# Equivalent RSA modulus for NIST P-192 and P-521 elliptic curves [duplicate]

This question already has an answer here:

At www.keylength.com, I found the following table of ECC field size and the corresponding RSA modulus recommended by NIST.

ECC Modulus RSA Prime Size

160 1024

224 2048

256 3072

384 7680

512 15360

But NIST proposed P-192, P-224, P-256, P-384, P-521 curves. May I know what is equivalent RSA modulus for P-192 and P-521 curves?

## marked as duplicate by kelalaka, Community♦Dec 3 '18 at 16:33

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

## 1 Answer

Security strength of RSA in relation with the modulus size outlines the formula that is used for the strength of an RSA key (as a function of the size of the modulus).

For ECC it's a simpler "the prime field size / 2".

So ECC-192 => 96 bits of security. $$\sqrt[0.43]{96 / 4}$$ = $$\sqrt[0.43]{24}$$ = $$1621$$, with $$1624$$ being the next highest number divisible by 8.

ECC-521 => 260.5 bits of security. $$\sqrt[0.43]{260.5 / 4}$$ = $$\sqrt[0.43]{65.125}$$ = $$16520.3$$, making $$16528$$ the equivalent, which is beyond most systems' maximum of 16384.

• What is root0.43(96 / 4)? Can you please write it in latex? – satya Dec 3 '18 at 16:22
• @satya Ah, much fancier formatting available here. Done. – bartonjs Dec 3 '18 at 16:30
• Generic ECC strength is half the size of the subgroup generated by G on the curve, but the X9/NIST prime curves in particular were chosen (specifically with cofactor 1) so the subgroup order is close to the underlying field size. – dave_thompson_085 May 3 at 1:47