
Note that performance is only one reason why direct encryption with RSA should be shunned. Random number generation can be fast, but it might also block or slow down the system by other means. The generation of the padding however relies on a secure random number generator. RSA private key operations are rather slow, and the unpadding won't take much time compared to them. The padding type is generally not much of a problem when it comes to encryption speed. The block size of the ciphertext is identical to the size of the modulus in bytes. The block size for the plaintext is generally 11 smaller than the key size for the less secure PKCS#1 v1.5 padding and differs by the hash value for OAEP.

the input is always smaller than the output) due to the padding requirements. The block size used for the plaintext differs from the one for the ciphertext (i.e. And those kind of operations are certainly very slow, specifically when it comes to private key operations. RSA-3072 is providing about 128 bit security, but you need to go over 16Kbit of key size to reach 256 bits. Furthermore, RSA key sizes grow very fast if you require more key strength. The RSA key size is of utmost importance because larger key sizes will affect performance hugely.

