If I understand correctly in (unpadded) RSA the length of message M must be shorter than modulus n.

Encryption gives ciphertext that is also shorter than n.

Let's say I want to send a message of 2.5x length of n.

Is the split of message into chunks inferred somehow, or is that encoded somehow within ASN.1 keys? What are the different options/standards for this?

EDIT: Probably RSA is not used for messages longer than n but symmetric keys are generated with RSA and then they are used for longer messages?


1 Answer 1


Yes, hybrid crytography is generally used; hybrid crypto combines asymmetric cryptography with a fast symmetric cipher to do the bulk of the work.

Either the keys are generated using RSA-KEM (and a Key Derivation Function) or - and this is much more common - a random symmetric key is encrypted using RSA with PKCS#1 padding or the more secure OAEP padding - the key encapsulation talked about in the Wikipedia article.

Messages are usually not split at all; most cryptographic libraries do not directly support concatenating blocks of RSA ciphertext. That is not a standardized mode of operation for RSA.

Keys are not specific to the RSA mode used (just like you can use an AES key for about any kind of mode, ECB, CBC, CTR etc.). Sometimes X.509 certificates do contain a specific signature generation / verification algorithm to be used, but the key is usable for any RSA based algorithm.


  • With most RSA modes for encryption the padding which is required to make RSA secure introduces overhead. The ciphertext will be of the same size as the modulus (in bytes), but the amount of plaintext that can be encrypted is reduced by at least 11 bytes for PKCS#1 v1.5 padding and even more for the OAEP padding modes. Of course for any secure RSA key size there will be plenty of room for a symmetric key - or even an IV, encryption key and authentication key if the protocol requires it.
  • The message (+ padding overhead) can be of the same size as the modulus, as long as the numerical representation of the input to the RSA modular exponentiation is smaller than the modulus. Otherwise the modular reduction will be performed on the input, which means you would get a value that is one or more times the modulus smaller than the input. RSA modular exponentiation is about numbers, not bits; there are special functions called OS2IP and I2OSP in RSA PKCS#1 to convert between binary and number values.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.