How RSA encryption actually works (and why its whole security rests on one stubborn math step)

Every time you log into a bank, check out with a card, or open a site that starts with https, a system called RSA is quietly doing the locking. It has been a pillar of the internet since the 1980s. The thing that makes RSA remarkable is how little it looks to need: the entire scheme hangs on one operation that is easy to do and - as far as anyone can tell - impossible to reverse without the secret ingredient.

The one-way trapdoor

RSA rests on modular exponentiation, an operation that is fast to compute and believed to have no shortcut to undo. In plain terms: pick two very large prime numbers, multiply them together, and publish the result. Anyone can take the product, but to find the original two primes you would have to factor a huge number - a job that takes classical computers an impractical amount of time. That gap, between easy-to-make and hard-to-undo, is the trapdoor the whole cryptosystem is built on.

The magic is in what you can do with that prime pair. Because of a result from number theory, you can craft two special numbers so that one scrambles a message and only its partner unscrambles it. The scrambling number is the public key; the unscrambling number is the private key. You can hand out the public version by the truckload - everyone can use it - and the private one still stays yours.

How you lock and unlock without a shared secret

Here is the part that makes RSA worth more than a simple cipher. Suppose Alice wants to send Bob a secret. She uses Bob's public key to lock it into a jumble; only Bob's private key can turn that jumble back into readable text. No one who intercepted it can read it, because reading it is the same as factoring the giant number. And because the trapdoor works in both directions, RSA can be flipped around for digital signatures: Bob signs with his private key, and anyone can verify with his public key. That is how a certificate, a software update, or a block on a ledger can be proven genuine.

In practice, RSA is almost never the only thing at work, and that is a good sign of maturity. For bulk data it is too slow, so protocols like TLS use RSA to protect a short shared secret, then hand the heavy lifting to a faster symmetric cipher. And modern browsers lean heavily on elliptic-curve schemes that do the same job with much smaller numbers. RSA is the load-bearing wall in many places, but rarely the whole house.

• Easy to compute, hard to reverse: RSA's whole strength is one-way modular exponentiation.
• Public key locks, private key unlocks, and factoring is the missing shortcut.
• RSA also signs - private key signs, public key verifies.
• Real systems pair it with fast symmetric ciphers, not use it alone.
• Quantum Shor's algorithm breaks the trapdoor, so NIST is sunsetting RSA-2048 by 2030.
• Harvest-now-decrypt-later means today's encrypted traffic can be stolen for a later reveal.

What this means for you

For most users the takeaway is simple: the https padlock you trust is doing something genuinely clever, and it deserves your confidence today. The one long shadow to know about is harvest-now, decrypt-later - attackers can record your encrypted traffic now and crack it years from now once a quantum machine exists. If you protect data that must stay secret for decades, RSA alone is no longer a safe long-term bet, and the quiet migration to post-quantum cryptography is already underway.

Sources: Modular exponentiation - Wikipedia; RSA - Wikipedia; NIST IR 8547 - Transition to Post-Quantum Cryptography.

Corrections: Report an error at corrections@wireshaman.com.