RSA

RSA is a method that allows two parties to communicate securely without having previously agreed on a shared secret. It works with two keys: a public one, which anyone may see, and a private one, known only to the recipient. Anyone who wants to send a message encrypts it with the public key. Only whoever holds the matching private key can then decrypt it. The name stands for the surnames of the three mathematicians who published the method in 1977: Ron Rivest, Adi Shamir, and Leonard Adleman.

Why RSA secures the internet

Before RSA, there was a fundamental problem: if two people wanted to communicate securely, they first had to agree on a secret code. That’s easy if they can meet in person — but impossible if they’ve never encountered each other. RSA solves this problem because the public key can be transmitted without any danger. Nobody who intercepts it can use it to decrypt messages.

The method also enables digital signatures. Here, the order is reversed: the sender encrypts a piece of information with their private key. Anyone who knows the public key can verify whether the signature is genuine. This makes it possible to prove that a message really did come from a specific person — without that person revealing their secret.

The mathematical foundation of RSA

RSA is built on a simple observation: multiplying two large prime numbers together is easy. Factoring the result back into its prime factors, however, is extremely difficult. Even for numbers with a few hundred digits, even fast computers would need many millions of years. It is precisely this difficulty that protects the private key.

In practice, one first chooses two random, very large prime numbers and multiplies them. From this product and further computational steps, the public and private keys are derived. Key length is specified in bits — today, 2048 bits is considered the minimum standard, while 4096 bits is considered especially secure. The more bits, the larger the numbers, and the harder the attack.

A common misconception is that RSA is used to encrypt entire sets of data. That’s not true. RSA is slow and therefore only suitable for small amounts of data, such as exchanging a further, symmetric key. This symmetric key then takes over the actual work and encrypts, for example, the content of a webpage. RSA is thus more like the secure envelope for the secret — not the secret itself.

RSA in products and current debates

Every time a browser establishes a secure connection — recognizable by the “https” in the address bar — RSA or a related method is involved. Email encryption, software updates, and secure logins on servers also rely on RSA or are conceptually built upon it.

In financial news, RSA mainly comes up in two contexts. First: quantum computers, meaning machines based on different physical principles than ordinary processors, could one day solve the factorization problem quickly and thereby break RSA. That’s why authorities and companies worldwide are working on successor methods that remain secure even against quantum attacks — so-called post-quantum cryptography. Second, RSA comes up when data breaches or certificate errors lead to private keys being compromised: in such cases, it is not the method that has been broken, but the implementation that was flawed.