1
$\begingroup$

This question already has an answer here:

I know that the sizes are standardized to $1024$, $2048$ etc. but they actually provide different security than $128$, $256$... for example $\texttt{RSA-}2048$ is actually $112$ bits of security and $128$ bits would be $2304$, so how many bits of security is $\texttt{RSA-}3072$ actually providing?

$\endgroup$

marked as duplicate by otus, yyyyyyy, Maarten Bodewes, e-sushi Apr 8 '16 at 20:01

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • $\begingroup$ Welcome on Crypto.SE. Please could you mention where did you read that a $2304$-bit modulus size provides a $128$-bit security level? $\endgroup$ – Raoul722 Apr 7 '16 at 6:35
1
$\begingroup$

The https://www.keylength.com/en web site summarizes reports from well-known organizations to give cryptographic key length recommandations for different kind of algorithms. Also note that

The lengths provided here are designed to resist mathematic attacks; they do not take algorithmic attacks, hardware flaws, etc. into account.

Plus, there is a feature which allows you to enter the modulus size to synthetize the results: https://www.keylength.com/en/compare/

So by entering $3072$ as the modulus size, according to all the different organizations mentioned on this web site, it is assumed that the $\texttt{RSA-}3072$ security level is equivalent to a $128$-bit symmetric key.

Note that there can be some discrepancies according to the different organizations. For example, for a $2048$-bit modulus size, ANSSI claims that it has the same security level as a $100$-bit symmetric key while NIST says it is $112$.

$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.