RSA-2048 Encryption: The Complete Guide

Q: What is the difference between RSA and AES?

RSA is asymmetric encryption — it uses a public/private key pair and is primarily used for key exchange and digital signatures. AES is symmetric encryption — it uses a single shared key and is designed for bulk data encryption. In practice, both are used together: RSA negotiates the AES session key, and AES encrypts the actual data (hybrid encryption).

Q: Is RSA vulnerable to quantum computers?

Yes. Shor's algorithm running on a sufficiently powerful quantum computer can factor the RSA modulus in polynomial time, completely breaking RSA regardless of key size. This is fundamentally different from AES, which only faces a quadratic speedup from Grover's algorithm. For quantum-resistant key exchange, consider ML-KEM (Kyber); for signatures, ML-DSA (Dilithium) or Ed25519.

Q: What RSA key size should I use?

RSA-2048 is the current minimum for general use (secure through ~2030). RSA-3072 is recommended for new systems (128-bit security, comparable to AES-128). RSA-4096 is used for long-lived secrets or classified data. Keys larger than 4096 offer diminishing security returns with rapidly increasing computational cost.

Understand RSA-2048 encryption — how the algorithm works, key sizes, padding schemes (OAEP vs PKCS#1 v1.5), and practical implementation in browsers, Python, and OpenSSL.

November 4, 2026 · 18 min read · Encryption

RSA-2048 is the world’s most widely deployed public-key encryption algorithm. It secures every HTTPS connection, signs digital certificates, enables secure key exchange, and underpins the trust infrastructure of the internet. This guide explains how RSA works at the mathematical level, when to choose RSA over symmetric alternatives, and how to implement it correctly across browsers, Python, and the OpenSSL CLI.

Try the RSA Encrypt/Decrypt tool to generate keys and encrypt data right in your browser — no server, no installation.

A Brief History of RSA

RSA was publicly described in 1977 by Ron Rivest, Adi Shamir, and Leonard Adleman at MIT. It was the first practical public-key cryptosystem, solving the key distribution problem that had plagued symmetric encryption for decades: two parties who have never met can communicate securely without sharing a secret key in advance.

The mathematical foundation — trapdoor functions based on the difficulty of factoring large semiprimes — had been theorized earlier, but RSA was the first to turn it into a complete, usable encryption and digital signature scheme. Today, RSA is embedded in TLS/SSL certificates, SSH protocols, PGP encryption, and smart card systems worldwide.

How RSA Encryption Works

Unlike AES, which uses the same key for encryption and decryption (symmetric), RSA uses a key pair: a public key for encryption and a private key for decryption (asymmetric).

Key Generation

Choose two large random prime numbers, p and q (each ~1024 bits for RSA-2048).
Compute n = p × q. This is the modulus — its bit length defines the “key size” (2048 bits).
Compute λ(n) = lcm(p−1, q−1) (Carmichael’s totient function).
Choose a public exponent e (commonly 65537 = 2¹⁶ + 1, a Fermat prime that balances speed and security).
Compute the private exponent d ≡ e⁻¹ (mod λ(n)).

The public key is (n, e). The private key is (n, d). Security rests entirely on the fact that factoring n back into p and q is computationally infeasible for sufficiently large primes.

Encryption and Decryption

Encrypt:  ciphertext = plaintext^e mod n
Decrypt:  plaintext  = ciphertext^d mod n

RSA can only encrypt data smaller than the modulus (256 bytes for RSA-2048 with OAEP padding). For larger data, a hybrid encryption scheme is used: RSA encrypts a symmetric key, and the symmetric key encrypts the actual data. This is exactly how TLS works.

Digital Signatures

RSA also enables digital signatures: the sender computes a hash of the message, then encrypts that hash with their private key. Anyone with the public key can verify the signature — proving the message was sent by the key holder and hasn’t been tampered with. Try the Digital Signature Verify tool to test this interactively.

