# Insecure RSA Configuration

> Detects RSA usage with insufficient key sizes, PKCS#1 v1.5 padding (vulnerable to padding oracle), or direct message encryption without hybrid scheme.

- Skill: `zakirkun/insecure-rsa-configuration` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/insecure-rsa-configuration`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/insecure-rsa-configuration/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/insecure-rsa-configuration

---


# Insecure RSA Configuration

## Overview
Common RSA vulnerabilities:
1. **Key size < 2048 bits**: Keys below 2048 bits are factorable; minimum is 3072 bits by 2030 (NIST guidance)
2. **PKCS#1 v1.5 padding**: Vulnerable to Bleichenbacher's padding oracle attack; OAEP must be used
3. **Direct message encryption**: RSA should only encrypt symmetric keys (hybrid encryption), not arbitrary messages
4. **Public exponent e=1 or e=3**: Trivial to break with small exponents

## Remediation
- Use RSA key size ≥ 2048 bits (prefer 4096 for long-lived keys)
- Always use OAEP padding (`PKCS1_OAEP` in Python, `RSA/ECB/OAEPWithSHA-256AndMGF1Padding` in Java)
- Use hybrid encryption (encrypt data with AES, encrypt AES key with RSA)

**Vulnerable (Python):**
```python
from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_v1_5  # Vulnerable padding!
key = RSA.generate(1024)  # Too small!
```

**Safe (Python):**
```python
from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_OAEP
key = RSA.generate(4096)
cipher = PKCS1_OAEP.new(key.publickey())
```