RFC 2313

PKCS #1: RSA Encryption Version 1.5

📅 published March 1998, from ietf

RFC 2313 PKCS #1: RSA Encryption Version 1.5 💖🎀

okay bestie, let's get into it ✨ this is the one about RSA encryption, and it's giving foundational. it's labelled as an informational document, so it's not an Internet standard, just useful info for the community 🌸 it's by B. Kaliski from RSA Laboratories East, and it dropped in March 1998 💅

the title block doesn't say it obsoletes or updates anything, so nothing's been replaced or patched by this one 🫶

Status of this Memo 🌈

this memo provides information for the Internet community. it does not specify an Internet standard of any kind. distribution is unlimited 🦋

Copyright Notice 💜

Overview 🧚

this document describes a method for encrypting data using the RSA public-key cryptosystem 🔐

1. Scope 🍓

okay so the vibe here is: this doc describes how to encrypt data with RSA 💖 its main jobs are digital signatures and digital envelopes, which are both from PKCS #7 🎀

1.1. Digital signatures 🫶

the content gets squished into a message digest using something like MD5 💅
that digest (an octet string) gets encrypted with the signer's RSA private key 🔑
the content and the encrypted digest get packaged together using PKCS #7 syntax to make a digital signature ✨
this is compatible with Privacy-Enhanced Mail (PEM) 💌

1.2. Digital envelopes 🦋

the content gets encrypted with a content-encryption key, using a cipher like DES 🔒
that content-encryption key then gets encrypted with the RSA public keys of the recipients 🗝️
the encrypted content and the encrypted key get packaged together with PKCS #7 syntax to make a digital envelope 💜
this one's compatible with PEM too 🌸

okay and then there's more 👑 the doc also describes the syntax for RSA public and private keys. public keys would be used in certificates, and private keys would usually show up in PKCS #8 private-key info 🎀 the public-key syntax is identical to X.509 and PEM, so X.509/PEM RSA keys can be used here too 💅

it also defines three signature algorithms for signing X.509/PEM certificates and certificate-revocation lists, PKCS #6 extended certificates, and other objects that use digital signatures, like X.401 message tokens 🦋

and what's NOT in scope? details on the message-digest and content-encryption algorithms, and details on where the pseudorandom bits come from for some methods. that's a whole other conversation 🙈

2. References 📚

okay here's the reading list, every single source, no cap 💅

FIPS PUB 46-1 — National Bureau of Standards. FIPS PUB 46-1: Data Encryption Standard. January 1988.
PKCS #6 — RSA Laboratories. PKCS #6: Extended-Certificate Syntax. Version 1.5, November 1993.
PKCS #7 — RSA Laboratories. PKCS #7: Cryptographic Message Syntax. Version 1.5, November 1993.
PKCS #8 — RSA Laboratories. PKCS #8: Private-Key Information Syntax. Version 1.2, November 1993.
RFC 1319 — Kaliski, B., "The MD2 Message-Digest Algorithm," RFC 1319, April 1992.
RFC 1320 — Rivest, R., "The MD4 Message-Digest Algorithm," RFC 1320, April 1992.
RFC 1321 — Rivest, R., "The MD5 Message-Digest Algorithm," RFC 1321, April 1992.
RFC 1423 — Balenson, D., "Privacy Enhancement for Internet Electronic Mail: Part III: Algorithms, Modes, and Identifiers," RFC 1423, February 1993.
X.208 — CCITT. Recommendation X.208: Specification of Abstract Syntax Notation One (ASN.1). 1988.
X.209 — CCITT. Recommendation X.209: Specification of Basic Encoding Rules for Abstract Syntax Notation One (ASN.1). 1988.
X.411 — CCITT. Recommendation X.411: Message Handling Systems: Message Transfer System: Abstract Service Definition and Procedures. 1988.
X.509 — CCITT. Recommendation X.509: The Directory-- Authentication Framework. 1988.
[dBB92] — B. den Boer and A. Bosselaers. An attack on the last two rounds of MD4. In J. Feigenbaum, editor, Advances in Cryptology---CRYPTO '91 Proceedings, volume 576 of Lecture Notes in Computer Science, pages 194-203. Springer-Verlag, New York, 1992.
[dBB93] — B. den Boer and A. Bosselaers. Collisions for the compression function of MD5. Presented at EUROCRYPT '93 (Lofthus, Norway, May 24-27, 1993).
[DO86] — Y. Desmedt and A.M. Odlyzko. A chosen text attack on the RSA cryptosystem and some discrete logarithm schemes. In H.C. Williams, editor, Advances in Cryptology---CRYPTO '85 Proceedings, volume 218 of Lecture Notes in Computer Science, pages 516-521. Springer-Verlag, New York, 1986.
[Has88] — Johan Hastad. Solving simultaneous modular equations. SIAM Journal on Computing, 17(2):336-341, April 1988.
[IM90] — Colin I'Anson and Chris Mitchell. Security defects in CCITT Recommendation X.509--The directory authentication framework. Computer Communications Review, :30-34, April 1990.
[Mer90] — R.C. Merkle. Note on MD4. Unpublished manuscript, 1990.
[Mil76] — G.L. Miller. Riemann's hypothesis and tests for primality. Journal of Computer and Systems Sciences, 13(3):300-307, 1976.
[QC82] — J.-J. Quisquater and C. Couvreur. Fast decipherment algorithm for RSA public-key cryptosystem. Electronics Letters, 18(21):905-907, October 1982.
[RSA78] — R.L. Rivest, A. Shamir, and L. Adleman. A method for obtaining digital signatures and public-key cryptosystems. Communications of the ACM, 21(2):120-126, February 1978.

