Work out symmetric vs asymmetric strength instantly with clear inputs, formula shown and shareable results.
Hybrid protocols use asymmetric cryptography to establish a symmetric key, so the overall strength is the minimum of the two. Pairing AES-256 with RSA 2048 gives 112 bits, not 256, because breaking the key exchange recovers the session key directly. Matching the levels is what NIST's equivalence tables exist to enable.
Weakest-link security
effective bits = min(symmetric bits, asymmetric security level); ECC level ~ size / 2; RSA level from NIST tables
It is unbalanced rather than broken. 112 bits is still infeasible to attack today, but the extra cost of AES-256 buys nothing while the key exchange is the weaker half.
Grover's algorithm halves symmetric strength, so AES-256 still gives 128 post-quantum bits, whereas Shor's algorithm breaks RSA and ECC outright — which is why hybrid key exchange with ML-KEM is being deployed.