`RsaPublicKey::new_with_max_size` behaves differently

[zacknewman]

On rsa 0.9.8, RsaPublicKey::new_with_max_size treated the passed max_size as the actual maximum number of bits the modulus is allowed to have; however rsa 0.10.0-rc.0 expects that same parameter to actually be the maximum number of "bits precision" the modulus is allowed to have.

It would be nice if the documentation were at least amended to make this clear.

rsa 0.9.8:

use rsa::{BigUint, RsaPublicKey};
fn main() {
    let n = BigUint::from_bytes_be([1, 116, 2, 177, 35, 163, 109, 146, 185].as_slice());
    assert!(RsaPublicKey::new_with_max_size(n, 3u32.into(), 65).is_ok());
}

rsa 0.10.0-rc.0:

use rsa::{BoxedUint, RsaPublicKey};
fn main() {
    let n =
        BoxedUint::from_be_slice([1, 116, 2, 177, 35, 163, 109, 146, 185].as_slice(), 65).unwrap();
    // Despite `n` being 65 bits, `max_size` is considered to be too small.
    assert!(RsaPublicKey::new_with_max_size(n.clone(), 3u32.into(), 65).is_err());
    // `128` is the smallest `max_size` that doesn't cause an error which happens to also be
    // the value of `n.bits_precision()`.
    assert!(RsaPublicKey::new_with_max_size(n, 3u32.into(), 128).is_ok());
}

[zack@laptop ~]$ rustc --version
rustc 1.87.0 (17067e9ac 2025-05-09)
[zack@laptop ~]$ uname -a
Linux laptop 6.15.1-arch1-2 #1 SMP PREEMPT_DYNAMIC Sat, 07 Jun 2025 14:36:24 +0000 x86_64 GNU/Linux

[tarcieri]

FYI that API will likely go away entirely to be replaced with something like ::new_with_size_limits (#526), however we can probably preserve the existing method with a deprecation and make sure it behaves the same as it used to.

[zacknewman]

FYI that API will likely go away entirely to be replaced with something like ::new_with_size_limits (#526), however we can probably preserve the existing method with a deprecation and make sure it behaves the same as it used to.

Cool. The size limits will actually be the number of bits correct, or will it be "bits precision"? As long as the documentation makes it clear, then I guess the latter is OK even though it's much easier to understand if it were just bits.

[tarcieri]

Number of bits. Sounds like it's just the wrong API being called.