# How to calculate key size of a security algorithm?

There are lots of security algorithms. One of the way to measure security of a cryptography algorithm is to find out its key size. There are many key size of a single algorithm.

ECC (Elliptic Curve Cryptography) has 163, 256, 384, 512 etc.

RSA has 1024, 3072, 7680, 15360. I found this from here

but how can I calculate key size of an algorithm? How a single algorithm has different key size?

I am building an simple cryptographic algorithm but I don't know how to calculate key size of my algorithm.

My algorithm is to change a letter of a plain text by a code suppose

a=2H, b=3C, c=8S ......, z=6D


If the plain text is "cb" then cipher text will be "8S3C". So what will the key size of this algorithm be? How can I calculate it?

• What the "key" of an encryption scheme is, is not very precisely defined apart from whatever piece of data needs be kept secret for the encryption to be secure. The key size is then the bit length of this piece of data. So you have to isolate this piece of data in your scheme in order to find its key size. Note however that key size alone does not say very much. For example 512 bit ECC is not necessarily weaker than 1024 bit RSA. – Guut Boy Feb 11 '16 at 8:02
• @GuutBoy The key is precisely defined as part of the definition of the cryptosystem. If the key is not precisely defined, neither is the system itself. – fkraiem Feb 11 '16 at 8:35
• Sure an encryption scheme should define a key, but my point is that it is not always clear exactly which piece of data should be defined to be "the key". This is more or less up to the author of the encryption scheme to decide. – Guut Boy Feb 11 '16 at 9:15

There are lots of security algorithms. One of the way to measure security of a cryptography algorithm is to find out its key size. There are many key size of a single algorithm. But how can I calculate key size of an algorithm? How a single algorithm has different key size?

There is no standardized method that can help you with that. The best way to figure out the key sizes that are applicable is to lookup the standards that the algorithm should comply to. Furthermore, implementations may restrict those sizes further. If you are unlucky they may even expand the possible sizes of the input / output parameters (including the key size).

Lets take a look:

• RSA: any key size will do (starting with a ridiculously low minimum), but usually the key size should be a multiple of 8 bits and possibly of a specific size or higher (e.g. > 1024 bits);
• DH: the key size consists of two numbers, of which the size of the group is most important for security - specifying the key size is hard;
• AES: AES has key sizes 128, 192 and 256 bits and the number of rounds changes for the different key sizes. AES is a subset of Rijndael which has key sizes 128, 160, 192, 224 and 256. The .NET classes that implement Rijndael only support the AES key sizes (but more block sizes);
• Blowfish has a configurable key size of 32 bits up to 448 bits with steps of 8 its;
• 3DES has key sizes of 128 bit or 192 bit total, but the actual key size without parity bits is 112 and 168 bits respectively. The actual effective security is about 63-80 and 112 bits respectively.

This clearly shows you that key size is a tricky subject.

My algorithm is to change a letter of a plain text by a code suppose a=2H, b=3C, c=8S ......, z=6D

The key size is what you define as the key size. You could define the string 2H3C8S ...... 6D as your key, given you a total key space of $10^{26}$ (for the digit in the code) times $26^{26}$ (for the letter in the code). Then the key size in bits is then $\log^2({10^{26} \times 26^{26}})$ or 20902 bits (!). Obviously the actual key size is somewhat smaller as you should not repeat codes (just like the parity bits for DES are not counted).

The effective key size is of course about zero as this is not a secure modern cipher.

• As my maintained simple algorithm is not secure thus its key size zero? Only because, it can be attacked using statical attack? If i shuffle my cipher text using some methodology like "8S3C9D2S" would be "38D9SS2C" after shuffling. What will be the key size then? – Md Nasir Uddin Bhuiyan Feb 11 '16 at 14:46
• The effective key size is the key size when the most successful attacks are applied. A simple substitution cipher is not secure and can be attacked by frequency analysis. The above change won't influence the security. – Maarten Bodewes Feb 11 '16 at 15:11
• A simple substitution cipher is not secure. That means I have to substitute complexly to make my algorithm more secure and then can I say that I have some key size on my algorithm? – Md Nasir Uddin Bhuiyan Feb 11 '16 at 15:19
• I have another question. Is any substitution cipher secure? – Md Nasir Uddin Bhuiyan Feb 11 '16 at 15:22
• Nope, not secure. There are tricks to make them more secure and the amount of ciphertext per key matters. But it will never match a modern cipher - if that cipher is correctly applied of course. – Maarten Bodewes Feb 11 '16 at 15:50

How to calculate key size of a security algorithm?

The answer to this question is completely dependant on the algorithm. It depends on how the algorithm processes it (like how the key stream is generated, or how it influences the ciphertext), and how secure it is against brute-force attack. A small key can be brute-forced, as in the case of DES.

Key length can vary. It is usually a power of two.

...if plain text is "cb" then ciphertext will be "8S3C". Then what will be the key size of this algorithm? How can I calculate?

You never described the role of a key in your algorithm, so all I can say that your algorithm has a key length of zero.