I am keep generating RSA keys for 512/1024/2048/4096... as bit size. Each time the key length is increasing.

Is it possible to generate/use keys other than the above bit sizes. Let us say 800/1000/2000/...

Am I missing any theory behind ?

  • 2
    $\begingroup$ I think this might help: crypto.stackexchange.com/questions/7849/… Is that what you were looking for? $\endgroup$
    – CCS
    Jun 14, 2021 at 10:03
  • $\begingroup$ Yes, .. I could have searched few more questions .. thanks @CCS for pointing with link $\endgroup$
    – Raghu
    Jun 14, 2021 at 13:46

1 Answer 1


RSA allows any key size, as the calculations are performed using big unsigned integers. The modulus size in bits specifies the key size.

However, many implementations do have limitations. Many libraries will at least require a modulus that is a multiple of 8 bits, but ones that only allow 32 bit increments or even only specific key sizes are not uncommon. If specific key sizes are used then those are generally powers of two (as the ones you've mentioned), or the addition of two subsequent powers of two (e.g. 2048 + 1024 = 3072 bits).

It makes sense that hardware implementations have maximum key sizes. Implementations may will also often require a minimum key size - it is debatable if that kind of check should be performed at the algorithm implementation level though; I'm personally not in favor of it.

Usually standards will use those kind of key sizes, but sometimes other options are used, e.g. 1792 bits (1024 + 512 + 256 = 1792) or 1920 bits (1024 + 512 + 256 + 128) for smart card operations where a 2048 bit ciphertext or signature will not fit into one (protected) Application Protocol Data Unit (APDU). As you can see, they will try and stay as close to multiples of some power of two as possible.

Note that PKCS#1 has been defined to encode both the modulus and exponent but also the ciphertext / signature as bytes (or octets). Still, the padding modes defined in there should work even if the modulus isn't a multiple of 8.

One thing to keep in mind is that the private exponent is basically a random value between 0 and the modulus. In all likelihood it is close to the modulus in size, but it may be one or more bytes smaller when encoded to the minimum number of bytes.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.