Skip to content
ENExplore Calculators

Key Length Equivalence Calculator

Work out key length equivalence instantly with clear inputs, formula shown and shareable results.

About Key Length Equivalence Calculator

Different primitives need very different key sizes for the same security level because the best known attacks differ. Brute force is the best attack on symmetric ciphers, so n bits gives n bits of security. Factoring and discrete logs are sub-exponential, so RSA needs 3072 bits to match AES-128. Elliptic curves fall to generic square-root attacks, so a 256-bit curve gives 128 bits.

Formula

NIST SP 800-57 equivalences

80 bits ~ RSA 1024 ~ ECC 160; 112 ~ RSA 2048 ~ ECC 224; 128 ~ RSA 3072 ~ ECC 256; 192 ~ RSA 7680 ~ ECC 384; 256 ~ RSA 15360 ~ ECC 512

Worked example

With the default values below, Key Length Equivalence Calculator returns Equivalent RSA modulus of 3,072. Change any input above and every figure here is recalculated in your browser.

Inputs used

Symmetric key lengthaccepts 40–512 bits
128 bits
Protection horizonone of Until 2030, Beyond 2030, Long-term archival (30+ years)
Until 2030

Results

Equivalent RSA modulus
3,072 bits
Equivalent elliptic-curve size
256 bits
Nearest standard security level
128 bits
Hash output for matching collision resistance
256 bits

Step by step

  1. 1Values used
  2. 2NIST SP 800-57 equivalences
  3. 3Equivalent RSA modulus= 3,072 bits
  4. 4Equivalent elliptic-curve size= 256 bits
  5. 5Nearest standard security level= 128 bits
  6. 6Hash output for matching collision resistance= 256 bits

Assumptions and limits

  • The result is derived only from the 2 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Why is RSA 2048 still so common if it is only 112 bits?

112 bits remains beyond practical reach and RSA 2048 is far cheaper to compute than 3072. NIST allows it through 2030, after which 3072 or elliptic curves are expected.

Why is the ECC key roughly twice the security level?

Pollard's rho solves the elliptic-curve discrete log in about sqrt(n) operations, so a 256-bit curve offers 128 bits of security.

Related Calculators

Key Length Equivalence Calculator | Calcrivo