I am looking at wrapping AES keys with RSA. In NIST SP 800-57 Part 1 Recommendation for Key Management, pg 55 it is estimated that the RSA security-strength equivalent of symmetric AES-256 key would be a RSA key with 15360 bits modulus. This RSA key size looks impractical, and mostly not even available due to technical reasons.

Is there a practical and proven mechanism for wrapping "stronger" symmetric keys with a set of "weaker" RSA wrapping keys?

  • $\begingroup$ What are your risks? What are your constraints? What is your target security? What are the capabilities of your adversary? What is the required date so that the data need to be still safe? $\endgroup$
    – kelalaka
    May 11, 2022 at 10:44
  • $\begingroup$ The requirement is "security strength equivalence" as indicated in NIST SP 800-57, specifically applied to key wrapping. The technical limitation is that only RSA keys up to 4k are available, which in this frame are not strong enough when it comes to wrapping AES-256 keys. $\endgroup$ May 11, 2022 at 11:52

1 Answer 1


Is there a practical and proven mechanism for wrapping "stronger" symmetric keys with a set of "weaker" RSA wrapping keys?

The problem is not due to any technical issue. It is just that the key strength would be undermined if the ciphertext was available to an attacker (and usually that's a common assumption, as otherwise you would not have to wrap anything in the first place). The mechanism is fine, but the security of the key is now less than 256 bits.

So what are your options around this issue:

  • use a different method for key establishment, such as ECDH (agreement) or ECIES (wrapping / encapsulation);
  • mitigate the problem by protecting the ciphertext using other measures;
  • downgrade to AES-128 - hey is it pretty secure anyway.

Finally, maybe you are just using 256 bit AES because it is a technical requirement. If you only need 128 bits of security in the first place then using a 4Kib RSA key pair is fine.

Note that ECDH and ECIES and are more vulnerable to quantum analysis than RSA, so you may also want to look into post quantum computing if you need to keep the data confidential in the not so near future. AES-128 is also somewhat vulnerable.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.