RustCrypto: RSA
A portable RSA implementation in pure Rust, with encryption and signature schemes specified in PKCS#1 v2.2 (RFC8017).
| Scheme | Purpose | Specification |
|---|---|---|
| RSAES-OAEP | Encryption | RFC8017 §7.1 |
| RSAES-PKCS1-v1_5 | Encryption | RFC8017 §7.2 |
| RSASSA-PSS | Signatures | RFC8017 §8.1 |
| RSASSA-PKCS1-v1_5 | Signatures | RFC8017 §8.2 |
PKCS#1 v1.5 is provided as opt-in through feature pkcs1v15 for compatibility
with legacy applications only. Prefer OAEP and PSS for new applications.
See the security warning below for known implementation vulnerabilities.
use rsa::{Generate, PrivateKey, sha2::Sha256};
let private_key = PrivateKey::generate();
let public_key = private_key.to_public_key();
// Encrypt
let data = b"hello world";
let enc_data = public_key.oaep_encrypt::<Sha256>(data).expect("failed to encrypt");
assert_ne!(&data[..], &enc_data[..]);
// Decrypt
let dec_data = private_key.oaep_decrypt::<Sha256>(&enc_data).expect("failed to decrypt");
assert_eq!(&data[..], &dec_data[..]);Note: If you encounter unusually slow key generation time while using
RsaPrivateKey::newyou can try to compile in release mode or add the following to yourCargo.toml. Key generation is much faster when building with higher optimization levels, but this will increase the compile time a bit.[profile.debug] opt-level = 3
Though this crate has been previously audited the implementation has diverged significantly since then, and several security issues have been discovered which have been resolved in the 0.10 release.
See the open security issues on our issue tracker for other known problems. This crate was previously vulnerable to the Marvin Attack which could enable private key recovery by a network attacker (see RUSTSEC-2023-0071).
You can follow our work on constant-time hardening in #711.
Users are advised to migrate to 0.10 in order to avoid the discovered side channels.
Additionally legacy PKCS#1 1.5 implementations, including the implementation of it within this crate, has seen a long running source of Bleichenbacher and Marvin Attacks related vulnerabilities.
For this reason, users who require the use of this legacy padding scheme i.e.
in legacy protocols must explicitly enable the pkcs1v15 feature to use it.
MSRV increases are not considered breaking changes and can happen in patch releases.
The crate MSRV accounts for all supported targets and crate feature combinations.
Licensed under either of
at your option.
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.