3. Definitions 🎀

okay so these are the terms the doc uses, and they're kinda the whole vocabulary 💅 "for the purposes of this document, the following definitions apply" 🫶

AlgorithmIdentifier — a type that identifies an algorithm (by object identifier) and its associated parameters. it's defined in X.509 🦋
ASN.1 — Abstract Syntax Notation One, as defined in X.208 ✨
BER — Basic Encoding Rules, as defined in X.209 🌸
DES — Data Encryption Standard, as defined in FIPS PUB 46-1 🔒
MD2 — RSA Data Security, Inc.'s MD2 message-digest algorithm, as defined in RFC 1319 💜
MD4 — RSA Data Security, Inc.'s MD4 message-digest algorithm, as defined in RFC 1320 💜
MD5 — RSA Data Security, Inc.'s MD5 message-digest algorithm, as defined in RFC 1321 💜
modulus — integer constructed as the product of two primes 🔢
PEM — Internet Privacy-Enhanced Mail, as defined in RFC 1423 and related documents 💌
RSA — the RSA public-key cryptosystem, as defined in [RSA78] 🔐
private key — modulus and private exponent 🗝️
public key — modulus and public exponent 🔑

4. Symbols and abbreviations 🔣

okay so upper-case symbols like BT are octet strings and bit strings (like the signature S), and lower-case symbols like c are integers 💅

ab   hexadecimal octet value  c    exponent
BT   block type               d    private exponent
D    data                     e    public exponent
EB   encryption block         k    length of modulus in
                                    octets
ED   encrypted data           n    modulus
M    message                  p, q  prime factors of modulus
MD   message digest           x    integer encryption block
MD'  comparative message      y    integer encrypted data
       digest
PS   padding string           mod n  modulo n
S    signature                X || Y  concatenation of X, Y
                              ||X||  length in octets of X

5. General overview 🌈

okay so the next six sections cover key generation, key syntax, the encryption process, the decryption process, signature algorithms, and object identifiers ✨

each entity shall generate a pair of keys: a public key and a private key. the encryption process shall be performed with one of the keys and the decryption process shall be performed with the other key 🔐 so encryption can be a public-key or private-key operation, and so can decryption 🦋 both processes turn one octet string into another 💅 and they're inverses of each other when one uses an entity's public key and the other uses that same entity's private key 💖

the encryption and decryption processes can do either the classic RSA transformations or variations with padding 🎀

