I checked RSA's patent application, which was registered in 1983. As patents don't last more than 20 years, it seems to me it should be free. But my friend said to use RSA I have to buy a license from MIT. Is it true ?
You are correct, anyone can use it without asking for permission or paying anybody. The RSA patent US 4,405,829 expired in 2000, and the RSA algorithm was never patented anywhere else (because the rest of the world won't allow you to patent something that has already been published; the US gives you a year).