A key pair is a modulus n = p·q of 2048–4096 bits, a public exponent e (almost always 65537) and a private exponent d = e⁻¹ mod lcm(p − 1, q − 1). Private keys usually also carry p, q and the CRT values dP, dQ and qInv, which make signing about four times faster (the PKCS #1 RSAPrivateKey structure, RFC 8017 Appendix A.1.2). Signing raises an encoded message to the power d modulo n; verifying raises the signature to e and compares the result with the expected encoding.
Raw RSA is malleable and forgeable, so a padding scheme is always part of the algorithm: RSASSA-PKCS1-v1_5 (deterministic, JOSE RS256) or RSASSA-PSS (randomized, PS256) for signatures, and RSAES-OAEP for encryption. The older PKCS #1 v1.5 encryption padding enabled Bleichenbacher's padding-oracle attacks; TLS 1.3 removed RSA key transport altogether. FIPS 186-5 §5.4 requires exactly two primes and an odd public exponent between 2¹⁶ and 2²⁵⁶.
A signature is as long as the modulus: 256 bytes for RSA-2048, 384 for RSA-3072, 512 for RSA-4096. SP 800-57 Part 1 rates 2048 bits at 112-bit security and 3072 bits at 128-bit. Verification is cheap and signing is not: on one core of an Apple M4 Max with OpenSSL 3.6.5, RSA-2048 signs about 3,000 and verifies about 114,000 messages per second, and generating a 2048-bit key takes about 26 ms on average, with wide variance.
NIST IR 8547 (initial public draft) proposes deprecating 112-bit RSA (2048-bit) after 2030 and disallowing all RSA after 2035. See ECDSA vs RSA for the comparison with elliptic curves.