6. Key generation 🔑

this section is all about RSA key generation ✨

each entity shall select a positive integer e as its public exponent 🌸

each entity shall privately and randomly select two distinct odd primes p and q such that (p-1) and e have no common divisors, and (q-1) and e have no common divisors 🎲

the public modulus n shall be the product of the private prime factors p and q 🔢

n = pq .

the private exponent shall be a positive integer d such that de-1 is divisible by both p-1 and q-1 💜

the length of the modulus n in octets is the integer k satisfying

2^(8(k-1)) <= n < 2^(8k) .

the length k of the modulus must be at least 12 octets to accommodate the block formats in this document (see Section 8). 💀

Notes 📝

the public exponent may be standardized in specific applications. the values 3 and F4 (65537) may have some practical advantages, as noted in X.509 Annex C 🎀
some additional conditions on the choice of primes may well be taken into account in order to deter factorization of the modulus 🙈 these security conditions fall outside the scope of this document. the lower bound on the length k is there to accommodate the block formats, not for security 🔥

7. Key syntax 🗝️

this section gives the syntax for RSA public and private keys 🧚

7.1. Public-key syntax 🔑

an RSA public key shall have ASN.1 type RSAPublicKey:

RSAPublicKey ::= SEQUENCE {
  modulus INTEGER, -- n
  publicExponent INTEGER -- e }

(this type is specified in X.509 and is kept here for compatibility 💅)

the fields of type RSAPublicKey have these meanings:

modulus is the modulus n 🔢
publicExponent is the public exponent e 🦋

that's part 1 done, bestie 🫶 more parts are coming, so stay tuned 💖✨

7.2. Private-key syntax ✨

okay so the private key is where things get juicy 🔐 an RSA private key SHALL have the ASN.1 type RSAPrivateKey, and here's the whole shape:

RSAPrivateKey ::= SEQUENCE {
  version Version,
  modulus INTEGER, -- n
  publicExponent INTEGER, -- e
  privateExponent INTEGER, -- d
  prime1 INTEGER, -- p
  prime2 INTEGER, -- q
  exponent1 INTEGER, -- d mod (p-1)
  exponent2 INTEGER, -- d mod (q-1)
  coefficient INTEGER -- (inverse of q) mod p }

Version ::= INTEGER

Here's what each field means, bestie 🧚

version is the version number, so future revisions of this document stay compatible. It SHALL be 0 for this version of the document.
modulus is the modulus n.
publicExponent is the public exponent e.
privateExponent is the private exponent d.
prime1 is the prime factor p of n.
prime2 is the prime factor q of n.
exponent1 is d mod (p-1).
exponent2 is d mod (q-1).
coefficient is the Chinese Remainder Theorem coefficient q-1 mod p.

Notes.

ngl this one is so good 💜 logically, an RSA private key only needs the modulus n and the private exponent d. The extra values (p, q, d mod (p-1), d mod (p-1), and q-1 mod p) are there purely for efficiency, as Quisquater and Couvreur showed [QC82]. And if someone has a private key without all the extras, it can be converted over to the syntax here, as long as the public key is known, thanks to a result by Miller [Mil76]. 🙌
The public exponent e is included so it's super easy to derive a public key from the private key 🎀

8. Encryption process 🎀

This section describes the RSA encryption process 💖

The encryption process has four steps: encryption-block formatting, octet-string-to-integer conversion, RSA computation, and integer-to-octet-string conversion. The input is an octet string D (the data), an integer n (the modulus), and an integer c (the exponent). The integer c SHALL be an entity's public exponent e for a public-key operation, and an entity's private exponent d for a private-key operation. The output is an octet string ED, the encrypted data ✨

The length of the data D SHALL NOT be more than k-11 octets. That's totally positive, since the modulus length k is at least 12 octets. This limit guarantees that the padding string PS is at least eight octets, which is a security condition 🔒

Notes.

