RSA Encryption Complete Guide
What's RSA encryption?
RSA is the most widely used asymmetric encryption algorithm by Ron Riverst, Adi Shamir and Leonard Adleman in 1977 Yearly invention (the algorithm is taken from the initials of the three names). The safety of RSA is based on the difficulty of calculating large integers.
Asymmetric encryption working principles
Unlike the AES equivalent encryption, RSA uses a pair of keys:
-
Public key:
It's open to sharing. Anyone can encrypt information with a public key.
-
Private key:
It must be strictly confidential. Only private keyholders can decrypt it.
Data encrypted with public key can only be decrypted with the corresponding private key, and vice versa. This makes it possible for secure communications to be made public by the recipient, which is encrypted by the sender with the public key and which can be decrypted only by the recipient with the private key.
RSA-OAEP mode
This tool uses RSA-OAEP (Optimal Asymmetric Encryption Pading), this is RSA Encryption recommended security mode, compared to old PKCS#1 v1.5 fill, OAEP Resisting from multiple attacks is a recommended option for modern safety standards.
Algorithm: RSA-OAEP Key Length: 2048 bit Hash: SHA-256 Output Format: Base64
Key Length Selection
2048 bits:
Current mainstream security standards, recommended for most scenarios, are expected to be safe by 2030.
4096 bits:
Higher security, but the encryption/declassification is significantly slower and suitable for long-term sensitive data.
RSA limitations
RSA can encrypt data of limited length. RSA-OAEP (SHA-256) for 2048 keys can only be encrypted at most about 190 bytes.
In practical applications, hybrid encryption is used: large amounts of data are encrypted using a symmetric algorithm like AES, and then with RSA encryption is used for AES Key.
Practical application scene
- Key exchange in HTTPS/TLS connection
- Digital signature and certificate authentication
- SSH Key Authentication
- Mail Encryption (PGP/GPG)
- Code signature and software distribution
Recommendations for safe use
- Private key must be stored securely offline and never shared
- Change key pairs on a regular basis (at least once a year)
- Do not generate or use keys on untrustworthy devices
- Use of certified hardware security module (HSM) for critical scenes