Is it alright to generate RSA keys with bit sizes other than 512/1024/2048?

Question

I am keep generating RSA keys for 512/1024/2048/4096... as bit size. Each time the key length is increasing.

Is it possible to generate/use keys other than the above bit sizes. Let us say 800/1000/2000/...

Am I missing any theory behind ?

Answer 1

RSA allows any key size, as the calculations are performed using big unsigned integers. The modulus size in bits specifies the key size.

However, many implementations do have limitations. Many libraries will at least require a modulus that is a multiple of 8 bits, but ones that only allow 32 bit increments or even only specific key sizes are not uncommon. If specific key sizes are used then those are generally powers of two (as the ones you've mentioned), or the addition of two subsequent powers of two (e.g. 2048 + 1024 = 3072 bits).

It makes sense that hardware implementations have maximum key sizes. Implementations may will also often require a minimum key size - it is debatable if that kind of check should be performed at the algorithm implementation level though; I'm personally not in favor of it.

Usually standards will use those kind of key sizes, but sometimes other options are used, e.g. 1792 bits (1024 + 512 + 256 = 1792) or 1920 bits (1024 + 512 + 256 + 128) for smart card operations where a 2048 bit ciphertext or signature will not fit into one (protected) Application Protocol Data Unit (APDU). As you can see, they will try and stay as close to multiples of some power of two as possible.

---

Note that PKCS#1 has been defined to encode both the modulus and exponent but also the ciphertext / signature as bytes (or octets). Still, the padding modes defined in there should work even if the modulus isn't a multiple of 8.

One thing to keep in mind is that the private exponent is basically a random value between 0 and the modulus. In all likelihood it is close to the modulus in size, but it may be one or more bytes smaller when encoded to the minimum number of bytes.