If RSA is an encryption algorithm used to create an asymmetric key pair and digital signature, why can't it also be used to create a symmetric key?

Even if RSA is used to create public keys, why can't it be used to create symmetric keys?

2 Answers 2


As a matter of fact, you can create symmetric keys with RSA. The math behind RSA allows for it. But if this ever happens, it is a horrible mistake, and it's completely pointless to try doing this on purpose because nobody in his right mind would want to use RSA for symmetric encryption. It's way less efficient and nobody uses RSA to encrypt large amounts of data - usually you just use it to encrypt a random symmetric key or a hash (for signatures).

Basically textbook RSA works like this: generate two primes p and q, then determine an integer e < (p-1)(q-1) so that e has no common divisors with (p-1)(q-1).

Now determine the modular inverse d of e, meaning that (e*d) mod ((p-1)(q-1)) = 1

If you're very unlucky, you end up picking e, p and q so that e is it's own modular inverse. So you end up with e = d. If that happens, you have created a symmetric key.

This always happens sooner or later when you have people try and understand how RSA works by creating toy keys with very small numbers p and q (which means that you can do the math in your head, but also that RSA becomes trivially breakable). Consider for example p=5, q=7, e=11.

I'd think the chances of accidentally creating symmetric keys with full-size primes (e.g. at least 1024 bits long, and better twice that) are minuscule, and it would take an incredible amount of effort to produce one on purpose using a brute-force approach, which is another reason why nobody does it (Although there might be a way to choose p and q in a way that makes it easy to find a number that is it's own inverse - someone with a background in number theory might know how to do this if it's possible)


Leaving aside the very good points made by @Pascal, it should be pointed out that - when used properly - you generally can't create a single "key" that is symmetric in RSA (or any other asymmetric algorithm) because the whole point of such algorithms is that the key used for encryption cannot be used for decryption, and vice versa.

As a practical matter, you could generate key-pairs (with both public and private components) and treat that whole blob as a single "secret" (symmetric) key. The encrypt / verify operations would use one part of the blob, and the decrypt / sign operations would use the other part, but you could kind of pretend it would be a single key. This is a really, really silly idea, though. It completely misses the point of asymmetric crypto, and would have massive performance problems (asymmetric crypto is excruciatingly slow, both for using and generating the keys, if using secure key sizes).

It's also not even that secure. See, for example, the comparison of RSA (public) key modulus size and effective bits of security (which in any decent symmetric algorithm is just "the key size"; i.e. AES-128 uses 128-bit keys and would require 2^128 guesses to fully brute-force the key space) in this question.

One potential huge problem for RSA is if quantum computing ever gets going, because that will basically halve the effective bits entropy of most ciphers. For AES, that's no big deal; we can switch from AES-128 to AES-256 and still have 128 bits of effective security, which will still be completely implausible to brute-force for over a hundred years, even if Moore's Law continues apace. However, an RSA-2048 key (probably the most common size in use today) would drop to a piddling 56 bits of effective security - brute-forcible in a day as a private citizen, as of a few years ago - RSA-4096 (the longest RSA keys I've ever seen in the wild) would still be in trouble, and if we wanted the same effective security as AES-256 we'd need to go to RSA-15360. Leaving aside that this would make just the public key nearly 2KB long, it'd take an enormous amount of time to generate or use such keys.

  • I don't claim to understand the math behind it, but I believe Shor's algorithm does much more than halve the effective security of RSA. Feb 21, 2018 at 14:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .