# What changed in rsa

> 54 changes in rsa 0.10 from its official release notes, upgrade guides and advisories: 22 breaking, 3 deprecations, 6 security, 13 new APIs and options. Each one cited. Sources checked 2026-11-12. HTML: https://unstale.sh/cargo/rsa/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## rsa 0.10

### Breaking changes

- The public API replaces BigUint with BoxedUint; modulus and prime-factor types are now NonZero<BoxedUint> and Odd<BoxedUint>. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- PKCS#1/PKCS#8/SPKI support is gated on the default-enabled encoding feature; std no longer implicitly enables encoding dependencies. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Key generation enforces a 1024-bit minimum; default public-key construction and decoding also enforce that minimum. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- The minimum supported Rust version is 1.87. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- The nightly feature has been removed. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Oaep is generic over its digest type instead of using DynDigest. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- The separate pem feature is removed; PEM support is included with encoding. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Signatures are stored as byte strings, preserving their encoded width. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Invalid PKCS#1 v1.5 padding returns deterministic synthetic plaintext instead of a padding error, avoiding a sidechannel. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- PKCS#1 v1.5 encryption and signatures now require the opt-in pkcs1v15 feature. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- The deprecated *_with_prefix constructors have been removed. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- The deprecated new_raw constructor has been removed. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Construction rejects factors less than or equal to one, even or repeated factors, and private exponents greater than or equal to the modulus. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Adds construction for unbalanced two-prime keys; ordinary constructors now reject these keys. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Pss is generic over its digest type instead of using DynDigest. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- PSS now follows RFC 8017 encoded-message width rules, including moduli with bit lengths congruent to 1 modulo 8. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Salt lengths that cannot be represented by the AlgorithmIdentifier encoder are rejected instead of truncated. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- SigningKey now applies blinding by default. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- The project now uses the Rust 2024 edition. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- The optional sha2 feature is removed because SHA-2 support is always enabled. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Signature decoding is limited to 1024 bytes by default, with an API for specifying an explicit limit. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- The u64_digit feature has been removed. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)

### Security

- Private-key components are redacted from Debug output. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Cryptographic operations, including OAEP decryption, now honor explicitly configured larger-key construction limits. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Stored secret-prime Montgomery parameters are zeroized. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Private-key operations are hardened following draft-irtf-cfrg-rsa-guidance. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Deprecated in favor of pss::SigningKey, which now applies blinding by default. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Undersized encoded messages and overflowing salt lengths return verification errors instead of panicking. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)

### Deprecations

- Renames RsaPrivateKey to PrivateKey while retaining the old name as a deprecated alias. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Deprecated in favor of PublicKey::new_with_size_limits. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Renames RsaPublicKey to PublicKey while retaining the old name as a deprecated alias. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)

### New APIs and options

- Error now implements Clone and core::error::Error. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Adds a crypto_common::Generate implementation and re-export for generating 3072-bit keys with public exponent 65537. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Multipart signing trait implementations are available for PKCS#1 v1.5 and PSS. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- PSS keys can be decoded from PKCS#8/SPKI, including id-RSASSA-PSS algorithm identifiers. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Adds algorithm-specific inherent methods for OAEP encryption/decryption and PKCS#1 v1.5/PSS signing and verification, including prehash and explicit-RNG variants. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Adds an accessor for obtaining a public key from a private key. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Adds large-exponent component construction behind the hazmat feature. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Adds salt-length access and opt-in automatic salt-length detection through new_with_auto_salt_len. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Adds public-key construction with explicit size limits. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Adds modulus and exponent serialization helpers. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Adds explicit maximum-length control for signature decoding. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Fallible RNGs are accepted and their failures are propagated as errors. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Adds signature conversion from BitStringRef for PKCS#1 v1.5 and PSS signatures. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)

### Performance

- Exponentiation is bounded to the public exponent's bit length to improve encryption and verification performance. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- A redundant allocation is removed during OAEP decryption. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)

### Behavior and default changes

- The default maximum public-key modulus size is raised to 8192 bits. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- getrandom is enabled by default, and default decryption and signing paths use the system RNG for blinding. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- OAEP accepts arbitrary byte strings as labels. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)

### Fixes and other changes

- Zero blinding factors are retried instead of replaced with one. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- Size limits are enforced against the modulus's actual bit length rather than its storage precision. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- SigningKey::from now uses the digest prefix consistently with new. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- VerifyingKey::from now uses the digest prefix consistently with new. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)
- CRT precomputation errors are propagated from private-key constructors. (0.10.0) — [release notes](https://github.com/RustCrypto/RSA/blob/48270237f4cd9c75ed511f1079518369f2213892/CHANGELOG.md#0100-2026-11-08)