RSA Cryptography and NIST Guidance
2 years ago
Article Number
000073094
Article Summary

RSA is aware of the NIST draft that states the intention to deprecate RSA digital signature algorithms of 112 bits (2048-bit keys) by 2030 and to disallow all RSA digital signature algorithms by 2035. There is no impact to RSA products or security stance based on this guidance.

 

The RSA cryptosystem was initially developed in 1977 by the founders of RSA – Ron Rivest, Adi Shamir and Leonard Adleman. RSA released the public-key RSA cryptosystem into the public domain on September 6, 2000. RSA encryption is still widely used but no longer maintained by RSA. While the algorithm is associated with our founders and the name of our company, it is not a significant part of our products or solutions.

 

RSA encryption is still commonly used for certificate signing and to establish the TLS 1.2 handshake. RSA continues to review the state of quantum computing and its relation to the RSA encryption algorithms in our products and environments. RSA also continues to follow NIST guidance regarding encryption and quantum computing.

 

NIST Internal Report / IR 8547 ipd can be found here for reference: https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf

Disclaimer
Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact RSA Technical Support at 1-800-995-5095. RSA Security LLC and its affiliates distribute RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided 'as is' without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall RSA, its affiliates, or suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates, or suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.
Don't see what you're looking for?