# Elliptic Curve vs RSA key length comparison

I'm new to ECC. From this website (GlobalSign Elliptic Curve Cryptography) a 256 elliptic curve key pair provides as much security as a 3072 bit RSA key pair.

My question is: how do experts come to this conclusion? Is there an algorithm that can check or compare the key strengths of both algorithms? Which parameter of the elliptic curve (a, b, G, P, N, H) determines the most the strength of the elliptic curve?

The comparison can be made according to know attacks and their timings. Your source doesn't provide a reference and date backs to 2015, so that is not a good site as keylength.com. The current values of this answer is taken for 2019.

ECC

For ECC 128 bit security means we need 256-bit curves due to the generic discrete log attacks that have $$\mathcal{O}(\sqrt{n})$$-time. Your cited page also matches this.

RSA

For RSA it is more complicated since there are different methods around. For example, NIST gives 112-bit for RSA-2048.

There is a good cost estimate with Batch NFS for RSA-2048 in area-time cost per key of about $$2^{103}$$ taking $$o(1)$$ as zero, rather than the cost $$2^{112}$$ advertised by keylength.com, NIST, etc.

Commercial National Security Algorithm, Information Assurance Directorate at the NSA IAD-NSA give 256-bit security for RSA-3072 and ECC with 384 bit.

• oh, so you are refering to the certificate they use, I thought you were comparing 3072-bit RSA to equaly strong EC encryption. Thanks for clarification – Aemyl Dec 28 '19 at 15:22
• I've removed a lot of the existing comments as they resulted in edits of the answer and therefore didn't make sense anymore. If there are still issues outstanding then please comment again. – Maarten Bodewes Dec 28 '19 at 16:27