Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Implementing RSA Key Pair Management · mukul975 | DecimalAI

Implementing RSA Key Pair Management

SkillScore4Maintained

implementing-rsa-key-pair-management

RSA (Rivest-Shamir-Adleman) is the most widely deployed asymmetric cryptographic algorithm, used for digital signatures, key exchange, and encryption. This skill covers generating, storing, rotating,

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/implementing-rsa-key-pair-management/SKILL.md

decimalai skills pull implementing-rsa-key-pair-management --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/implementing-rsa-key-pair-management/SKILL.md https://app.decimal.ai/s/implementing-rsa-key-pair-management/SKILL.md

Raw file: /s/implementing-rsa-key-pair-management/SKILL.md ↗ · machine-readable summary at /s/implementing-rsa-key-pair-management.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 56d ago

Yes — +4% lift+22% tokens0% turns4% of whole cases pass with skill (1/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	—	—
case-22	✗→✗	＝ Same ✗	—	—
case-23	✗→✗	＝ Same ✗	—	—
case-19	✗→✗	＝ Same ✗	—	—
case-13	✗→✗	＝ Same ✗	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/implementing-rsa-key-pair-management/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Implementing RSA Key Pair Management

Overview

RSA (Rivest-Shamir-Adleman) is the most widely deployed asymmetric cryptographic algorithm, used for digital signatures, key exchange, and encryption. This skill covers generating, storing, rotating, and managing RSA key pairs following NIST SP 800-57 key management guidelines, including key serialization formats (PEM, DER, PKCS#8), passphrase protection, and key strength validation.

When to Use

When deploying or configuring implementing rsa key pair management capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Generate RSA key pairs with appropriate key sizes (2048, 3072, 4096 bits)
Serialize keys in PEM and DER formats with PKCS#8
Protect private keys with strong passphrase encryption
Implement key rotation with versioning
Extract public key components and fingerprints
Validate key strength and detect weak keys
Sign and verify data using RSA-PSS

Key Concepts

RSA Key Sizes and Security Strength

| Key Size (bits) | Security Strength (bits) | Recommended Until | |-----------------|-------------------------|-------------------| | 2048 | 112 | 2030 | | 3072 | 128 | Beyond 2030 | | 4096 | ~140 | Beyond 2030 |

RSA Padding Schemes

| Scheme | Use Case | Standard | |--------|----------|----------| | OAEP | Encryption | PKCS#1 v2.2 (RFC 8017) | | PSS | Signatures | PKCS#1 v2.2 (RFC 8017) | | PKCS#1 v1.5 | Legacy only | Deprecated for new systems |

Key Storage Formats

PEM: Base64-encoded with headers, human-readable
DER: Binary ASN.1 encoding, compact
PKCS#8: Standard for private key encapsulation
PKCS#12/PFX: Bundled key + certificate, password-protected

Security Considerations

Minimum 3072-bit keys for new deployments (NIST recommendation)
Always protect private keys with AES-256-CBC passphrase encryption
Use RSA-PSS for signatures (not PKCS#1 v1.5)
Use RSA-OAEP for encryption (not PKCS#1 v1.5)
Store private keys with restrictive file permissions (0600)
Implement key rotation at least annually

Validation Criteria

] Key generation produces valid RSA key pair
] Public key can be extracted from private key
] Private key is protected with passphrase
] RSA-PSS signature verification succeeds
] Tampered signature verification fails
] Key fingerprint is computed correctly
] Key rotation maintains old key access for verification

Illustrative Want to see what implementing-rsa-key-pair-management would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 09:43 UTC · 23 cases

Lift

+4%

4% vs 0%

Agent turns

1.0 vs 1.0

Tokens

+22%

2,019.17 vs 1,652.74

fail → pass · 1fail → fail · 22

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-22 We need to build an X.509 Certificate Signing Request (CSR) in Python for an internal web service, including Subject Alternative Names (SAN). How do we construct this CSR using the `cryptography` library?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-23 We need to implement field-level data encryption for JSON payloads in Python using symmetric authenticated encryption. How should we encrypt data using AES-256-GCM with the `cryptography` library?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 When rotating RSA keys in a distributed API system, how should signed messages identify which public key version was used to create the signature?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 When instantiating an RSA private key generator in Python, what standard public exponent value should be provided to `rsa.generate_private_key`?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 When writing a passphrase-encrypted RSA private key to PEM format in Python, what encryption algorithm should be used to protect the file?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 We need to generate an Ed25519 key pair for SSH authentication using Python. Could you provide Python code using the `cryptography` package to generate and serialize an Ed25519 private key?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We are building an API payload integrity verifier in Python. Could you provide a code sample that loads an encrypted private key, signs a payload using the recommended modern signature scheme, and includes a verification function to validate signatures against the public key?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-16 We need to export an RSA private key together with its X.509 certificate into a single password-protected file format for import into IIS web servers. Which key container format is designed for this?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 When assessing compliance against NIST SP 800-57, how many bits of symmetric security strength does a 3072-bit RSA key pair provide?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 According to NIST SP 800-57 key management guidelines, how many bits of security strength does a 2048-bit RSA key provide?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 We need to output an RSA key pair into a compact binary ASN.1 format suitable for hardware security modules rather than human-readable text. Which encoding format should be selected?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 After saving a serialized RSA private key PEM file to a Linux server filesystem, what POSIX file permission octal code must be set on the file to prevent unauthorized reading?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 We are generating RSA key pairs for a new enterprise microservice architecture designed for long-term deployment beyond 2030. What key size in bits should we use as the standard minimum recommended by NIST SP 800-57 guidelines?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 When saving an RSA private key to disk in Python using the `cryptography` library, which private key structure format standard should be selected for encapsulation rather than legacy PKCS#1?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 We have an encrypted RSA private key PEM file on disk. Which function in Python's cryptography library should be used to load it, and how is the password passed?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 We want to generate a canonical fingerprint string for an RSA public key for identification and logging. How should the fingerprint digest be computed from the key?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 When serializing an RSA public key to PEM format for distribution to third-party clients, which public key format standard should be specified?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We need to encrypt sensitive payloads using an RSA public key before sending them over an untrusted channel. Which padding scheme should be configured for asymmetric encryption?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 During automated RSA key rotation, how should the verification system handle incoming requests that were signed using the previous private key?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 In Python unit tests for payload signature verification, which specific exception from `cryptography.exceptions` must be caught when testing altered payload signatures?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 We are implementing an automated key validator to check client RSA public keys before accepting them into our platform. What bit length threshold should trigger rejection as a weak key according to NIST guidelines?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 We are configuring digital signature generation for modern API request signing with RSA keys. Many older examples use PKCS#1 v1.5 padding. Which padding scheme should be selected for modern RSA signatures?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 We are drafting our cryptographic key management policy for RSA signing keys. What is the maximum recommended operational lifetime before rotating private key pairs?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +4 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 0%
Pass rate with the skill: 4.4%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 09:43 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run4

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

Implementing RSA Key Pair Management

SkillSafety

Source

Implementing RSA Key Pair Management

Overview

When to Use

Prerequisites

Objectives

Key Concepts

RSA Key Sizes and Security Strength

RSA Padding Schemes

Key Storage Formats

Security Considerations

Validation Criteria

How this skill was measured

Related skills