# What prime lengths are used for RSA?

Let's assume we have an RSA 2048 that was produced by two primes multiplication. What is the digit's difference in those 2 factors? For example one prime is 1024 digits and second one 1024 or, one is 900 and second one 1148? Are there any limits for primes that could be used in RSA or it could be "1" and a 2048 bit prime?

• I very much depends on what security recommendation was followed when generating the 2048-bit modulus. If that's FIPS 186-4 (a very common choice), then the factors $p$ and $q$ must each be exactly 1024-bit (further, each factor must be at least $2^{1023.5}$). – fgrieu Feb 17 '15 at 7:35
• Good luck implementing RSA with $p =1$... – user4686 Feb 17 '15 at 7:54
• what is estimated primes quantity of 1024 bits are there? – user23124 Feb 22 '15 at 17:41
• A common assumption is equal length, $q<p<2q$ or at most a length difference of $1$. But that is not really a question about security, it is more about the policy for the usage of RSA. Allowing uneven factors is a potential security risk, because "small factors" can be found more easily. In general, the factoring problem scales with the smallest prime factor, not with the total length. Multiplying $2^{1000000}$ to any RSA modulus does not make it harder to factor. – tylo Mar 19 '15 at 15:59
• In order to get an answer to this, head there. – fgrieu Mar 22 '15 at 10:41

When you multiply an $n$-bit integer by an $m$-bit integer, the product is an $(m+n-\epsilon)$-bit integer, with $\epsilon \leq 1$.
There is also another suggestion from Shamir about generation of RSA keys for paranoid, which recommends for example a prime $p$ of say $1000$ bits and the other prime $q$ of $5000$ bits.