In typical uses of this document, encrypting content-encryption keys and message digests, ||D|| <= 30. So the RSA modulus needs to be at least 328 bits (41 octets). That's reasonable and matches security recommendations 👑
The encryption process doesn't include an explicit integrity check to catch errors if the encrypted data gets corrupted in transit. Still, the structure of the encryption block means the chance that corruption goes unnoticed is less than 2^-16, which is an upper bound on the probability that a random encryption block looks like block type 02 🧐
Using private-key operations as defined here on data other than an octet string holding a message digest is NOT RECOMMENDED, and it's still subject to further study 🙈
This document may be extended to handle data longer than k-11 octets 🌈

8.1. Encryption-block formatting

A block type BT, a padding string PS, and the data D SHALL be formatted into an octet string EB, the encryption block 🧱

EB = 00 || BT || PS || 00 || D .           (1)

The block type BT SHALL be a single octet that tells you the structure of the encryption block. For this version of the document it SHALL have the value 00, 01, or 02. For a private-key operation, the block type SHALL be 00 or 01. For a public-key operation, it SHALL be 02 🦋

The padding string PS SHALL consist of k-3-||D|| octets. For block type 00, the octets SHALL have the value 00. For block type 01, they SHALL have the value FF. For block type 02, they SHALL be pseudorandomly generated and nonzero. This makes the encryption block EB exactly k octets long ✨

Notes.

The leading 00 octet makes sure the encryption block, once converted to an integer, is less than the modulus 🌸
For block type 00, the data D must begin with a nonzero octet, or have a known length, so the encryption block can be parsed unambiguously. For block types 01 and 02, the encryption block can be parsed unambiguously, because the padding string PS has no octets with value 00 and it's separated from the data D by an octet with value 00 💅
Block type 01 is RECOMMENDED for private-key operations. It has the property that the encryption block, converted to an integer, is guaranteed to be large, which prevents certain attacks of the kind proposed by Desmedt and Odlyzko [DO86]. 🔥
Block types 01 and 02 are compatible with PEM RSA encryption of content-encryption keys and message digests, as described in RFC 1423 💜
For block type 02, it is RECOMMENDED that the pseudorandom octets be generated independently for each encryption process, especially if the same data goes into more than one encryption process. Hastad's results [Has88] are the reason behind this recommendation 🙌
For block type 02, the padding string is at least eight octets long. That's a security condition for public-key operations, and it stops an attacker from recovering data by trying every possible encryption block 🔒 For simplicity, the minimum length is the same for block type 01.
This document may be extended in the future to include other block types 🦄

8.2. Octet-string-to-integer conversion

The encryption block EB SHALL be converted to an integer x, the integer encryption block. Let EB1, ..., EBk be the octets of EB from first to last. Then the integer x SHALL satisfy 🔢

                                 k
            x =  SUM  2^(8(k-i)) EBi .              (2)
                               i = 1

Basically, the first octet of EB carries the most significance in the integer, and the last octet of EB carries the least significance 🌷

Note. The integer encryption block x satisfies 0 <= x < n, since EB1 = 00 and 2^(8(k-1)) <= n. ✨

8.3. RSA computation

The integer encryption block x SHALL be raised to the power c modulo n to give an integer y, the integer encrypted data 💫

y = x^c mod n,  0 <= y < n .

This is the classic RSA computation 👑

8.4. Integer-to-octet-string conversion

The integer encrypted data y SHALL be converted to an octet string ED of length k, the encrypted data. The encrypted data ED SHALL satisfy 🎀

                                 k
            y =  SUM  2^(8(k-i)) EDi .              (3)
                               i = 1

where ED1, ..., EDk are the octets of ED from first to last.

Again, the first octet of ED has the most significance in the integer, and the last octet of ED has the least significance 🦋

9. Decryption process 🦋

This section describes the RSA decryption process 🔓

The decryption process has four steps: octet-string-to-integer conversion, RSA computation, integer-to-octet-string conversion, and encryption-block parsing. The input is an octet string ED (the encrypted data), an integer n (the modulus), and an integer c (the exponent). The integer c SHALL be an entity's public exponent e for a public-key operation, and an entity's private exponent d for a private-key operation. The output is an octet string D, the data ✨

It is an error if the length of the encrypted data ED is not k. 🙅‍♀️

For brevity, the decryption process is described in terms of the encryption process 💖

9.1. Octet-string-to-integer conversion

The encrypted data ED SHALL be converted to an integer y, the integer encrypted data, according to Equation (3) 🔢

It is an error if the integer encrypted data y does not satisfy 0 <= y < n. 🙅‍♀️

9.2. RSA computation

The integer encrypted data y SHALL be raised to the power c modulo n to give an integer x, the integer encryption block 💫

x = y^c mod n,  0 <= x < n .

