# How many bits of symmetric security does RSA-3072 actually provide? [duplicate]

I know that the sizes are standardized to $1024$, $2048$ etc. but they actually provide different security than $128$, $256$... for example $\texttt{RSA-}2048$ is actually $112$ bits of security and $128$ bits would be $2304$, so how many bits of security is $\texttt{RSA-}3072$ actually providing?

• Welcome on Crypto.SE. Please could you mention where did you read that a $2304$-bit modulus size provides a $128$-bit security level? Apr 7 '16 at 6:35

The https://www.keylength.com/en web site summarizes reports from well-known organizations to give cryptographic key length recommandations for different kind of algorithms. Also note that

The lengths provided here are designed to resist mathematic attacks; they do not take algorithmic attacks, hardware flaws, etc. into account.

Plus, there is a feature which allows you to enter the modulus size to synthetize the results: https://www.keylength.com/en/compare/

So by entering $3072$ as the modulus size, according to all the different organizations mentioned on this web site, it is assumed that the $\texttt{RSA-}3072$ security level is equivalent to a $128$-bit symmetric key.

Note that there can be some discrepancies according to the different organizations. For example, for a $2048$-bit modulus size, ANSSI claims that it has the same security level as a $100$-bit symmetric key while NIST says it is $112$.