I know that the sizes are standardized to $1024$, $2048$ etc. but they actually provide different security than $128$, $256$... for example $\texttt{RSA-}2048$ is actually $112$ bits of security and $128$ bits would be $2304$, so how many bits of security is $\texttt{RSA-}3072$ actually providing?
$\begingroup$
$\endgroup$
1
-
$\begingroup$ Welcome on Crypto.SE. Please could you mention where did you read that a $2304$-bit modulus size provides a $128$-bit security level? $\endgroup$– Raoul722Apr 7, 2016 at 6:35
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
The https://www.keylength.com/en web site summarizes reports from well-known organizations to give cryptographic key length recommandations for different kind of algorithms. Also note that
The lengths provided here are designed to resist mathematic attacks; they do not take algorithmic attacks, hardware flaws, etc. into account.
Plus, there is a feature which allows you to enter the modulus size to synthetize the results: https://www.keylength.com/en/compare/
So by entering $3072$ as the modulus size, according to all the different organizations mentioned on this web site, it is assumed that the $\texttt{RSA-}3072$ security level is equivalent to a $128$-bit symmetric key.
Note that there can be some discrepancies according to the different organizations. For example, for a $2048$-bit modulus size, ANSSI claims that it has the same security level as a $100$-bit symmetric key while NIST says it is $112$.