This is the classic RSA computation 👑

9.3. Integer-to-octet-string conversion

The integer encryption block x SHALL be converted to an octet string EB of length k, the encryption block, according to Equation (2) 🌸

9.4. Encryption-block parsing

The encryption block EB SHALL be parsed into a block type BT, a padding string PS, and the data D according to Equation (1) 🧩

It is an error if any of the following conditions occurs:

The encryption block EB cannot be parsed unambiguously (see notes to Section 8.1).
The padding string PS consists of fewer than eight octets, or is inconsistent with the block type BT.
The decryption process is a public-key operation and the block type BT is not 00 or 01, or the decryption process is a private-key operation and the block type is not 02.

Okay bestie, this part is serious 🚨 If any of those checks fail, it's an error, so don't skip them!

10. Signature algorithms 💅

This section defines three signature algorithms based on the RSA encryption process described in Sections 8 and 9. They're meant for signing X.509/PEM certificates and certificate-revocation lists, PKCS #6 extended certificates, and other objects that use digital signatures, like X.401 message tokens. The algorithms are NOT intended for constructing digital signatures in PKCS #7. The first signature algorithm (informally, "MD2 with RSA") combines the MD2 message-digest algorithm with RSA. The second (informally, "MD4 with RSA") combines the MD4 message-digest algorithm with RSA. The third (informally, "MD5 with RSA") combines the MD5 message-digest algorithm with RSA 🌈

This section describes the signature process and the verification process for the two algorithms. The "selected" message-digest algorithm SHALL be either MD2 or MD5, depending on the signature algorithm. The signature process SHALL be performed with an entity's private key, and the verification process SHALL be performed with an entity's public key. The signature process transforms an octet string (the message) into a bit string (the signature). The verification process determines whether a bit string (the signature) is the signature of an octet string (the message) 🎀

Note. The only difference between the signature algorithms defined here and one of the methods for constructing signatures (encrypted message digests) in PKCS #7 is that the signatures here are represented as bit strings, for consistency with the X.509 SIGNED macro. In PKCS #7, encrypted message digests are octet strings 🦄

10.1 Signature process ✨

okay bestie, signing is where the drama starts 💅 there are four steps: message digesting, data encoding, RSA encryption, and octet-string-to-bit-string conversion. the input is an octet string M (the message) plus the signer's private key 🔑. the output is a bit string S, the signature 🦋

10.1.1 Message digesting 🌸

the message M SHALL be run through the selected message-digest algorithm to get an octet string MD, the message digest 💖

10.1.2 Data encoding 🎀

the message digest MD and a message-digest algorithm identifier SHALL get combined into an ASN.1 value of type DigestInfo (it's described right below 👀). then it SHALL be BER-encoded into an octet string D, the data ✨

DigestInfo ::= SEQUENCE {
  digestAlgorithm DigestAlgorithmIdentifier,
  digest Digest }

DigestAlgorithmIdentifier ::= AlgorithmIdentifier

Digest ::= OCTET STRING

so the fields of DigestInfo mean this:

digestAlgorithm tells you which message-digest algorithm got used (plus any parameters that come with it). for this app it SHOULD name the selected algorithm, which is MD2, MD4 or MD5 🔥 the object identifiers are:

md2 OBJECT IDENTIFIER ::=
  { iso(1) member-body(2) US(840) rsadsi(113549)
      digestAlgorithm(2) 2 } md4 OBJECT IDENTIFIER ::=
  { iso(1) member-body(2) US(840) rsadsi(113549)
      digestAlgorithm(2) 4 } md5 OBJECT IDENTIFIER ::=
  { iso(1) member-body(2) US(840) rsadsi(113549)
      digestAlgorithm(2) 5 }

for these object identifiers, the parameters field of the digestAlgorithm value SHOULD be NULL 🙈

digest is the output of the digesting step, which is the message digest MD 💅

Notes.

