Compare SSH key algorithm and bit-length strength across RSA, ECDSA and Ed25519.
Different SSH key algorithms achieve comparable real-world security at very different key sizes, because RSA's security relies on integer factorization while elliptic-curve algorithms (Ed25519, ECDSA) rely on the discrete logarithm problem, which resists brute force far more efficiently per bit. NIST's estimated symmetric-equivalent security strength lets keys of very different byte lengths be compared on equal footing: RSA-2048 gives roughly 112 bits, RSA-3072/4096 and Ed25519/ECDSA-256 all give roughly 128 bits, despite Ed25519 keys being a fraction of the size.
RSA security strength estimate
security_bits ≈ (key_bits / 30)^(1/3) × 4.5 (NIST approximation: RSA-2048 ≈ 112 bits, RSA-3072 ≈ 128 bits)
Ed25519 provides RSA-4096-equivalent security (128 bits) with a much smaller 256-bit key, which makes key generation, signing and verification significantly faster while keeping the public key short enough to paste inline in authorized_keys files.
RSA-2048 (112-bit security) is still considered acceptable by NIST guidance for now, but it offers a smaller security margin than RSA-3072+ or Ed25519, and many organizations are moving away from it as compute power increases and quantum-resistance planning begins.
It is the estimated number of operations (as a power of two) an attacker would need to break the key via the best known attack, used as a common yardstick to compare fundamentally different algorithms like RSA and elliptic curves.