# How RSA encryption works, and how ECC encryption does the same job with smaller keys URL: https://webvpn.org/encryption/rsa-encryption/ Updated: 2026-09-08 What the RSA encryption algorithm is and how it works, the maths in plain language, how ECC encryption compares, and where RSA and elliptic curves are used. RSA encryption works by building a public key from the product of two large secret prime numbers: anyone can use the public key to encrypt a message or verify a signature, but only someone who knows the original primes can decrypt or sign, and recovering the primes from their product, called factoring, is computationally infeasible at the key sizes in use. ECC encryption, elliptic-curve cryptography, provides the same capabilities from a different hard problem, and does it with keys roughly a tenth the size. RSA was the first practical public-key algorithm and remains one of the most widely deployed; elliptic curves are increasingly replacing it in new systems. This guide explains what RSA is and how it works with the maths kept readable, why it is secure, how ECC does the same job, how the two compare in key size and speed, where each is used, and what quantum computing means for both. ## What RSA is RSA is a public-key algorithm published in the late 1970s and named after its inventors. It provides the two things public-key cryptography exists for: encrypting a message to a recipient using only their public key, and producing a digital signature that anyone can verify using the signer's public key. The symmetric versus asymmetric guide on this site explains why those two functions matter; this guide explains how RSA delivers them. In practice RSA encrypts small things, typically a symmetric key that then protects the actual data, because RSA is slow and can only process a message smaller than its key. RSA signatures are used in website certificates, software updates, PGP and many other places. ## How RSA encryption works, step by step The security rests on a simple asymmetry: multiplying two large primes is easy, but recovering them from the product is extremely hard. - Choose two large primes, each hundreds of digits long, and call them p and q. Keep them secret. - Multiply them to get the modulus n. Publish n. Its size in bits is the key size: 2048, 3072 or 4096. - Choose a public exponent e, a small number with a particular mathematical property relative to p and q; a standard value is used almost universally. Publish e. The public key is the pair (n, e). - Compute the private exponent d from e, p and q. This step requires knowing p and q; without them it is as hard as factoring n. The private key is d, kept secret along with p and q. - To encrypt a message m, represented as a number smaller than n, compute the ciphertext c as m raised to the power e, modulo n. Anyone with the public key can do this. - To decrypt, compute c raised to the power d, modulo n. The mathematics guarantees the result is the original m. Only the holder of d can do this. - To sign, reverse the roles: the signer computes a signature from a hash of the message using d, and anyone verifies it using e and n. Real implementations add padding schemes around the raw operation, because unpadded RSA has well-known weaknesses; the padding is a critical part of a secure RSA implementation, and historical flaws have come from getting it wrong. ## Why RSA is secure Everything an attacker needs to break RSA reduces to finding p and q from n. The best known classical algorithms for factoring a number of the size used in RSA keys would take longer than any available computing resources could sustain. Public factoring records sit far below the 2048-bit keys in use, and each increase in key size makes factoring exponentially harder. RSA keys of 1024 bits are considered insecure and have been retired. 2048 bits is the current minimum; 3072 or 4096 bits are recommended for keys that must remain secure for many years. The cost of larger keys is speed, since every RSA operation grows with key size. ## How ECC encryption works Elliptic-curve cryptography uses a different hard problem. Points on a particular kind of curve can be "added" together by a geometric rule, and a point can be added to itself many times, called scalar multiplication. Given a starting point and the result of multiplying it by a secret number, finding that secret number is the elliptic-curve discrete logarithm problem, and no efficient classical algorithm exists for it. The private key is a random number. The public key is the base point of the curve multiplied by that number. Key agreement works by each party multiplying the other's public point by their own private number; both arrive at the same shared point, which becomes a symmetric key. Signatures are built on the same operation. The standard curves in use have names such as P-256, Curve25519 and secp256k1. Because the elliptic-curve problem is harder per bit than factoring, ECC keys are much smaller: a 256-bit ECC key is considered