RSA Key Sizes: 1024 vs 2048 vs 4096

Key Size	Security Level	Max Encrypted Data (OAEP)	Performance	Status
RSA-1024	~80 bits	128 bytes	Fastest	Broken — 829-bit RSA factored in 2020, never use
RSA-2048	~112 bits	190 bytes	Moderate	Current standard; secure through 2030
RSA-3072	~128 bits	126 bytes	~3x slower than 2048	Recommended for new systems
RSA-4096	~140 bits	62 bytes	~8x slower than 2048	Long-term / classified data

Recommendation: Use RSA-2048 as a minimum. For new systems with no backward compatibility constraints, RSA-3072 provides a 128-bit security margin comparable to AES-128. Generate keys instantly with the RSA Key Generator tool.

RSA vs AES: Why Both Exist

Property	RSA (Asymmetric)	AES (Symmetric)
Key type	Public/private pair	Single shared key
Speed	~1000x slower	Very fast
Max data size	Limited to key size	Unlimited
Primary use	Key exchange, signatures	Bulk data encryption
Quantum resistance	Vulnerable (Shor’s algorithm)	Resistant (Grover’s, 128-bit)

In practice, hybrid encryption combines both: RSA negotiates a shared symmetric key during the TLS handshake, then AES-256-GCM encrypts the actual data. This gives you the key distribution benefits of asymmetric encryption with the performance of symmetric encryption. The AES Encrypt/Decrypt tool supports this workflow — generate an AES key, encrypt your data, then use RSA to protect that key.

Padding Schemes: OAEP vs PKCS#1 v1.5

Raw (“textbook”) RSA — computing m^e mod n directly on plaintext — is deterministic and insecure. The same message always produces the same ciphertext, enabling pattern detection and chosen-ciphertext attacks.

OAEP (Optimal Asymmetric Encryption Padding) adds randomized padding before encryption, making RSA semantically secure (indistinguishable under chosen-plaintext attack). It is the recommended padding scheme for all new implementations.

PKCS#1 v1.5 is an older padding scheme still widely supported for backward compatibility. It is vulnerable to padding oracle attacks (Bleichenbacher’s attack, 1998) if error messages are not handled carefully. Use it only when required by legacy systems.

For digital signatures, the equivalent choices are PSS (recommended) and PKCS#1 v1.5 (legacy).

Hardware Acceleration

RSA operations involve large-number modular exponentiation, which modern processors accelerate through:

AVX2 / AVX-512 vector instructions for multi-precision arithmetic
Montgomery multiplication — an algorithmic optimization that reduces modular multiplication to shift-and-add operations, widely implemented in OpenSSL and BoringSSL
Hardware RNG — secure random number generation for prime selection during key generation

A modern CPU can perform RSA-2048 encryption in ~0.5ms and decryption in ~15ms (decryption is slower because the private exponent d is large). For comparison, AES-256-GCM encryption of the same data size takes ~0.001ms.

RSA Key Formats

RSA keys are stored and transmitted in several standardized formats. Understanding these formats is critical for interoperability between systems.

PEM Format

PEM (Privacy-Enhanced Mail) is the most common format for RSA keys. It’s Base64-encoded DER with human-readable header and footer lines:

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
-----END PUBLIC KEY-----

PEM files use .pem, .crt, .key, or .pub extensions. The header indicates the key type:

BEGIN PUBLIC KEY / BEGIN PRIVATE KEY — PKCS#8 format (algorithm-agnostic)
BEGIN RSA PUBLIC KEY / BEGIN RSA PRIVATE KEY — PKCS#1 format (RSA-specific)

DER Format

DER (Distinguished Encoding Rules) is the binary encoding of the ASN.1 structure. PEM is just Base64-encoded DER with headers. DER files use .der or .cer extensions and are common in Java keystores and Windows certificate stores.

