RSA encryption output size

The output size of plain RSA (using some padding scheme, but no hybrid encryption) is always the key size. The reason is that for some public key n the result is some integer c with 0<=c<n. There are lots of introductions for RSA, e.g. http://ocw.mit.edu/courses/electrical-engineering-and-computer-science/6-045j-automata-computability-and-complexity-spring-2011/lecture-notes/MIT6_045JS11_rsa.pdf

The output (as integer) of RSAEP (RSA encryption primitive) is always between 0 and n:

1. If the message representative m is not between 0 and n-1, output message representative out of range and stop.

2. Let c = m^e mod n.

3. Output c.

Of course, c is a number. So you have to convert it to bytes for it to be usable. The only thing known about c is that it is smaller than n for a large value of m. It may be that c is a few bytes smaller even if m is large.

---

You've mentioned PKCS1Padding, which is part of the RSAES-PKCS1-V1_5-ENCRYPT encryption scheme. The padding will make sure that m is always large and randomized; requirements for RSA encryption to be secure.

You'll find that the encoding of c is specified in there:

...

Step 4: Convert the ciphertext representative c to a ciphertext C of length k octets: C = I2OSP (c, k)

...

where k is the size of the modulus in octets (bytes).

So yes, the answer is always k, the size of the modulus in bytes. Simply because the standard requires it that way. It is a value encoded as unsigned big endian number prefixed with as many zero bytes as required.

---

Notes:

• the modulus size defines the key size. So the output of an RSA encryption is the same as the key size: ceil(keySize / 8.0) using floats or (keySize + 8 - 1) / 8 using integers.

• RSA with OAEP padding uses the same technique, so the answer is correct for OAEP as well (and most other, less known schemes such as RSA-KEM).

• Many library routines that perform "raw" RSA (just modular exponentiation of the message with the public exponent) still perform the I2OSP function - but better check to make sure.

Yes, it is.

The output-size should always equals the size of the Modulus (part of the key), so:

2048 bit Modulus -> 2048 bit output
1024 bit Modulus -> 1024 bit output
...

If it is not, there exist numerous attacks on RSA, see here for basic information about that.

So to guarantee that the output is 2048 bit even when the input to encrypt is, let's say 7,
a padding must always be applied!