equivalent to a 3072-bit RSA key, and a 384-bit ECC key to RSA at 7680 bits. Smaller keys mean faster operations, smaller certificates and less bandwidth, which is why ECC dominates in mobile, messaging and modern TLS. ## RSA versus ECC Property RSA ECC Hard problem Factoring large integers Elliptic-curve discrete logarithm Typical key size 2048 to 4096 bits 256 to 384 bits Speed Slow signing and decryption, fast verification Fast overall Direct encryption Yes, for small messages Usually via key agreement rather than direct encryption Maturity Longest track record Widely deployed and standardised Quantum resistance None None Both are secure today at recommended sizes. ECC is the default for new designs; RSA persists in certificates, legacy systems and places where its direct encryption capability is convenient. ## Where you meet them Your browser verifies website certificates signed with RSA or ECC and performs an elliptic-curve key agreement in almost every TLS handshake. SSH keys are RSA or, increasingly, Ed25519, an elliptic-curve signature scheme. PGP keys are RSA or elliptic-curve, as the PGP guides on this site describe. Passkeys and hardware security keys sign challenges with elliptic-curve private keys stored in hardware. Modern messaging protocols use elliptic-curve key agreement to establish end-to-end encryption. VPN protocols such as WireGuard are built on Curve25519. ## What quantum computers change A sufficiently large quantum computer running Shor's algorithm could factor RSA moduli and solve elliptic-curve discrete logarithms efficiently, breaking both RSA and ECC regardless of key size. No such computer exists today, and estimates of when one might vary widely. Because encrypted data recorded now could be decrypted later, standards bodies have selected post-quantum algorithms based on different mathematics and systems are beginning to deploy them alongside RSA and ECC. The quantum guides on this site cover the threat and the response. ## What cryptographers and standards bodies say The description above follows the published standards and the consensus of the field. Standards bodies specify RSA at 2048 bits and above and named elliptic curves as approved for key establishment and digital signatures, publish equivalence tables between RSA and ECC key sizes, and have deprecated 1024-bit RSA. Cryptographers note that most practical attacks on RSA have targeted padding and implementation errors rather than factoring, and that the same holds for ECC implementations, which is why using well-reviewed libraries matters more than choosing between the two. Post-quantum standardisation efforts state explicitly that both RSA and ECC are vulnerable to large quantum computers and recommend planning migration, while confirming both remain secure against classical attacks at current sizes. ## Reading a key size When you next see "RSA 2048" on a certificate or "Ed25519" on an SSH key, you will know what is behind it: a product of two primes that nobody can factor, or a point on a curve that nobody can reverse. Both do the same job of letting strangers share secrets and prove identity, and both are the reason the symmetric encryption that carries your data can be agreed upon in the first place. ## FAQ Q: What is the RSA encryption algorithm? A: RSA is a public-key algorithm, named after its inventors Rivest, Shamir and Adleman, in which a public key is built from the product of two large secret primes and the private key depends on knowing those primes. It is used for encrypting small secrets, such as symmetric keys, and for digital signatures. Q: How does RSA encryption work in simple terms? A: Multiply two very large primes to get a modulus and publish it with a public exponent. Anyone can encrypt a message by raising it to the public exponent modulo the modulus. Only someone who knows the two primes can compute the private exponent that reverses the operation. Recovering the primes from the modulus, called factoring, is infeasible at current key sizes. Q: What is ECC encryption? A: Elliptic-curve cryptography is a family of public-key algorithms based on the difficulty of reversing point multiplication on an elliptic curve. It provides the same functions as RSA, key agreement and signatures, with much smaller keys: a 256-bit ECC key is roughly as strong as a 3072-bit RSA key. Q: Is RSA still secure? A: RSA with 2048-bit or larger keys is considered secure against classical computers today, and 3072 or 4096 bits are recommended for long-term use. Both RSA and ECC would be broken by a sufficiently large quantum computer, which is why post-quantum algorithms are being deployed alongside them. Q: Where are RSA and ECC used? A: In HTTPS certificates and TLS handshakes, SSH keys, PGP and encrypted email, code signing, passkeys and hardware security keys, VPN protocols and cryptocurrency signatures. New systems increasingly favour ECC for its smaller keys and speed, while RSA remains widespread in certificates and legacy systems.