PKCS#1 vs PKCS#8

PKCS#1 (RFC 8017) is RSA-specific. The structure directly stores RSA parameters (modulus n, public exponent e, private exponent d, primes p and q):

RSAPublicKey ::= SEQUENCE {
  modulus           INTEGER,
  publicExponent    INTEGER
}

PKCS#8 (RFC 5208) is algorithm-agnostic. It wraps the PKCS#1 key with an AlgorithmIdentifier header, making it possible to store RSA, ECC, or Ed25519 keys in the same format:

PrivateKeyInfo ::= SEQUENCE {
  version                   Version,
  privateKeyAlgorithm       AlgorithmIdentifier,
  privateKey                OCTET STRING (contains PKCS#1 RSAPrivateKey)
}

Recommendation: Use PKCS#8 for new systems. It’s the modern default in OpenSSL (openssl genpkey), supported by all major libraries, and makes it easier to switch algorithms later if needed.

Converting Between Formats

# PKCS#1 to PKCS#8 (private key)
openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt \
  -in rsa_private_pkcs1.pem -out rsa_private_pkcs8.pem

# PKCS#8 to PKCS#1 (private key)
openssl rsa -in rsa_private_pkcs8.pem -out rsa_private_pkcs1.pem

# PEM to DER
openssl rsa -inform PEM -outform DER -in key.pem -out key.der

# DER to PEM
openssl rsa -inform DER -outform PEM -in key.der -out key.pem

Our RSA Key Generator tool exports keys in PEM format (PKCS#8 by default) and supports both public and private key generation.

When NOT to Use RSA

While RSA remains widely deployed and secure with proper padding, newer systems should seriously consider elliptic curve cryptography (ECC) as the default choice for most use cases.

RSA vs ECC: The Decision Framework

Property	RSA-2048	ECC-256 (Ed25519)
Key size	2048 bits (256 bytes)	256 bits (32 bytes)
Security level	~112 bits	~128 bits
Signing speed	~1,000 ops/sec	~46,000 ops/sec (Ed25519)
Verification speed	~50,000 ops/sec	~15,000 ops/sec (Ed25519)
Signature size	256 bytes	64 bytes (Ed25519)
Key generation	Slow (prime search)	Fast (random scalar)
Quantum resistance	❌ Broken by Shor’s	❌ Broken by Shor’s
Implementation complexity	Moderate (padding oracle risk)	Low (deterministic signing)

Choose RSA When:

Legacy system compatibility — You’re integrating with systems that only support RSA (older HSMs, legacy banking protocols, government systems locked to FIPS 140-2 with RSA-only profiles)
Compliance mandates RSA — Certain regulatory frameworks (some government procurement standards, legacy PCI-DSS implementations) explicitly require RSA for certificate signatures
You need universal TLS certificate support — All certificate authorities issue RSA certificates; ECC certificates are supported but not universally deployed
Encryption of small payloads — RSA-OAEP can encrypt up to 190 bytes (RSA-2048) directly; if you’re only wrapping symmetric keys, RSA is straightforward

Choose ECC (Ed25519 or ECDSA) When:

New SSH deployments — OpenSSH defaults to Ed25519; GitHub and GitLab recommend it for all new keys
Performance-critical applications — ECC signs 46x faster than RSA-2048 (Ed25519) and produces 4x smaller signatures
Mobile or IoT devices — Smaller keys mean less storage, lower bandwidth, and faster operations on constrained hardware
Modern protocols — TLS 1.3, Signal, WhatsApp, and Git commit signing all prefer ECC
Deterministic signing is important — Ed25519 eliminates the nonce-reuse vulnerability that plagues ECDSA and RSA

The Post-Quantum Reality

Both RSA and ECC are vulnerable to quantum computers. Shor’s algorithm can break both in polynomial time. NIST has standardized post-quantum alternatives:

ML-KEM (Kyber) — For key encapsulation (replaces RSA key exchange)
ML-DSA (Dilithium) — For digital signatures (replaces RSA/ECDSA/Ed25519 signatures)

Current estimates from the Global Risk Institute suggest a >50% probability that a quantum computer capable of breaking RSA-2048 will exist within 15 years. If you’re designing systems with data that must remain secure beyond 2035, start planning your migration to post-quantum cryptography now.

Hybrid approach: Use classical algorithms (RSA or ECC) for backward compatibility, combined with post-quantum algorithms (ML-KEM/ML-DSA) for quantum resistance. Our ML-KEM Key Encapsulation and ML-DSA Sign/Verify tools let you experiment with post-quantum cryptography today.

