1
$\begingroup$

At www.keylength.com, I found the following table of ECC field size and the corresponding RSA modulus recommended by NIST.

ECC Modulus RSA Prime Size

160 1024

224 2048

256 3072

384 7680

512 15360

But NIST proposed P-192, P-224, P-256, P-384, P-521 curves. May I know what is equivalent RSA modulus for P-192 and P-521 curves?

Improve this question
$\endgroup$
0

1 Answer 1

Reset to default
1
$\begingroup$

Security strength of RSA in relation with the modulus size outlines the formula that is used for the strength of an RSA key (as a function of the size of the modulus).

For ECC it's a simpler "the prime field size / 2".

So ECC-192 => 96 bits of security. $\sqrt[0.43]{96 / 4}$ = $\sqrt[0.43]{24}$ = $1621$, with $1624$ being the next highest number divisible by 8.

ECC-521 => 260.5 bits of security. $\sqrt[0.43]{260.5 / 4}$ = $\sqrt[0.43]{65.125}$ = $16520.3$, making $16528$ the equivalent, which is beyond most systems' maximum of 16384.

Improve this answer
$\endgroup$
3
  • $\begingroup$ What is root0.43(96 / 4)? Can you please write it in latex? $\endgroup$
    – satya
    Commented Dec 3, 2018 at 16:22
  • $\begingroup$ @satya Ah, much fancier formatting available here. Done. $\endgroup$
    – bartonjs
    Commented Dec 3, 2018 at 16:30
  • $\begingroup$ Generic ECC strength is half the size of the subgroup generated by G on the curve, but the X9/NIST prime curves in particular were chosen (specifically with cofactor 1) so the subgroup order is close to the underlying field size. $\endgroup$
    – dave_thompson_085
    Commented May 3, 2019 at 1:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.