RSA’s speed puzzle hinges on modular exponentiation, the core math that turns keys into ciphertext. In practice, the CPU wrestles with this operation, and its cost depends on the exponent’s binary weight. A small public exponent like 65537 keeps the work light, while a large private exponent forces heavy computation.

When a server signs a message, it uses the private exponent d, which is roughly the same size as the modulus and has about half its bits set to one. The binary method then performs over three thousand multiplications, making signing orders of magnitude slower than verification.

Clients, on the other hand, raise the public exponent e to the same message. Because e contains only two ones in its 17‑bit binary form, the binary method needs just 17 squarings and a single multiplication, so verification finishes in milliseconds. This asymmetry forces web servers to shoulder the heavy load.

The performance gap has pushed the industry toward elliptic‑curve algorithms like ECDSA, which keep both signing and verification lightweight. In TLS 1.3, servers now sign session tickets with ECDSA, reducing CPU usage and improving scalability for high‑traffic sites.