RSA is the reason you can send a credit card number to a shop you have never visited. It was published in 1977, it still protects a large share of the internet, and it is the algorithm a quantum computer breaks first. Understanding why takes about five minutes and makes the rest of the post-quantum transition make sense.
The problem RSA solved
Before public-key cryptography, two people who wanted to exchange secret messages had to already share a secret. That works for embassies and spies. It does not work for a shop with a million customers it has never met, because there is no moment beforehand in which to agree on anything.
RSA solved that with a key that comes in two halves. You publish one half and keep the other. Anyone can lock a message with the public half, and only the private half opens it. Nothing has to be agreed in advance, and the public half can be shouted across a crowded room.
Why it works: multiplying is easy, unmultiplying is not
Multiply 61 by 53 and you get 3233. That took you a moment. Now go the other way: what two numbers multiply to make 3233? You have to search. For a three-digit answer the search is short, so try it with a number six hundred digits long instead. Multiplying two six-hundred-digit primes is instant for a computer. Recovering them from the product is not, and nobody has found a shortcut in fifty years of trying.
That gap is the whole of RSA. The public key contains the product. The private key is built from the two primes. Everything else is arithmetic arranged around that one asymmetry.
What 2048-bit actually measures
It is the size of that product, in binary digits, not a measure of how much security you get. RSA-2048 gives roughly 112 bits of classical security, and RSA-3072 gives about 128. Doubling the key size does not double the strength: it buys steadily less each time, which is why RSA keys grew so large so fast.
The two different jobs RSA does
People say RSA and mean one of two things, and the post-quantum replacements split them apart, so it is worth separating them now.
- Encryption. Lock a message with someone's public key so only they can read it. RSA can do this directly, which turns out to be unusual.
- Signatures. Prove a message came from you and was not altered. You sign with the private key; anyone verifies with the public one.
Notice that the first one is direct: with RSA you can genuinely encrypt a message with a public key. That shapes how people picture public-key cryptography, and it is exactly the intuition that breaks when they meet ML-KEM, which never touches the message at all.
Where the quantum computer comes in
In 1994, Peter Shor showed that a quantum computer could factor large numbers efficiently. Not faster in the way a newer laptop is faster, but in a way that collapses the problem from impossible to routine. A machine large enough to run Shor's algorithm against RSA-2048 does not exist yet. The estimates for when one might exist range from about a decade to considerably longer, and the honest answer is that nobody knows.
The deadline is not the day the machine arrives
An attacker can record your encrypted traffic today and keep it until a quantum computer exists, then decrypt all of it at once. This is called harvest now, decrypt later. If the data you are sending today still matters in fifteen years, it is already exposed, whatever the hardware timeline turns out to be.
That is the reasoning behind every deadline that now exists. NIST IR 8547 deprecates RSA and elliptic curve in 2030 and disallows them in 2035, and Executive Order 14412 moved the federal dates earlier still.
Generate an RSA key yourself
Nothing here beats doing it. These commands work on any machine with OpenSSL, which means almost any Mac or Linux box you already have.
Generate a private key, then extract the public half from it. Notice how long the 4096-bit one takes compared to the 2048-bit one, and compare both against how instantly ML-KEM generates a key. That delay is the prime search.
Why you cannot make an RSA key from a seed phrase
Wallets turn twelve words into keys because most algorithms derive a key from a seed by hashing. RSA cannot: generating a key means searching for large primes, which is a hunt rather than a derivation. The key generator on this site offers a seed for elliptic curve, ML-KEM and ML-DSA, and greys the option out for RSA for exactly this reason.
What replaces it
| What RSA did | The replacement | The catch |
|---|---|---|
| Encrypt a message directly | ML-KEM plus a symmetric cipher | ML-KEM agrees a shared secret rather than encrypting your message |
| Sign a message | ML-DSA | Signatures grow from 256 bytes to roughly 3.3 kB |
| Small keys you could paste in an email | Nothing does this | An ML-KEM-768 public key is 1,184 bytes against RSA-2048's 294 |
The replacements are standardised, implemented, and shipping. What they are not is drop-in, and that table is why. See RSA vs ML-KEM for what actually changes in a protocol.