Cryptographic Key Length Recommendation

In most cryptographic functions, the key length is an important security parameter. Both academic and private organizations provide recommendations and mathematical formulas to approximate the minimum key size requirement for security. Despite the availability of these publications, choosing an appropriate key size to protect your system from attacks remains a headache as you need to read and understand all these papers. This web site implements mathematical formulas and summarizes reports from well-known organizations allowing you to quickly evaluate the minimum security requirements for your system. You can also easily compare all these techniques and find the appropriate key length for your desired level of protection.

The lengths provided here are designed to resist mathematic attacks; they do not take algorithmic attacks, hardware flaws, etc. into account.
Choose a method
This is the first level of recommendations from the DCSSI [5] that contributes to the definition and the expression of the French government policy concerning information systems security. Second and third levels contain classified information that will not be released.
Date Symmetric Asymmetric
Discrete Logarithm
GF(p) 
Key Size
GF(2n)
Key Size
Elliptic Curve
GF(p)  GF(2n)
Hash
2009 - 2010 80 1536
160 1536
160 2048
160 160
160
2011 - 2020 100 2048
256 2048
256 2048
256 256
256
> 2020 100 4096
256 4096
256 4096
256 256
256
Advised Minimum 128 2048
256 2048
- -
- -
-
All key sizes are provided in bits. These are the minimal sizes for security.
Click on a value to compare it with other methods.
Remarks and recommended algorithms for symmetric schemes:
  • 64-bit is the minimal bloc length for bloc ciphers (advised 128-bit).
  • It is counseled to use bloc ciphers instead of stream ciphers.
  • Encryption algorithm: AES-CBC (FIPS 197)
  • Authentication and integrity algorithm: CBC-MAC "retail" with AES
Remarks and recommended algorithms for asymmetric schemes:
  • For encryption, public exponents must be strictly higher than 216=65536.
  • Secret exponents must have the same length as the module.
  • Encryption algorithm: RSAES-OAEP (PKCS#1 v2.1)
  • Signature algorithm: RSASSA-PSS (PKCS#1 v2.1)
  • Signature algorithm: ECDSA with P-256, P-384, P-521, B-283, B-409 or B-571 (FIPS 186-3)
  • Elliptic curves GF(p): P-256, P-384 and P-521 (FIPS 186-3)
  • Elliptic curves GF(2n): B-283, B-409 and B-571 (FIPS 186-3)
Recommended algorithm for hash functions: SHA-256 (FIPS 180-2)
© 2009 BlueKrypt - v 21.2 - June 30, 2009
Author: Damien Giry
Approved by Prof. Jean-Jacques Quisquater
Contact:
Surveys of laws and regulations on cryptology: Crypto Law Survey / Digital Signature Law Survey.
Bibliography[1] Selecting Cryptographic Key Sizes, Arjen K. Lenstra and Eric R. Verheul, PKC2000: p. 446-465, 01/2000.
[2] Handbook of Information Security, Arjen K. Lenstra, 06/2004.
[3] Yearly Report on Algorithms and Keysizes (2008-2009), D.SPA.7 Rev. 1.0, ICT-2007-216676 ECRYPT II, 07/2009.
[4] Recommendation for Key Management, Special Publication 800-57 Part 1, NIST, 03/2007.
[5] Mécanismes cryptographiques - Règles et recommandations "standards", Rev. 1.10, DCSSI , 12/2006.
[6] Fact Sheet Suite B Cryptography, NSA, 07/2008.
[7] Determining Strengths for Public Keys Used for Exchanging Symmetric Keys, RFC 3766, H. Orman and P. Hoffman, 04/2004.
[8] Algorithms for Qualified Electronic Signatures, BNetzA, BSI, 01/2009.
Privacy Policy (P3P)  |  Disclaimer / Copyright  |  Release Notes