this part is so smart 🧠 the digestAlgorithm identifier is in there so that if one digest algorithm gets compromised, the damage stays limited. say an attacker finds messages that share an MD2 digest. they could sneak a forged signature through by swapping in an innocent-looking message with that same MD2 digest and getting a signer to sign it. but that only works on signers using MD2. if DigestInfo held just the digest, the attack could hit signers using any digest algorithm 😭
someone could argue that using a SEQUENCE breaks the literal rule in the X.509 SIGNED and SIGNATURE macros, which say a signature is an ENCRYPTED OCTET STRING (not an ENCRYPTED SEQUENCE). but that literal reading doesn't have to be required, as I'Anson and Mitchell point out [IM90]. it's giving nuance 🫶
no known reason says MD4 would not be for very high security digital signature schemes 🤔 but MD4 was built to be super fast, so it's "at the edge" when it comes to cryptanalytic attack risk. a message-digest algorithm counts as "broken" if someone can find a collision (two messages with the same digest). collisions have been found in variants of MD4 with only two digesting "rounds" [Mer90][dBB92], but none have been found in MD4 itself, which has three rounds. after more critical review, it may be appropriate to consider MD4 for very high security applications.

MD5 has four rounds and is proportionally slower than MD4. until MD4's review is done, MD5 is RECOMMENDED 💜 the reported "pseudocollisions" in MD5's internal compression function [dBB93] don't seem to have any practical impact on MD5's security.

MD2 is the slowest of the three, and it has the most conservative design. no attacks on MD2 have been published 🐢

10.1.3 RSA encryption 🔐

the data D SHALL be encrypted with the signer's RSA private key, as described in Section 7, to give an octet string ED, the encrypted data. the block type SHALL be 01. (See Section 8.1.)

10.1.4 Octet-string-to-bit-string conversion 🌈

the encrypted data ED SHALL be converted into a bit string S, the signature. specifically, the most significant bit of the first octet of the encrypted data SHALL become the first bit of the signature. it keeps going like that until the least significant bit of the last octet of the encrypted data, which SHALL become the last bit of the signature ⭐

Note. the length in bits of the signature S is a multiple of eight.

10.2 Verification process 🔍

the verification process for both signature algorithms has four steps: bit-string-to-octet-string conversion, RSA decryption, data decoding, and message digesting and comparison. the input SHALL be an octet string M (the message), a signer's public key, and a bit string S (the signature). the output SHALL be an indication of success or failure 🎀

10.2.1 Bit-string-to-octet-string conversion 🦋

the signature S SHALL be converted into an octet string ED, the encrypted data. assuming the length in bits of the signature S is a multiple of eight, the first bit of the signature SHALL become the most significant bit of the first octet of the encrypted data. this continues through the last bit of the signature, which SHALL become the least significant bit of the last octet of the encrypted data 🧚

it is an error if the length in bits of the signature S is not a multiple of eight. ❌

10.2.2 RSA decryption 🔓

the encrypted data ED SHALL be decrypted with the signer's RSA public key, as described in Section 8, to give an octet string D, the data 💖

it is an error if the block type recovered in the decryption process is not 01. (See Section 9.4.)

10.2.3 Data decoding 🍓

the data D SHALL be BER-decoded into an ASN.1 value of type DigestInfo. that value SHALL be split into a message digest MD and a message-digest algorithm identifier. the message-digest algorithm identifier SHALL decide which "selected" message-digest algorithm gets used in the next step 👑

it is an error if the message-digest algorithm identifier does not identify the MD2, MD4 or MD5 message-digest algorithm.

