name: implementing-rsa-key-pair-management description: RSA (Rivest-Shamir-Adleman) is the most widely deployed asymmetric cryptographic algorithm, used for digital signatures, key exchange, and encryption. This skill covers generating, storing, rotating, domain: cybersecurity subdomain: cryptography tags:

• cryptography
• rsa
• key-management
• pki
• asymmetric-encryption

version: '1.0' author: mahipal license: Apache-2.0 nist_csf:

• PR.DS-01
• PR.DS-02
• PR.DS-10

mitre_attack:

• T1600
• T1573
• T1553
• T1486

Implementing RSA Key Pair Management

Overview

RSA (Rivest-Shamir-Adleman) is the most widely deployed asymmetric cryptographic algorithm, used for digital signatures, key exchange, and encryption. This skill covers generating, storing, rotating, and managing RSA key pairs following NIST SP 800-57 key management guidelines, including key serialization formats (PEM, DER, PKCS#8), passphrase protection, and key strength validation.

When to Use

• When deploying or configuring implementing rsa key pair management capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Familiarity with cryptography concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Generate RSA key pairs with appropriate key sizes (2048, 3072, 4096 bits)
• Serialize keys in PEM and DER formats with PKCS#8
• Protect private keys with strong passphrase encryption
• Implement key rotation with versioning
• Extract public key components and fingerprints
• Validate key strength and detect weak keys
• Sign and verify data using RSA-PSS

Key Concepts

RSA Key Sizes and Security Strength

RSA Padding Schemes

Key Storage Formats

• PEM: Base64-encoded with headers, human-readable
• DER: Binary ASN.1 encoding, compact
• PKCS#8: Standard for private key encapsulation
• PKCS#12/PFX: Bundled key + certificate, password-protected

Security Considerations

• Minimum 3072-bit keys for new deployments (NIST recommendation)
• Always protect private keys with AES-256-CBC passphrase encryption
• Use RSA-PSS for signatures (not PKCS#1 v1.5)
• Use RSA-OAEP for encryption (not PKCS#1 v1.5)
• Store private keys with restrictive file permissions (0600)
• Implement key rotation at least annually

Validation Criteria

• [ ] Key generation produces valid RSA key pair
• [ ] Public key can be extracted from private key
• [ ] Private key is protected with passphrase
• [ ] RSA-PSS signature verification succeeds
• [ ] Tampered signature verification fails
• [ ] Key fingerprint is computed correctly
• [ ] Key rotation maintains old key access for verification