Why is RSA-2048 max input 245 bytes?

Question

I can see that the message (after padding) should not be 256 bytes because it might be bigger than the modulus of RSA. So I think that the message should be 255 bytes, but I saw posts that says the maximum input is 245 bytes. Why is that?

Answer 1

This is due to RSA with PKCS#1 v1.5 padding, as defined in section 7.2 of RFC 3447 (PKCS#1 v2.1):

2. EME-PKCS1-v1_5 encoding:

      a. Generate an octet string PS of length k - mLen - 3 consisting
         of pseudo-randomly generated nonzero octets.  The length of PS
         will be at least eight octets.

      b. Concatenate PS, the message M, and other padding to form an
         encoded message EM of length k octets as

            EM = 0x00 || 0x02 || PS || 0x00 || M.

As you can see there are three overhead bytes and a minimum of 8 bytes of random padding.

Without the padding RSA encryption would be deterministic and not secure.

---

Originally the RSA encryption scheme has mostly been used with PKCS#1 v1.5 defined padding. No other schemes were all that popular at the time. So it is most likely that PKCS#1 v1.5 is implicitly used when no padding scheme is indicated.

Officially the name should be RSAES-PKCS1-V1_5-ENCRYPT of course, but nobody uses the function names directly.

---

Note that there are other modes of padding such as OAEP (defined in the same RFC), which is more secure. For new protocols PKCS#1 padding should not be used anymore. If you're stuck with an old protocol that requires PKCS#1 unpadding, you should make sure that padding / decryption oracles do not apply.