post-quantum migration guidance.
• The right question is not “Is RSA good or bad?” but “Is RSA the right tool for this exact security job?”