{"record":{"id":"a8f0f73879985554","repo":"jwtk/jjwt","slug":"the-rsa-keytype-signing-key-size-aka-modulus","errorCode":null,"errorMessage":"The RSA ${keyType(signing)} key size (aka modulus bit length) is ${size} bits which is not secure enough for the ${id} algorithm.  The JWT JWA Specification (RFC 7518, Section ${section}) states that RSA keys MUST have a size >= ${MIN_KEY_BIT_LENGTH} bits.  Consider using the Jwts.SIG.${id}.keyPair() builder to create a KeyPair guaranteed to be secure enough for ${id}.  See https://tools.ietf.org/html/rfc7518#section-${section} for more information.","messagePattern":"The RSA (.+?) key size \\(aka modulus bit length\\) is (.+?) bits which is not secure enough for the (.+?) algorithm\\.  The JWT JWA Specification \\(RFC 7518, Section (.+?)\\) states that RSA keys MUST have a size >= (.+?) bits\\.  Consider using the Jwts\\.SIG\\.(.+?)\\.keyPair\\(\\) builder to create a KeyPair guaranteed to be secure enough for (.+?)\\.  See https://tools\\.ietf\\.org/html/rfc7518#section-(.+?) for more information\\.","errorType":"exception","errorClass":"WeakKeyException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/RsaSignatureAlgorithm.java","lineNumber":197,"sourceCode":"\n    @Override\n    protected void validateKey(Key key, boolean signing) {\n        super.validateKey(key, signing);\n        if (!isRsaAlgorithmName(key)) {\n            throw new InvalidKeyException(\"Unrecognized RSA or RSASSA-PSS key algorithm name.\");\n        }\n        int size = KeysBridge.findBitLength(key);\n        if (size < 0) return; // https://github.com/jwtk/jjwt/issues/68\n        if (size < MIN_KEY_BIT_LENGTH) {\n            String id = getId();\n            String section = id.startsWith(\"PS\") ? \"3.5\" : \"3.3\";\n            String msg = \"The RSA \" + keyType(signing) + \" key size (aka modulus bit length) is \" + size + \" bits \" +\n                    \"which is not secure enough for the \" + id + \" algorithm.  The JWT JWA Specification \" +\n                    \"(RFC 7518, Section \" + section + \") states that RSA keys MUST have a size >= \" +\n                    MIN_KEY_BIT_LENGTH + \" bits.  Consider using the Jwts.SIG.\" + id +\n                    \".keyPair() builder to create a KeyPair guaranteed to be secure enough for \" + id + \".  See \" +\n                    \"https://tools.ietf.org/html/rfc7518#section-\" + section + \" for more information.\";\n            throw new WeakKeyException(msg);\n        }\n    }\n\n    @Override\n    protected byte[] doDigest(final SecureRequest<InputStream, PrivateKey> request) {\n        return jca(request).withSignature(new CheckedFunction<Signature, byte[]>() {\n            @Override\n            public byte[] apply(Signature sig) throws Exception {\n                if (algorithmParameterSpec != null) {\n                    sig.setParameter(algorithmParameterSpec);\n                }\n                sig.initSign(request.getKey());\n                return sign(sig, request.getPayload());\n            }\n        });\n    }\n\n    @Override","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/RsaSignatureAlgorithm.java#L179-L215","documentation":"Thrown as WeakKeyException when an RSA signing/verification key's modulus bit length is below the minimum required by the algorithm (2048 bits for RS*/PS* per RFC 7518 sections 3.3/3.5). jjwt enforces JWA minimum key sizes to prevent insecure signatures.","triggerScenarios":"Signing or verifying a JWT with an RSA key smaller than 2048 bits (e.g. legacy 1024-bit keys) with RS256/RS384/RS512/PS256/PS384/PS512 via Jwts.builder().signWith or parser verification.","commonSituations":"Legacy test/development keys (512/768/1024-bit) still used in production; keys generated years ago with outdated tooling; unit tests with fast small keys.","solutions":["Generate a new RSA keypair of >= 2048 bits, ideally with Jwts.SIG.RS256.keyPair().build() or openssl genrsa 2048.","Rotate stored keys and update all verification parties with the new public key.","If truly needed for legacy interop, use an explicit weaker configuration only in test environments (not recommended)."],"exampleFix":"// before\nKeyPairGenerator kg = KeyPairGenerator.getInstance(\"RSA\");\nkg.initialize(1024);\n// after\nKeyPair kp = Jwts.SIG.RS256.keyPair().build(); // 2048-bit by default","handlingStrategy":"validation","validationCode":"RSAPublicKey pub = (RSAPublicKey) keyPair.getPublic();\nif (pub.getModulus().bitLength() < 2048) throw new IllegalStateException(\"RSA key too small for RS*/PS*\");","typeGuard":"boolean strongEnough(RSAPublicKey k) { return k.getModulus().bitLength() >= 2048; }","tryCatchPattern":"try { /* sign/verify */ } catch (WeakKeyException e) { throw new IllegalStateException(\"Rotate to a >= 2048-bit RSA key\", e); }","preventionTips":["Always generate RSA keys with >= 2048 bits (Jwts.SIG.RSxxx.keyPair() does this).","Audit legacy keystores for 1024-bit or smaller keys.","Establish key-rotation policy so old weak keys are replaced."],"tags":["rsa","weak-key","key-size","security"],"backgroundTag":"value-out-of-range","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}