Skip to main content
Version: 0.1.25

RSA

RSA key generation, encryption, decryption, and signatures.

Algorithm overview​

RSA is an integer-factorization-based public-key scheme that supports encryption/decryption and digital signatures. Security relies on sufficiently large key sizes and modern padding/signature schemes (for example OAEP/PSS in broader usage contexts).

Pros and cons​

Pros

  • Very mature ecosystem and broad interoperability across legacy and modern systems.
  • Flexible primitive used for both encryption and signatures.
  • Well understood operationally with extensive tooling support.

Cons

  • Larger keys and slower private-key operations compared with modern ECC/EdDSA options.
  • Incorrect padding/mode choices can cause serious vulnerabilities.
  • Not ideal for constrained devices or high-throughput signature workloads.

When to use​

  • Use when compatibility with existing PKI or legacy systems is required.
  • Prefer modern signature mode (RSA-PSS) for new signature workflows.
  • For new designs prioritizing speed and compact keys, Ed25519/ECC is often preferred.

Types​

rsa_key_t​

RSA key pair (public and private components). Initialized with noxtls_rsa_key_init, generated with noxtls_rsa_key_generate, freed with noxtls_rsa_key_free.

rsa_key_size_t​

RSA key size (e.g. 2048, 4096 bits). Used when initializing or generating an rsa_key_t.

API​

noxtls_rsa_key_init​

noxtls_return_t noxtls_rsa_key_init(rsa_key_t *key, rsa_key_size_t key_size);

Initialize RSA key structure. key is rsa_key_t; key_size is rsa_key_size_t.

noxtls_rsa_key_generate​

noxtls_return_t noxtls_rsa_key_generate(rsa_key_t *key, rsa_key_size_t key_size);

Generate RSA key pair. key is rsa_key_t; key_size is rsa_key_size_t.

Returns: noxtls_return_t: NOXTLS_RETURN_SUCCESS on success.

noxtls_rsa_key_free​

noxtls_return_t noxtls_rsa_key_free(rsa_key_t *key);

Free RSA key structure. key is rsa_key_t.

Returns: noxtls_return_t: NOXTLS_RETURN_SUCCESS on success.

noxtls_rsa_encrypt​

noxtls_return_t noxtls_rsa_encrypt(const rsa_key_t *key, const uint8_t *plaintext, uint32_t plaintext_len, uint8_t *ciphertext, uint32_t *ciphertext_len);

RSA Encryption. key is rsa_key_t.

Returns: noxtls_return_t: NOXTLS_RETURN_SUCCESS on success.

noxtls_rsa_decrypt​

noxtls_return_t noxtls_rsa_decrypt(const rsa_key_t *key, const uint8_t *ciphertext, uint32_t ciphertext_len, uint8_t *plaintext, uint32_t *plaintext_len);

RSA Decryption. key is rsa_key_t.

Returns: noxtls_return_t: NOXTLS_RETURN_SUCCESS on success.

noxtls_rsa_decrypt_crt_only​

noxtls_return_t noxtls_rsa_decrypt_crt_only(const rsa_key_t *key, const uint8_t *ciphertext, uint32_t ciphertext_len, uint8_t *plaintext, uint32_t *plaintext_len);

RSA decrypt using CRT path only (for unit testing).

Returns: noxtls_return_t: NOXTLS_RETURN_SUCCESS on success.

noxtls_rsa_sign​

noxtls_return_t noxtls_rsa_sign(const rsa_key_t *key, const uint8_t *message, uint32_t message_len, uint8_t *signature, uint32_t *signature_len, noxtls_hash_algos_t hash_algo);

RSA Signature Generation. key is rsa_key_t; hash_algo is noxtls_hash_algos_t.

noxtls_rsa_verify​

noxtls_return_t noxtls_rsa_verify(const rsa_key_t *key, const uint8_t *message, uint32_t message_len, const uint8_t *signature, uint32_t signature_len, noxtls_hash_algos_t hash_algo);

RSA Signature Verification. key is rsa_key_t; hash_algo is noxtls_hash_algos_t.

Returns: noxtls_return_t: NOXTLS_RETURN_SUCCESS on success.

noxtls_rsa_sign_pss​

noxtls_return_t noxtls_rsa_sign_pss(const rsa_key_t *key, const uint8_t *message, uint32_t message_len, uint8_t *signature, uint32_t *signature_len, noxtls_hash_algos_t hash_algo);

Generate RSA-PSS signature (RFC 8017). Used by TLS 1.3 CertificateVerify and other modern RSA signing workflows.

Returns: noxtls_return_t.

noxtls_rsa_verify_pss​

noxtls_return_t noxtls_rsa_verify_pss(const rsa_key_t *key, const uint8_t *message, uint32_t message_len, const uint8_t *signature, uint32_t signature_len, noxtls_hash_algos_t hash_algo);

Verify RSA-PSS signature (RFC 8017).

Returns: noxtls_return_t.