Code Examples

Browser — Web Crypto API

// Generate an RSA-2048 key pair
const keyPair = await crypto.subtle.generateKey(
  {
    name: 'RSA-OAEP',
    modulusLength: 2048,
    publicExponent: new Uint8Array([1, 0, 1]), // 65537
    hash: 'SHA-256',
  },
  true,
  ['encrypt', 'decrypt']
);

// Encrypt data with the public key
const encoded = new TextEncoder().encode('secret message');
const ciphertext = await crypto.subtle.encrypt(
  { name: 'RSA-OAEP' },
  keyPair.publicKey,
  encoded
);

// Decrypt with the private key
const decrypted = await crypto.subtle.decrypt(
  { name: 'RSA-OAEP' },
  keyPair.privateKey,
  ciphertext
);
console.log(new TextDecoder().decode(decrypted));

Python — cryptography library

from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives import hashes

# Generate RSA-2048 key pair
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048,
)
public_key = private_key.public_key()

# Encrypt with OAEP padding
ciphertext = public_key.encrypt(
    b"secret message",
    padding.OAEP(
        mgf=padding.MGF1(algorithm=hashes.SHA256()),
        algorithm=hashes.SHA256(),
        label=None,
    ),
)

# Decrypt
plaintext = private_key.decrypt(
    ciphertext,
    padding.OAEP(
        mgf=padding.MGF1(algorithm=hashes.SHA256()),
        algorithm=hashes.SHA256(),
        label=None,
    ),
)
print("Decrypted:", plaintext.decode())

OpenSSL CLI

# Generate RSA-2048 private key
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
  -out private_key.pem

# Extract public key
openssl rsa -pubout -in private_key.pem -out public_key.pem

# Encrypt a small file with OAEP padding
openssl pkeyutl -encrypt -pubin -inkey public_key.pem \
  -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 \
  -in secret.txt -out encrypted.bin

# Decrypt
openssl pkeyutl -decrypt -inkey private_key.pem \
  -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 \
  -in encrypted.bin -out decrypted.txt

# Create a digital signature
openssl dgst -sha256 -sign private_key.pem -out signature.bin document.pdf

# Verify signature
openssl dgst -sha256 -verify public_key.pem -signature signature.bin document.pdf

Compatibility note: The RSA Encrypt/Decrypt tool supports both OAEP and PKCS#1 v1.5 padding, with automatic detection when decrypting.

Hybrid Encryption: RSA + AES in Practice

RSA can only encrypt data smaller than the modulus (190 bytes for RSA-2048 with OAEP). For larger files or messages, you must use hybrid encryption — combining RSA’s key exchange security with AES’s bulk encryption performance.

The Hybrid Encryption Workflow

Alice wants to send a large file to Bob
Alice generates a random AES-256 session key (32 bytes)
Alice encrypts the file with AES-256-GCM using the session key
Alice encrypts the AES session key with Bob’s RSA public key using OAEP padding
Alice sends Bob both the encrypted file and the encrypted AES key
Bob decrypts the AES key with his RSA private key
Bob decrypts the file with the decrypted AES key

This pattern is used in TLS (RSA key exchange was common in TLS 1.2, though TLS 1.3 prefers (EC)DHE), PGP/GPG email encryption, and secure file transfer protocols.

Code Example: Hybrid Encryption in JavaScript

// Bob generates an RSA key pair and shares his public key with Alice
const bobKeyPair = await crypto.subtle.generateKey(
  { name: 'RSA-OAEP', modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: 'SHA-256' },
  true,
  ['encrypt', 'decrypt']
);

// Alice generates a random AES session key
const aesKey = await crypto.subtle.generateKey(
  { name: 'AES-GCM', length: 256 },
  true,
  ['encrypt', 'decrypt']
);

// Alice encrypts the file with AES-GCM
const iv = crypto.getRandomValues(new Uint8Array(12));
const fileData = new TextEncoder().encode('Large file content...');
const encryptedFile = await crypto.subtle.encrypt(
  { name: 'AES-GCM', iv },
  aesKey,
  fileData
);

