{"record":{"id":"f0656d44bae6730e","repo":"jwtk/jjwt","slug":"the-rsa-keytype-key-size-aka-modulus-bit-lengt","errorCode":null,"errorMessage":"The RSA ${keyType} key size (aka modulus bit length) is ${size} bits which is not secure enough for the ${id} algorithm. The JWT JWA Specification (RFC 7518, Section ${section}) states that RSA keys MUST have a size >= ${MIN_KEY_BIT_LENGTH} bits. See https://www.rfc-editor.org/rfc/rfc7518.html#section-${section} for more information.","messagePattern":"The RSA (.+?) key size \\(aka modulus bit length\\) is (.+?) bits which is not secure enough for the (.+?) algorithm\\. The JWT JWA Specification \\(RFC 7518, Section (.+?)\\) states that RSA keys MUST have a size >= (.+?) bits\\. See https://www\\.rfc-editor\\.org/rfc/rfc7518\\.html#section-(.+?) for more information\\.","errorType":"exception","errorClass":"io.jsonwebtoken.security.WeakKeyException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/DefaultRsaKeyAlgorithm.java","lineNumber":79,"sourceCode":"        }\n\n        if (RsaSignatureAlgorithm.isPss(key)) {\n            String msg = \"RSASSA-PSS keys may not be used for \" + keyType(encryption) +\n                    \", only digital signature algorithms.\";\n            throw new InvalidKeyException(msg);\n        }\n\n        int size = KeysBridge.findBitLength(key);\n        if (size < 0) return; // can't validate size: material or length not available (e.g. PKCS11 or HSM)\n        if (size < MIN_KEY_BIT_LENGTH) {\n            String id = getId();\n            String section = id.startsWith(\"RSA1\") ? \"4.2\" : \"4.3\";\n            String msg = \"The RSA \" + keyType(encryption) + \" key size (aka modulus bit length) is \" + size +\n                    \" bits which is not secure enough for the \" + id + \" algorithm. \" +\n                    \"The JWT JWA Specification (RFC 7518, Section \" + section + \") states that RSA keys MUST \" +\n                    \"have a size >= \" + MIN_KEY_BIT_LENGTH + \" bits. See \" +\n                    \"https://www.rfc-editor.org/rfc/rfc7518.html#section-\" + section + \" for more information.\";\n            throw new WeakKeyException(msg);\n        }\n    }\n\n    @Override\n    public KeyResult getEncryptionKey(final KeyRequest<PublicKey> request) throws SecurityException {\n\n        Assert.notNull(request, \"Request cannot be null.\");\n        final PublicKey kek = Assert.notNull(request.getPayload(), \"RSA PublicKey encryption key cannot be null.\");\n        validate(kek, true);\n        final SecretKey cek = generateCek(request);\n\n        byte[] ciphertext = jca(request).withCipher(new CheckedFunction<Cipher, byte[]>() {\n            @Override\n            public byte[] apply(Cipher cipher) throws Exception {\n                if (SPEC == null) {\n                    cipher.init(Cipher.WRAP_MODE, kek, ensureSecureRandom(request));\n                } else {\n                    cipher.init(Cipher.WRAP_MODE, kek, SPEC, ensureSecureRandom(request));","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/DefaultRsaKeyAlgorithm.java#L61-L97","documentation":"This WeakKeyException indicates the RSA key's modulus bit length is below the JWA (RFC 7518) minimum of 2048 bits required for the RSA key-management algorithm. The library enforces the RFC minimum to prevent insecure JWE usage; section 4.2 applies to RSA1_5 and 4.3 to RSA-OAEP.","triggerScenarios":"Calling getEncryptionKey/getDecryptionKey with an RSA key smaller than 2048 bits, e.g. a 1024- or 512-bit key pair, when the key length is obtainable (not HSM/PKCS11-opaque).","commonSituations":"Legacy keys generated at 1024 bits; test keys generated with small sizes for speed; keys imported from old systems predating the 2048-bit requirement.","solutions":["Generate a new RSA key pair with at least 2048 bits: KeyPairGenerator.getInstance(\"RSA\").initialize(2048).","Re-issue or rotate the key to 2048/3072/4096 bits and update the keystore.","If you must inspect, check key.getModulus().bitLength() >= 2048 before use.","Avoid reducing security by downgrading the algorithm; the RFC minimum is mandatory."],"exampleFix":"// before\nKeyPairGenerator kg = KeyPairGenerator.getInstance(\"RSA\");\nkg.initialize(1024);\n// after\nKeyPairGenerator kg = KeyPairGenerator.getInstance(\"RSA\");\nkg.initialize(2048);\nKeyPair kp = kg.generateKeyPair();","handlingStrategy":"validation","validationCode":"java.security.interfaces.RSAKey rk = (java.security.interfaces.RSAKey) key;\nif (rk.getModulus().bitLength() < 2048) {\n    throw new IllegalArgumentException(\"RSA key must be >= 2048 bits, was \" + rk.getModulus().bitLength());\n}","typeGuard":"boolean isStrongRsa(Key k) {\n    return k instanceof java.security.interfaces.RSAKey\n        && ((java.security.interfaces.RSAKey) k).getModulus().bitLength() >= 2048;\n}","tryCatchPattern":"try {\n    jwt = Jwts.builder().encryptWith(pub, Jwts.KEY.RSA_OAEP)...compact();\n} catch (io.jsonwebtoken.security.WeakKeyException e) {\n    // rotate to a >=2048-bit key\n}","preventionTips":["Generate RSA keys with initialize(2048) or higher","Audit legacy keystores for 1024-bit keys","Enforce key-size policy at key provisioning time"],"tags":["java","jjwt","rsa","weak-key","security"],"backgroundTag":"weak-crypto-key","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}