10.2.4 Message digesting and comparison 💅

the message M SHALL be run through the selected message-digest algorithm to get an octet string MD', the comparative message digest. the verification process SHALL succeed if MD' is the same as MD, and it SHALL fail otherwise 🥹

11. Object identifiers 🆔

this document defines five object identifiers: pkcs-1, rsaEncryption, md2WithRSAEncryption, md4WithRSAEncryption, and md5WithRSAEncryption ✨

the object identifier pkcs-1 identifies this document.

pkcs-1 OBJECT IDENTIFIER ::=
  { iso(1) member-body(2) US(840) rsadsi(113549)
      pkcs(1) 1 }

the object identifier rsaEncryption identifies RSA public and private keys (as defined in Section 7) and the RSA encryption and decryption processes defined in Sections 8 and 9 🔑

rsaEncryption OBJECT IDENTIFIER ::= { pkcs-1 1 }

the rsaEncryption object identifier is meant to go in the algorithm field of an AlgorithmIdentifier value. the parameters field of that type has the algorithm-specific syntax ANY DEFINED BY algorithm, and for this algorithm it would have ASN.1 type NULL 💜

the object identifiers md2WithRSAEncryption, md4WithRSAEncryption and md5WithRSAEncryption identify the "MD2 with RSA," "MD4 with RSA," and "MD5 with RSA" signature and verification processes defined in Section 10, respectively 🌸

md2WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 2 }
md4WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 3 }
md5WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 4 }

these object identifiers are meant to go in the algorithm field of an AlgorithmIdentifier value. the parameters field of that type would have ASN.1 type NULL for these algorithms 🎀

Note. X.509's object identifier rsa also identifies RSA public keys (as defined in Section 7), but it doesn't identify private keys, and it identifies different encryption and decryption processes. some applications are expected to identify public keys by rsa. those public keys are compatible with this document. an rsaEncryption process under an rsa public key is the same as the rsaEncryption process under an rsaEncryption public key 🫶

Security Considerations 🚨

Security issues are discussed throughout this memo. ⚠️

Revision history 📜

Versions 1.0-1.3

Versions 1.0-1.3 were shared with participants in RSA Data Security, Inc.'s Public-Key Cryptography Standards meetings in February and March 1991 🌷

Version 1.4

Version 1.4 is part of the June 3, 1991 initial public release of PKCS. it was published as NIST/OSI Implementors' Workshop document SEC-SIG-91-18 🎉

Version 1.5

Version 1.5 has several editorial changes, including updates to the references and a new revision history. the substantive changes were:

Section 10: "MD4 with RSA" signature and verification processes are added. 🔥
Section 11: md4WithRSAEncryption object identifier is added. 🆕

Supersedes June 3, 1991 version, which was also published as NIST/OSI Implementors' Workshop document SEC-SIG-91-18.

Acknowledgements 🫶

This document is based on a contribution from RSA Laboratories, a division of RSA Data Security, Inc. Any substantial use of the text from this document MUST acknowledge RSA Data Security, Inc. RSA Data Security, Inc. requests that all material mentioning or referencing this document identify it as "RSA Data Security, Inc. PKCS #1" 🙏

Author's Address 💌

Burt Kaliski
RSA Laboratories East
20 Crosby Drive
Bedford, MA  01730

Phone: (617) 687-7000
EMail: burt@rsa.com

Full Copyright Statement ✨

You're totally allowed to copy this document and share it with others. You can also make derivative works that comment on or explain it, or that help people implement it, and you can prepare, copy, publish, and distribute those, in whole or in part, with no restriction of any kind 🦋 The one catch: the above copyright notice and this paragraph have to be included on all those copies and derivative works 🫶

The document itself is a different story. It may not be modified in any way, so you can't remove the copyright notice or the references to the Internet Society or other Internet organizations 🙈 There are two exceptions. The first is developing Internet standards, where the copyright procedures in the Internet Standards process must be followed. The second is translating it into languages other than English 🌈

The limited permissions above are perpetual, and the Internet Society or its successors or assigns will not revoke them ⭐

Last but not least, this document and the information in it are provided on an "AS IS" basis, and the Internet Society and the Internet Engineering Task Force disclaim all warranties, express or implied. That includes, but isn't limited to, any warranty that using the information won't infringe any rights, and any implied warranties of merchantability or fitness for a particular purpose 💀

THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 💅

📦 where this page comes from

ietf: rfc2313 1998-03
💖 girlified by claude-haiku-5-5 on 2026-10-15: a language model's rewrite of the original, under its terms