// Alice encrypts the AES key with Bob's RSA public key
const encryptedAesKey = await crypto.subtle.encrypt(
  { name: 'RSA-OAEP' },
  bobKeyPair.publicKey,
  await crypto.subtle.exportKey('raw', aesKey)
);

// Alice sends: encryptedFile + encryptedAesKey + iv

// Bob decrypts the AES key with his RSA private key
const decryptedAesKey = await crypto.subtle.decrypt(
  { name: 'RSA-OAEP' },
  bobKeyPair.privateKey,
  encryptedAesKey
);

// Bob imports the decrypted AES key
const importedAesKey = await crypto.subtle.importKey(
  'raw',
  decryptedAesKey,
  { name: 'AES-GCM', length: 256 },
  true,
  ['decrypt']
);

// Bob decrypts the file with AES-GCM
const decryptedFile = await crypto.subtle.decrypt(
  { name: 'AES-GCM', iv },
  importedAesKey,
  encryptedFile
);

The AES Encrypt/Decrypt tool supports this workflow — generate an AES key, encrypt your data, then use RSA to protect that key for secure transmission.

Security Considerations

RSA-2048 is secure against classical factoring attacks when properly padded (OAEP) and when keys are generated with a cryptographically secure random number generator. The largest RSA key factored to date is 829 bits (2020), well below the 2048-bit threshold.
Quantum computing is an existential threat to RSA. Shor’s algorithm can factor the RSA modulus n in polynomial time, completely breaking RSA regardless of key size. Current estimates from the Global Risk Institute suggest a >50% probability that a quantum computer capable of breaking RSA-2048 will exist within 15 years. This is why NIST has standardized post-quantum algorithms (ML-KEM/Kyber for key encapsulation, ML-DSA/Dilithium for signatures). Try the ML-KEM Key Encapsulation and ML-DSA Sign/Verify tools to experiment with quantum-resistant alternatives.
Padding oracle attacks remain a practical threat when RSA is implemented with PKCS#1 v1.5 padding and error messages are distinguishable. Always use OAEP for new implementations, and ensure decryption failures produce identical error responses regardless of the failure mode.
Key management is critical. RSA private keys must be stored securely (HSM, KMS, or encrypted keychain). A leaked 4096-bit private key is worthless if the attacker has direct access to it. Rotate keys on a regular schedule and revoke compromised certificates promptly.

Common Implementation Mistakes

Using textbook RSA (no padding). Raw RSA (c = m^e mod n) is deterministic — the same plaintext always produces the same ciphertext. This leaks patterns and enables chosen-ciphertext attacks. Always use OAEP padding.
Encrypting large data directly with RSA. RSA can only encrypt data smaller than the modulus (256 bytes for RSA-2048 with OAEP: 256 − 42 bytes of padding overhead = 214 bytes max). For files or messages, use hybrid encryption: generate a random AES key, encrypt the data with AES-GCM, then encrypt the AES key with RSA.
Using RSA-1024 or smaller. RSA-1024 has been factored by academic researchers and provides less than 80 bits of security. Never use keys smaller than 2048 bits.
Weak random number generation during key creation. RSA key security depends entirely on the primes p and q being unpredictable. Using a weak or predictable PRNG (e.g., seeded with timestamp) allows attackers to reproduce your key. Always use the OS cryptographic RNG (/dev/urandom, crypto.getRandomValues()).
Reusing primes across keys. If two RSA keys share a common prime factor (due to bad RNG), an attacker can compute GCD(n₁, n₂) to instantly factor both keys. This has happened in the wild with IoT devices using default or poorly seeded random generators.

Frequently Asked Questions

Is RSA-2048 still secure in 2026?

Yes, RSA-2048 with OAEP padding remains secure against all known classical attacks. The largest RSA modulus factored to date is 829 bits (RSA-255, achieved in 2020). However, RSA-2048 provides only ~112 bits of security, which NIST considers acceptable through 2030 but not beyond. For new systems, RSA-3072 (128-bit security) is preferred.

