Module rsa 

The RSA signature family’s shared parameterization and admission contract. Interfaces minting RSA verification keys (rsassa-pkcs1-v15-verify, rsa-pss-verify) declare their variant from this one set (the sha2/aes pattern: one definition per family).

Key admission, shared by every RSA import:

• The modulus length must be 1024–16384 bits inclusive; anything outside fails error.invalid-key. The small end of RSA is factorable — 768-bit was publicly factored in 2009 — and a signature that verifies under a factorable key authenticates nothing (see README.md, “Design notes”).
• The public exponent must be odd and at least 3, or the import fails error.invalid-key. 3 and 65537 are guaranteed to import; whether a larger exponent is admitted is implementation-defined — do not rely on either behavior.
• The SubjectPublicKeyInfo algorithm must be rsaEncryption; a key carrying id-RSASSA-PSS parameters fails error.invalid-key.
• RSA public keys have no raw form (the platform serves spki and jwk only), so verifying-key.export-key-raw fails error.unsupported for keys minted by this family.

Enums

RsaModulus

The modulus lengths generate-key serves: the standard sizes, closed as an enum so a nonstandard or sub-2048 generation request is unrepresentable. (Import admission is wider — see the family contract above and the signing interfaces’ window — because existing keys are facts; new keys are choices.)

RsaVariant

The mint-bound digests RSA signature verification serves: RSA’s parameterization is the digest alone — the modulus length is a property of the imported material, reported by verifying-key.algorithm-length. (Each algorithm interface names its closed set of parameterizations <algorithm>-variant; the two RSA signature interfaces share this one.)