My understanding of security level is that for a crypto scheme to have n-bit security means it would take $2^n$ operations to break it.

For something like AES with a 128-bit key, it's straight-forward to see why it has 128-bit security.

What I don't understand is how 4096-bit RSA is estimated to have 128-bit security. How was that estimation determined?

  • $\begingroup$ @forest Does the estimation take current processing power into account? $\endgroup$ – Bastien Feb 8 '19 at 9:14
  • 1
    $\begingroup$ Processing power has nothing to do with it. 128 bits is 128 bits regardless of whether it's "enough". $\endgroup$ – forest Feb 8 '19 at 9:16

Browse other questions tagged or ask your own question.