For my research, I would like to compare the efficiency of a scheme when instantiated with Elliptic curves and RSA. So, I would like to know a "latest" comparison (as of 2018) on what group sizes of ECC and RSA provide equal amount of security. I found some references online, but they are really outdated and I would like to have a latest comparison on their security.

For example, I would like to have a table of the form for each of the 15 NIST curves.

2048 bit RSA - 224 bit ECC curve - xx bit security.

1024 bit RSA - 160 bit ECC curve - xx bit security.

What are the time complexities of best attacks in each case? Does the comparison matter whether the group is being used for encryption or signatures? It would be helpful to provide an explanation on why those groups provide the corresponding amount of security.

  • 4
    There's a website dedicated to that: keylength.com – fgrieu Nov 19 at 19:45
  • In the table in keylength.com, they show the comparison for 160-bit, 224-bit, 256-bit, 384-bit, 512-bit elliptic curves. But in NIST standard nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf page 90, they give 192-bit,224-bit, 256-bit, 384-bit, 521-bit curves. Slightly confused. – satya Nov 30 at 17:33
  • @fgrieu What formula did they use to get to that table? – satya Nov 30 at 17:35

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.