# Why is keysize almost always expressed in bits?

I've never actually seen a time when somebody has expressed RSA keysize in bytes, and I haven't seen keysize expressed in bytes in other encryption algorithms either (can't be certain that that's always the case). Is there a reason why keysize is almost always expressed in bits instead of bytes (in encryption algorithms in general, not just RSA)?

• Bits are the most natural unit of information. And with bits you will never have fractional key sizes. – aventurin Apr 5 '18 at 20:35
• @aventurin Yeah, I guess, but what if you have a keysize such as 4096 bits, which could be expressed as 512 bytes. Would it be bad practice there to call it a 512 byte length key? P.S. If this is your answer, could you post it as one? Just so it can be voted on. – Giraffer Apr 5 '18 at 20:39
• 512 would probably be OK, given that these days the byte is implicitly considered to have 8 bits. However, most people would need to convert it to bits for comparison. – aventurin Apr 5 '18 at 20:49

(Don’t underestimate the power of Tradition. The main reason we use bits is that this is how things have been done for a lot of time. If only to avoid confusion, it is a reasonable idea to stick to traditions. You don’t need a compelling reason to do things in the usual way, but you’d need one to do things differently.)

Also, bytes have not always been octets. The PDP-11 used 9-bit bytes. Even the C standard defines bytes to have at least eight bits, but possibly more.

• The PDP-11's idea of bytes is 8-bit quantities. The instruction set supports addressing 8-bit bytes and 16-bit words. Perhaps you meant to invoke the PDP-10, whose instruction set can address only 36-bit words—but certain instructions can specify in the instruction itself a fixed contiguous field of bits in the word on which to operate, which in PDP-10 parlance is called a byte. Conventions vary on how to divvy up 36-bit words into units like C char, if at all: a word evenly divides into four 9-bit units, but it can fit five 7-bit US-ASCII characters too, wasting only one bit instead of eight. – Squeamish Ossifrage Apr 6 '18 at 0:35
• Not to mention some of the old computers like the IBM 1401 using 36-bit words or 6-bit characters, never 8 bits. Some of the early modern cryptographers would have had experience with such systems, especially since many of them worked for IBM. – SAI Peregrinus Apr 6 '18 at 1:30
• @Squea: not quite; a -10 byte instruction word (like most others) contains the (base) address, with optional indexing and indirection, of a byte-pointer word elsewhere; that word contains 12 bits specifying the target bitfield, 6 unused bits, and 18 bits target word address. But you could write all of this in one MACRO-10 source line like LDB R0, [ 440700,,123456 ]where the square-brackets indicate an out-of-line literal word (and the numbers are in octal). – dave_thompson_085 Apr 6 '18 at 6:35
• The first timesharing system I managed to get significant access to (by pretending being a TA with an underage appearance in the business school that happened to be on my way back from high school) stored 3 characters in 16 bits for things like filenames, and that was exposed to the Fortran programmer, IIRC. Great way to get a grasp on encoding. – fgrieu Apr 6 '18 at 10:11
• @dave_thompson_085 I ran out of space to elaborate on the full details of the PDP-10 instruction set, or to mention, for instance, that you can also fit six 6-bit units if you discard control characters, case distinctions, and a few punctuation characters, as, e.g., the ITS file system used. Fun topics for youngsters to study in historical computing, but perhaps going a bit astray from the original question! – Squeamish Ossifrage Apr 7 '18 at 3:37

There are mutiple ways of describing the amount of bits. We can talk about key size, which for asymmetric crypto is often the size of one of the main components that make the cipher secure, e.g. the modulus for RSA. Then there is the encoded key size, which is larger than the key size of course; how large depends on the encoding. And then there is security strength, which is also expressed as bits.

Now the first two are generally well described as bytes. There are exceptions of course: some elliptic curves have an order that is not a multiple of 8. For instance P-521 which of course has an order of 521 bits. As people do not expact that the curve is often misspelled as curve P-512. The brainpool curves explicitly defined curves that are multiples of 32 bits at minimum. The encoding of the keys or domain parameters will still result in a number of octets or bytes as they are usually called, whatever the size of the curve.

As for the key strength; well, that's something different. This is the number of tries that a specific operation needs to be performed to find the key. For an symmetric cipher you'd expect that it is near the key size, but e.g. for two key triple DES the order is about $2^{80}$ giving you 80 bits of security. Now this strength doesn't necessarily be a number of bits that is dividable by 8.

So in the end you want to state things like: I'm using a 521 bit curve that gives me about 260 bits of security. It would be tricky to do that in bytes.

And yes, tradition and the fact that bits are the natural unit of information may also have something to do with it :) But there is some logic behind it as well.