rsa

The rsa crate is RustCrypto’s pure-Rust implementation of the RSA public-key cryptosystem, covering key generation, PKCS#1 v1.5 and PSS signing/verification, and OAEP/PKCS#1 v1.5 encryption. It has no dependency on OpenSSL or any other C cryptography library, making it straightforward to build and cross-compile, including to WASM and embedded targets.

As part of the broader RustCrypto organization, it composes with other RustCrypto traits crates (signature, digest, pkcs1, pkcs8) so it interoperates cleanly with the rest of the Rust cryptography ecosystem rather than reimplementing adjacent primitives itself. It also maintains a formal security policy and runs the Marvin Toolkit timing-side-channel test suite to catch RSA-specific timing leaks.

What You Get

• RSA key generation, encoding, and decoding via PKCS#1 and PKCS#8 formats
• PKCS#1 v1.5 and OAEP encryption/decryption schemes
• PKCS#1 v1.5 and PSS signature schemes with support for multiple digest algorithms
• A hazmat module exposing low-level primitives for advanced/custom use cases
• Integration with the RustCrypto signature/digest trait ecosystem for composability
• Wycheproof test-vector coverage and Marvin Toolkit timing-side-channel testing for security validation

Common Use Cases

• Signing and verifying JWTs, certificates, or software artifacts using RSA-PSS or PKCS#1 v1.5
• Encrypting small payloads (session keys, tokens) with RSA-OAEP for hybrid encryption schemes
• Cross-compiling Rust cryptography code to WASM or embedded targets without linking OpenSSL
• Interoperating with existing PKCS#1/PKCS#8-encoded RSA keys from other systems

Under The Hood

Architecture - The crate is organized around key.rs (key generation and representation), pkcs1v15.rs/pkcs1v15/ and pss.rs/pss/ for the two signature schemes, oaep.rs/oaep/ for OAEP encryption, and hazmat.rs for exposing raw primitives to advanced callers who need to build custom padding schemes on top. traits.rs/traits/ define the public interfaces that tie into RustCrypto’s shared signature and digest crates so rsa keys can be used anywhere those traits are expected.

Tech Stack - Pure Rust, no C dependencies; built on crypto-bigint (RustCrypto’s constant-time bignum arithmetic), crypto-primes for prime generation, signature/digest for algorithm-agnostic signing interfaces, and optional pkcs1/pkcs8/serdect integrations for encoding and serde support.

Code Quality - The tests/ directory includes a Wycheproof test-vector suite (wycheproof.rs) — a well-known cross-language cryptographic test corpus — plus dedicated PKCS#1/PKCS#8 encoding tests and property-based tests (proptests.rs) with recorded regression cases. The repo additionally ships a marvin-toolkit/ directory for RSA-specific timing-side-channel analysis and a documented SECURITY.md policy, both unusual and valuable additions for a cryptography crate.

API Design - The API separates high-level, safe-by-default operations (key generation, standard OAEP/PSS/PKCS#1 encrypt-sign-verify calls) from the explicitly-named hazmat module for low-level primitives, signaling clearly to callers which surface requires expert judgment to use safely — a common and appropriate pattern for cryptography libraries.