# Why is AES-128 considered secure while RSA needs a 1024-bit size to be considered secure [duplicate]

I got asked this question today and I didn't know the answer, AES-128 is considered secure, the key size is 2^128, so you would need in average 2^127 tries to break the key. Why does RSA need at least a 1024-bit modulus to be considered secure, If we consider a bruteforce attack on the private exponent, it would take 2^1019 tries (lets consider the private exponent is 1020-bit in length). Is the difference because of a much less complex attack that exists on RSA but doesn't exist in AES?

## marked as duplicate by poncho, Community♦Feb 10 '16 at 22:27

• Actually, to answer the question: while factoring the modulus may be difficult, it is significantly easier than trying to brute force the private exponent, or even trying possible primes $p$ to look for a factor... – poncho Feb 10 '16 at 22:34