skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-rsa-key-pair-management

Generates, protects, rotates, and validates RSA key pairs following NIST SP 800-57 guidelines.

954|172|Updated Mar 13, 2026
Search Tags:#cryptography#pki#key rotation#key management#RSA#rsa-pss#asymmetric encryption
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-rsa-key-pair-management
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-rsa-key-pair-management
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/cryptography/implementing-rsa-key-pair-management
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-rsa-key-pair-management

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Managing RSA keys incorrectly leads to weak key sizes, unprotected private keys, and vulnerable padding schemes like PKCS#1 v1.5 that enable Bleichenbacher padding oracle attacks. This Skill provides structured guidance for generating, storing, rotating, and validating RSA key pairs according to NIST SP 800-57 key management guidelines.

Core Features & Use Cases

  • Key Generation & Serialization: Generate RSA key pairs at 2048, 3072, or 4096 bits and serialize them in PEM, DER, and PKCS#8 formats with passphrase protection.
  • Secure Signing & Encryption: Implement RSA-PSS for signatures and RSA-OAEP for encryption, avoiding deprecated PKCS#1 v1.5 padding.
  • Key Rotation & Validation: Rotate keys with versioning, compute fingerprints, detect weak keys (small factors, low public exponent, ROCA), and enforce minimum key sizes.
  • Use Case: When deploying a new service that signs API tokens, use this Skill to generate a 3072-bit RSA key pair, encrypt the private key with AES-256 in PKCS#8 format, and verify that tampered signatures are rejected.

Quick Start

Use the implementing-rsa-key-pair-management skill to generate a 3072-bit RSA key pair with passphrase-protected PKCS#8 storage and verify an RSA-PSS signature.

Frequently Asked Questions about implementing-rsa-key-pair-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate an RSA key pair in Python?▼

Generate an RSA key pair by selecting a key size of 2048, 3072, or 4096 bits, then serialize the private key in PKCS#8 format with passphrase encryption. Extract the public key from the private key and compute its fingerprint for identification.

What RSA key size should I use for new deployments?▼

Use a minimum of 3072 bits for new deployments, which provides 128-bit security strength recommended beyond 2030. Keys of 2048 bits offer 112-bit strength and are acceptable only until 2030, while keys below 2048 bits should be rejected.

RSA-OAEP vs PKCS#1 v1.5: which padding should I use?▼

Use RSA-OAEP with SHA-256 for encryption and RSA-PSS for signatures in all new systems. PKCS#1 v1.5 decryption is vulnerable to Bleichenbacher padding oracle attacks that recover plaintext through error or timing side channels.

How do I protect an RSA private key stored on disk?▼

Encrypt the private key with a strong passphrase using AES-256 in PKCS#8 format and set file permissions to 0600. Never commit unencrypted PEM files to version control, and verify that loading with a wrong passphrase fails.

How do I detect weak RSA keys?▼

Validate the modulus bit length is at least 2048, check for small factors, low public exponents like e=3 without OAEP, shared primes, and ROCA vulnerabilities. Reject any key failing these checks before use.

How often should RSA keys be rotated?▼

Rotate RSA keys at least annually while retaining old public keys for verifying historical signatures. Implement key versioning so rotation maintains access to previous keys for verification purposes only.

Related Skills

Explore More Software Engineering Skills→
apakouapakou

E2EE_KeyGeneration

Generate RSA-OAEP key pairs using the Web Crypto API.

Community
Basic
arbazkhan971arbazkhan971
26

crypto

Detect and remediate weak cryptography while implementing secure controls across services.

Community
Advanced
tranceetrancee

wycheproof

Validate cryptographic implementations using standardized JSON test vectors.

Community
Advanced
igbuendigbuend
8

digital-signature-pattern

Implement digital signature patterns with asymmetric cryptography for data integrity.

Community
Advanced