Map an RSA modulus size to its NIST SP 800-57 equivalent security strength, ECC equivalent and signature size.
RSA strength grows far slower than its key length because the general number field sieve is sub-exponential: quadrupling the work factor from 112 to 128 bits needs the modulus to jump from 2048 to 3072 bits. Signature and ciphertext blocks are always exactly the modulus length in bytes. NIST disallowed 112-bit strength after 2030, so any RSA-2048 certificate or signing key with a lifetime past that date is already on a migration clock.
RSA Key Size
NIST SP 800-57 equivalences: RSA-2048 ≈ 112-bit, RSA-3072 ≈ 128-bit, RSA-7680 ≈ 192-bit, RSA-15360 ≈ 256-bit; a raw signature is modulus ÷ 8 bytes.
NIST SP 800-57 equivalences: RSA-2048 ≈ 112-bit, RSA-3072 ≈ 128-bit, RSA-7680 ≈ 192-bit, RSA-15360 ≈ 256-bit; a raw signature is modulus ÷ 8 bytes. RSA strength grows far slower than its key length because the general number field sieve is sub-exponential: quadrupling the work factor from 112 to 128 bits needs the modulus to jump from 2048 to 3072 bits. Signature and ciphertext blocks are always exactly the modulus length in bytes.
NIST disallowed 112-bit strength after 2030, so any RSA-2048 certificate or signing key with a lifetime past that date is already on a migration clock.
This calculator takes 2 inputs: RSA modulus size, Protect data until year. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
RSA-4096 only lifts the strength from 112 to roughly 140 bits while making private-key operations about 6–7× slower. If you need more than 128-bit strength, ECC P-384 or a post-quantum algorithm is a far better trade than a larger RSA modulus.