What is the difference between RSA and AES?

RSA is asymmetric encryption — it uses a public/private key pair and is primarily used for key exchange and digital signatures. AES is symmetric encryption — it uses a single shared key and is designed for bulk data encryption. In practice, both are used together: RSA negotiates the AES session key, and AES encrypts the actual data (hybrid encryption).

Is RSA vulnerable to quantum computers?

Yes. Shor’s algorithm running on a sufficiently powerful quantum computer can factor the RSA modulus in polynomial time, completely breaking RSA regardless of key size. This is fundamentally different from AES, which only faces a quadratic speedup from Grover’s algorithm. For quantum-resistant key exchange, consider ML-KEM (Kyber); for signatures, ML-DSA (Dilithium) or Ed25519.

Where is RSA used in practice?

RSA is embedded in TLS/SSL (key exchange and certificate signatures), SSH (host key authentication), PGP/GPG (email encryption), digital certificates (X.509 PKI), smart cards, and code signing. However, TLS 1.3 has deprecated RSA key transport in favor of (EC)DHE key exchange — RSA signatures on certificates remain standard.

What RSA key size should I use?

RSA-2048 is the current minimum for general use (secure through ~2030). RSA-3072 is recommended for new systems (128-bit security, comparable to AES-128). RSA-4096 is used for long-lived secrets or classified data. Keys larger than 4096 offer diminishing security returns with rapidly increasing computational cost.

How often should RSA keys be rotated?

Best practice is to rotate RSA keys every 1–2 years for active TLS/SSL certificates, and every 3–5 years for internal key pairs used for encryption or signing. Shorter rotation periods reduce the window of exposure if a key is compromised. Automated certificate management (e.g., Let’s Encrypt with 90-day certificates) makes frequent rotation practical.

RSA Encrypt/Decrypt — Generate RSA keys, encrypt and decrypt text with OAEP or PKCS#1 v1.5 padding, all in your browser. Supports PEM key import/export.
RSA Key Generator — Generate RSA key pairs (2048, 3072, 4096 bits) with configurable public exponent. Export in PEM, DER, or JWK format.
ECC Key Generator — Generate elliptic curve key pairs (P-256, P-384, secp256k1). ECC provides equivalent security to RSA with much smaller key sizes (256-bit ECC ≈ 3072-bit RSA).
AES Encrypt/Decrypt — Symmetric encryption with AES-128/192/256 in GCM, CBC, and CTR modes. Use RSA to exchange the AES session key in hybrid encryption workflows.
Digital Signature Verify — Create and verify RSA or ECDSA digital signatures. Supports PKCS#1 v1.5 and PSS padding schemes.

Related Tools

RSA Encrypt / Decrypt

Try it now →

RSA Key Generator

Try it now →

ECC / ECDSA Key Generator

Try it now →

Digital Signature & Verify

Try it now →

AES Encrypt/Decrypt

Try it now →

A Brief History of RSA

How RSA Encryption Works

Key Generation

Encryption and Decryption

Digital Signatures

RSA Key Sizes: 1024 vs 2048 vs 4096

RSA vs AES: Why Both Exist

Padding Schemes: OAEP vs PKCS#1 v1.5

Hardware Acceleration

RSA Key Formats

PEM Format

DER Format

PKCS#1 vs PKCS#8

Converting Between Formats

When NOT to Use RSA

RSA vs ECC: The Decision Framework

Choose RSA When:

Choose ECC (Ed25519 or ECDSA) When:

The Post-Quantum Reality

Code Examples

Browser — Web Crypto API

Python — cryptography library

OpenSSL CLI

Hybrid Encryption: RSA + AES in Practice

The Hybrid Encryption Workflow

Code Example: Hybrid Encryption in JavaScript

Security Considerations

Common Implementation Mistakes

Frequently Asked Questions

Is RSA-2048 still secure in 2026?

What is the difference between RSA and AES?

Is RSA vulnerable to quantum computers?

Where is RSA used in practice?

What RSA key size should I use?

How often should RSA keys be rotated?

Related Tools

Further Reading

Related Articles

Related Tools