I'm looking for a C/C++ implementation of RSA with a 2048 bit key (preferably read from a file). My target is an embedded platform, so it comes with some odd restrictions. The hardware restricts us from using the new operator, and we have to use a special version of malloc supplied by the hardware manufacturer called "umalloc". If necessary, I can dig into the source and replace the malloc calls by hand, but I'd like to avoid that. The most ideal solution would be to find a library that can do RSA encryption but without using exceptions nor dynamic allocation.

I've been researching this for about a week now and I've come across several different libraries in the various stackexchange websites. See here and here. I wanted to reopen this question since most of the questions I found were several years old, and I want to see if the opinions on those libraries still hold true.

So far here are the following libraries I've come across

  • OpenSSL: Most popular option. Seeing as how I want to JUST do RSA encryption, OpenSSL seems like overkill. Also, replacing malloc in the source seems like too much effort.
  • LibreSSL: Fork of OpenSSL. Comes with the same problems as OpenSSL.
  • crypto++: C++ library, but uses exceptions. Cannot use.
  • axTLS: Seems very lightweight, and I'm investigating this library right now. I've been struggling to understand how to read a public key into its interface though.
  • libcrypto: I just discovered this library a few hours ago. Currently investigating.

Ideally, what I'm hoping for is to just drop in a few files and just use a handful of functions to get going. Are there any libraries beyond what I've listed that can do RSA-2048 encryption and do it without using exceptions or dynamic memory allocation? Thanks

  • One thing to be aware of and investigate is the export restrictions than including RSA-2048 code in your embedded target will inevitably cause to apply to the whole device. The USA, and several other countries, regard cryptography above a certain level as weapons technology. Jun 23, 2015 at 18:33
  • Are you talking about ITAR? Does this refer to anything that is encrypted with RSA-2048?
    – HD_Mouse
    Jun 23, 2015 at 18:35
  • 1
    @HD_Mouse Most things that you'd encrypt with RSA would be covered (basically anything except a password). Signing is fine. However if the device's function isn't primarily to perform cryptography, the device as a whole would not have the same restrictions as the encryption code. Yes, it's a bit silly. What I'm writing here is only a very short summary, do research this properly before you start shipping software or hardware across borders. Jun 23, 2015 at 18:45
  • Could you replace RSA with ECC? Jun 23, 2015 at 19:04
  • @CodesInChaos I don't believe that is an option as I'm only writing one end of the data path. The data is expected to arrive encrypted with an RSA public key, and I don't believe I have the authority to change that.
    – HD_Mouse
    Jun 23, 2015 at 19:16

2 Answers 2


Yes, LibTomCrypt. LibTomCrypt implements most common cryptographic primitives (and many uncommon ones), including RSA (PKCS#1 v1.5, PSS and OAEP modes). The code is clean and portable C, so you can link it into applications written in pretty much any programming language. The library is made of small objects so that only the code you actually need will get linked into your binary. The license allows you to do, literally, what the fuck you want.

Mathematical operations are performed by the companion library LibTomMath (highly portable and readable code) or TomsFastMath (with optimizations for some platforms including ARM).

LibTomCrypt uses malloc and co. for memory management by default but you can substitute others when you build the library (#define XMALLOC umalloc etc.).

LibTomCrypt only does crypto primitives, it doesn't do certificates or network protocols. If you need SSL/TLS, 'll tentatively suggest mbed TLS, formerly known as PolarSSL. Tentatively because I've never actually used it in an embedded project.

It's maintained by ARM, so you can expect code that works well on ARM platforms (though to my knowledge there are no particular optimizations, e.g. there's no optional ARM assembly, only portable C). For open source projects library is licensed under the GNU GPL (not the LGPL), which is restrictive, but there are exceptions that allow linking with non-GPL open source code. A license that allows closed-source distribution is also available for a fee.

The source code is fairly clean, portable C. Some of the core code doesn't use malloc at all, and the code that does always uses polarssl_malloc and polarssl_free (there's no use of realloc) which makes it easy to substitute other allocators if necessary.

Elliptic curves are also supported if you migrate to something faster and smaller than RSA at some point.

  • Thanks for introducing me to this! This seems very promising, but the GPL license is definitely restrictive. I'll discuss with my peers whether we'd be willing to pay the fee for a closed-source distribution. I'll hold off on accepting this as the answer on the off-chance that a more promising solution reveals itself.
    – HD_Mouse
    Jun 24, 2015 at 0:36
  • The Library is now also licensed under Apache Version 2 License. Which means it can be used even in proprietary closed source commerical projects without any costs. While i was looking for a much smaller RSA only Library i couldn't find something so i take this answer too. Can't understand why there is not a small one file solution for it.
    – Lothar
    Jul 8, 2016 at 17:40
  • @Lothar Looking back on this answer, why did I ever recommend polar? That's for SSL, but that's not what the question asks. Edited. Use libtomcrypt! Jul 8, 2016 at 19:32
  • @HD_Mouse Looking back on this answer, why did I ever recommend polar? That's for SSL, but that's not what the question asks. Edited. Use libtomcrypt! Jul 8, 2016 at 19:32

In 2019, the best embedded cryptography C library is probably BearSSL. Beside it being IMO quite secure (it gives a lot of consideration to side-channel attacks), it is very compact and it is designed so as not to dynamically allocate any memory (e.g. it does not call malloc).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.