中文

Glossary

Key Size (Key length)

Last verified

Definition

Key size is a key's length in bits; its strength depends on the algorithm, so a 256-bit ECDSA key is stronger than a 2048-bit RSA key.

Key size measures how long a key is, but bits are not comparable across algorithms. NIST guidance (SP 800-57) rates RSA 2048 at about 112 bits of security and RSA 3072 at about 128 bits, while ECDSA on the P-256 curve also gives about 128 bits and P-384 about 192. Symmetric ciphers such as AES-128 and AES-256 are measured on yet another scale, where the key length roughly equals the security level.

Why it matters

The CA/Browser Forum Baseline Requirements set a minimum RSA modulus of 2048 bits for publicly trusted certificates, and RSA 2048 and ECDSA P-256 are the common choices for TLS server keys. Larger RSA keys raise the server's signing cost in every handshake, while elliptic-curve keys stay small and fast, which is why many operators prefer ECDSA. CA keys are often larger because they live much longer: Let's Encrypt's Generation Y roots are RSA-4096 (ISRG Root YR) and ECDSA P-384 (ISRG Root YE). No key size protects RSA or ECDSA against a large quantum computer, which is the motivation for post-quantum cryptography.

Example

openssl x509 -in example.com.crt -noout -text | grep "Public-Key"
#                 Public-Key: (2048 bit)
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out rsa3072.key

Common misconceptions

  • A 256-bit ECC key is weaker than a 2048-bit RSA key. It is stronger; the bit counts measure different things.
  • Bigger is always better. RSA 8192 slows handshakes and gains little in practice; RSA 2048/3072 or ECDSA P-256/P-384 cover current needs.
  • "256-bit SSL" describes the certificate. That marketing phrase usually refers to the symmetric cipher negotiated for the session, not the certificate key.

See also