According to this article HTTPS and RSA is the same thing: https://tiptopsecurity.com/how-does-https-work-rsa-encryption-explained/

From other sources I learn that they are both asymmetric encryption methods.

What is the difference between the two?


2 Answers 2


What is the difference between the two?

That question feels like the question "what is the difference between a truck and an 8 cylinder engine?"

They are different, in the sense that they serve different goals. HTTPS may use RSA (just like a truck may use an 8 cylinder engine), however HTTPS has a lot more to it (just like a truck consists of a lot more than the engine).

RSA is a cryptographical primitive; it can be used to implement public key encryption (as the page mentions); that is, someone can have a public key (which they can distribute); anyone can use that public key to encrypt messages that only the holder of the private key can read. RSA can also implement signatures; someone with the private key can 'sign' messages, and anyone with the public key can verify that that message was 'signed'.

HTTPS is a cryptographical protocol; in particular, it tries to be a method of implementing security for transit HTTP traffic. It makes sure that the HTTP traffic you get is actually from the web server you think it is, and that no one can read it or modify it in transit. It can use RSA as one of the cryptographical primitives it relies on, but it doesn't have to (actually, the current trend is to get away from RSA public key encryption in favor of other primitives). In addition, it also relies on other cryptographical primitives as well.


HTTPS stands for HyperText Transfer Protocol, it is just the way that web servers handle requests from web clients such as browsers. It is a bit of a misnomer in the sense that it can handle any kind of data, even binary data.

The S stands for secure or SSL. It means that the HTTP connection is established over a connection secured by SSL or, as it is now called, TLS. TLS stands for transport security layer, it protects an otherwise normal port-to-port connection over TCP (the internet's transport control protocol) using cryptography.

TLS is just established before the HTTP connection, the secure layer is basically transparent to the HTTP connection. In other words, HTTP will work the same way regardless if the underlying layer is secured or not.

Sidenote: One possible change that could be related to HTTP is HSTS, which simply tells browsers to please use HTTPS.

RSA is a cryptographic primitive. It relies on the RSA problem to be secure, using modular exponentiation as primitive for encryption or signature generation. RSA as such can be used as part of the TLS protocol to authenticate and to establish session keys. It may also be used as algorithm within the required PKIX based certificate infrastructure (RSA based certificates from certificate authorities).

In TLS 1.3 RSA is not used anymore for key establishment. It is only used to authenticate the server and optionally the client through the PKIX based certificate chains and a final signature generated by the leaf certificate belonging to the server or client. ECDSA certificates may also be used though; RSA is not the only option for the key pair nor for the signature by the Certification Authority.

RSA can be used within TLS 1.2 and earlier to establish the keys and to authenticate the server at the same time as a separate / backwards compatible option - commonly ECDHE is now used to establish keys. This option to establish keys using RSA doesn't deliver forward security, so it was removed from 1.3 altogether. Client authentication is also still a possibility.

So are RSA and HTTPS the same thing?

No, both are very different. RSA is a cryptographic primitive while HTTPS is an application level protocol in the OSI layer definition. Even as concepts they can hardly be further apart. Yes, they both can be used to encrypt data, but that's where the comparison ends.

HTTPS may or may not use RSA; currently there seems to be a shift to elliptic curve cryptography over RSA because it is more efficient and secure. If quantum computers come of age, TLS may have to switch to post-quantum cryptography. In that case HTTPS may well be practical long after RSA or elliptic curves have become deprecated. RSA does require a larger quantum computer to be broken, so there's that.

RSA is asymmetric as it uses public and private keys. HTTPS commonly employs both symmetric and asymmetric encryption, but at the message encryption level it just uses symmetric session keys. Asymmetric encryption may not be used at all on TLS session resumption or when TLS entity authentication is performed through pre-shared keys (PSK).

Note that I don't see the claim that RSA and HTTPS / TLS are both "asymmetric encryption methods" in the article at all.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.