Why do we use RSA encryption for ANY text/communication/data encryption when everybody on internet is writing that AES-256 is much stronger than RSA-2048? If this is true, why do encrypted email services like Protonmail even use RSA encryption for their email communication when it is not as secure as AES-256?

I have read that it is currently impossible to break AES-256 using brute force attacks, but RSA is not such a big problem to break. Why is this method even used in cryptography when it is slower and weaker than a symmetric cipher like AES?

Is the only reason for using RSA is because of its asymmetric geometry (private/public key)?

I know that this question is not easy to answer but I will give one example: If I want send secure and encrypted plaintext of - for example - two full A4 pages of text, is it better to use AES-256 or RSA-2048? What I know much stronger and also faster is using AES, but maybe I am missing something?

  • $\begingroup$ 2048 bit RSA currently is currently roughly strength equivalent to 128 bit AES. In terms of processing power/memory requirements for publicly known attacks both are out of reach of even government funded organizations. The main problem with RSA is that since there have been very small but somewhat steady inroads made over it's life time against the algorithm as such and so it is harder to exactly estimate the abilities of secret services with regards to it. In terms of AES we are more certain that you still need a brute force attack and the energy requirements alone for such an attack... $\endgroup$
    – DRF
    Commented Jun 8, 2017 at 11:45
  • $\begingroup$ are under insanely optimistic assumptions around 10-20 years of total world energy output (last I computed it). For AES 256 I believe you need 5 years of the suns total energy output just for bit flipping. All together unless you are a very high profile target for the NSA or KGB or similar 2kb RSA keys are quite safe in the foreseeable future. $\endgroup$
    – DRF
    Commented Jun 8, 2017 at 11:47
  • $\begingroup$ I have read that AES is good also against quantum computing breaking but RSA is not. Is this information really correct? $\endgroup$
    – daniel
    Commented Jun 8, 2017 at 12:16
  • $\begingroup$ Yes, in the sense of we know that there is an algorithm for quantum computers which can break 2kb RSA on a qc of a couple thousand qubits, and the best known speedup for AES using qc is halving the key. We don't really know of any algorithm that is provably safe, the best we have is there is no known attack. Provable security is very hard and in case P=NP I suppose it might even be impossible (for keys significantly shorter then cipher texts anyhow). $\endgroup$
    – DRF
    Commented Jun 8, 2017 at 12:52

2 Answers 2


AES is symmetric encryption. Both sides must have the same secret key. RSA is asymmetric encryption. Each side has a public and private key. You share your public key so that others can encrypt a message such that only you can read it (with your private key)

There are situations where the key exchange for AES isn't reasonable. For those situations, we use asymmetric encryption methods like RSA.

  • $\begingroup$ Even you know that AES256 is much stronger secured encryption than RSA 2048 you will use rather RSA because of this key exchange problem? $\endgroup$
    – daniel
    Commented Jun 8, 2017 at 6:39
  • 1
    $\begingroup$ Yes. Also, you can also just use RSA with 3072 bit modulus (or ~15000 bit modulus, depending on your estimates) and you will get the same security. It just makes keys longer and processing slower. Have a look at keylength.com/en/compare $\endgroup$
    – Elias
    Commented Jun 8, 2017 at 6:52
  • 3
    $\begingroup$ @daniel: Yes. The practical value of having a public repository of trusted public keys is immense, and only asymmetric cryptography allows it. That's how a web browser can securely communicate with a web server without initially holding a secret. $\endgroup$
    – fgrieu
    Commented Jun 8, 2017 at 6:54
  • 3
    $\begingroup$ @daniel If I may offer a metaphor, consider your car. It has perhaps 300HP? A Boeing 747 jet has 95,710 HP. Why would you use your car, when the 747 is so much more powerful? The answer is that they solve very different problems. You use your car for what it is good at, and you use the plane for what it is good at. $\endgroup$
    – Cort Ammon
    Commented Jun 8, 2017 at 7:00
  • 2
    $\begingroup$ @Daniel I'd say trust both of them until you understand enough cryptography to understand what particular attacks can be made against RSA and analyze how they affect your particular threat model. The difference between them are sufficient that just comparing bits doesn't quite capture the real situation. For example, RSA is more vulnerable to side channel attacks and timing attacks, but that doesn't mean much unless you know whether or not your threat model permits those attacks. There's also mitigations that can be done, at the cost of performance. $\endgroup$
    – Cort Ammon
    Commented Jun 8, 2017 at 7:34

Most likely, you're using both.

1 Generate a random 256-bit AES key.

2 Encrypt it with RSA2048 or 3072 or whatever size of RSA you have.

3 Encrypt your actual plaintext with AES256, using that random key.

The two algorithms do different things; it's a little like asking why we need a hammer when we've got a power screwdriver.

Now, RSA's strength depends on the size of its modulus. You can generate an RSA keypair with a large enough modulus that, as best anyone can estimate, it would take as much work to break that RSA key by factoring as it would to break AES256 by brute force search. Unfortunately, RSA gets very slow as you make the modulus very large.

The other issue with RSA vs AES is that if we ever get big enough quantum computers, RSA will be very efficiently broken by them, whereas AES256 will still be fine. However, that's also true for the other commonly used key agreement/key exchange mechanisms (Diffie-Hellman or ECDH). There is a big effort underway (both at NIST and in the bigger community) to develop and vet post-quantum public-key algorithms.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.