# To get 128-bit security for RSA, the modulus should be 4096 bits. How was that determined? [duplicate]

My understanding of security level is that for a crypto scheme to have n-bit security means it would take $$2^n$$ operations to break it.

For something like AES with a 128-bit key, it's straight-forward to see why it has 128-bit security.

What I don't understand is how 4096-bit RSA is estimated to have 128-bit security. How was that estimation determined?

• @forest Does the estimation take current processing power into account? – Bastien Feb 8 '19 at 9:14
• Processing power has nothing to do with it. 128 bits is 128 bits regardless of whether it's "enough". – forest Feb 8 '19 at 9:16