RSA

What Is RSA?

RSARSACryptographyPublic-key algorithm for smart card signatures and key exchange.Click to view → (Rivest-Shamir-Adleman) is a public-key cryptosystem based on the computational difficulty of factoring large integers. In smart card systems, RSA provides digital signatures, key transport, and certificate-based authentication using key pairs of 2048 or 4096 bits stored in the card's secure element. RSA was the first widely deployed asymmetric algorithm on smart cards and remains prevalent in payment, identity, and government card applications.

RSA Operations on Smart Cards

Smart cards use RSA for three primary operations:

• Digital signatures -- the card signs a hash of data using its private key (RSA-PSS or PKCS#1 v1.5). The signature is verified off-card using the corresponding public key from the card's certificate.
• Key transport -- a session key is encrypted with the card's RSA public key and sent to the card, which decrypts it with its private key. Used in legacy SCP02 secure channels.
• Authentication -- the card proves its identity by signing a random challenge from the terminal. This is the basis of Active Authentication in ePassports and PKI login with PIV cards.

Hardware Acceleration

RSA operations are computationally intensive -- a 2048-bit modular exponentiation requires millions of multiply operations. Without a crypto coprocessor, an RSA-2048 signature on an 8-bit smart card CPU would take minutes. Dedicated RSA accelerators reduce this to 50-200 ms for RSA-2048 and 200-800 ms for RSA-4096.

RSA vs ECC on Smart Cards

ECC is increasingly replacing RSA in new smart card designs because it provides equivalent security with much shorter keys:

Shorter keys mean smaller certificates (important for constrained EEPROM storage), faster key generation, and lower power consumption -- all critical factors for contactless cards operating on RF-harvested energy.

Current Usage

Despite ECC's advantages, RSA remains required for backward compatibility in many deployments:

• PIV and CAC -- RSA-2048 is still the default key type for authentication and digital signature certificates.
• EMV -- RSA is used for offline data authentication (SDA, DDA, CDA) in payment cards.
• PKI smart cards -- enterprise PKI deployments widely use RSA-2048 for email encryption and VPN authentication.