cargo / rsa
rsa
What changed in rsa 0.10, from its official release notes, upgrade guides and advisories. Sources checked 2026-11-12.
22 breaking6 security3 deprecations13 new APIs and options2 performance3 behavior and defaults5 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initrsa 0.1054 changes
Breaking changes 22
The public API replaces BigUint with BoxedUint; modulus and prime-factor types are now NonZero<BoxedUint> and Odd<BoxedUint>.
PKCS#1/PKCS#8/SPKI support is gated on the default-enabled encoding feature; std no longer implicitly enables encoding dependencies.
Key generation enforces a 1024-bit minimum; default public-key construction and decoding also enforce that minimum.
The minimum supported Rust version is 1.87.
The nightly feature has been removed.
Oaep is generic over its digest type instead of using DynDigest.
The separate pem feature is removed; PEM support is included with encoding.
Signatures are stored as byte strings, preserving their encoded width.
Invalid PKCS#1 v1.5 padding returns deterministic synthetic plaintext instead of a padding error, avoiding a sidechannel.
PKCS#1 v1.5 encryption and signatures now require the opt-in pkcs1v15 feature.
The deprecated *_with_prefix constructors have been removed.
The deprecated new_raw constructor has been removed.
Construction rejects factors less than or equal to one, even or repeated factors, and private exponents greater than or equal to the modulus.
Adds construction for unbalanced two-prime keys; ordinary constructors now reject these keys.
Pss is generic over its digest type instead of using DynDigest.
PSS now follows RFC 8017 encoded-message width rules, including moduli with bit lengths congruent to 1 modulo 8.
Salt lengths that cannot be represented by the AlgorithmIdentifier encoder are rejected instead of truncated.
SigningKey now applies blinding by default.
The project now uses the Rust 2024 edition.
The optional sha2 feature is removed because SHA-2 support is always enabled.
Signature decoding is limited to 1024 bytes by default, with an API for specifying an explicit limit.
The u64_digit feature has been removed.
Security 6
Private-key components are redacted from Debug output.
Cryptographic operations, including OAEP decryption, now honor explicitly configured larger-key construction limits.
Stored secret-prime Montgomery parameters are zeroized.
Private-key operations are hardened following draft-irtf-cfrg-rsa-guidance.
Deprecated in favor of pss::SigningKey, which now applies blinding by default.
Undersized encoded messages and overflowing salt lengths return verification errors instead of panicking.
Deprecations 3
Renames RsaPrivateKey to PrivateKey while retaining the old name as a deprecated alias.
Deprecated in favor of PublicKey::new_with_size_limits.
Renames RsaPublicKey to PublicKey while retaining the old name as a deprecated alias.
New APIs and options 13
Error now implements Clone and core::error::Error.
Adds a crypto_common::Generate implementation and re-export for generating 3072-bit keys with public exponent 65537.
Multipart signing trait implementations are available for PKCS#1 v1.5 and PSS.
PSS keys can be decoded from PKCS#8/SPKI, including id-RSASSA-PSS algorithm identifiers.
Adds algorithm-specific inherent methods for OAEP encryption/decryption and PKCS#1 v1.5/PSS signing and verification, including prehash and explicit-RNG variants.
Adds an accessor for obtaining a public key from a private key.
Adds large-exponent component construction behind the hazmat feature.
Adds salt-length access and opt-in automatic salt-length detection through new_with_auto_salt_len.
Adds public-key construction with explicit size limits.
Adds modulus and exponent serialization helpers.
Adds explicit maximum-length control for signature decoding.
Fallible RNGs are accepted and their failures are propagated as errors.
Adds signature conversion from BitStringRef for PKCS#1 v1.5 and PSS signatures.
Performance 2
Exponentiation is bounded to the public exponent's bit length to improve encryption and verification performance.
A redundant allocation is removed during OAEP decryption.
Behavior and default changes 3
The default maximum public-key modulus size is raised to 8192 bits.
getrandom is enabled by default, and default decryption and signing paths use the system RNG for blinding.
OAEP accepts arbitrary byte strings as labels.
Fixes and other changes 5
Zero blinding factors are retried instead of replaced with one.
Size limits are enforced against the modulus's actual bit length rather than its storage precision.
SigningKey::from now uses the digest prefix consistently with new.
VerifyingKey::from now uses the digest prefix consistently with new.
CRT precomputation errors are propagated from private-key constructors.