# What Is Key Size (Key length)? Definition and Examples

> Key size is a key's length in bits; its strength depends on the algorithm, so a 256-bit ECDSA key is stronger than a 2048-bit RSA key.

Source: https://ssl.sh/glossary/key-size/
Last updated: 2026-11-10

Key size measures how long a key is, but bits are not comparable across algorithms. NIST guidance (SP 800-57) rates [RSA](https://ssl.sh/glossary/rsa/) 2048 at about 112 bits of security and RSA 3072 at about 128 bits, while [ECDSA](https://ssl.sh/glossary/ecdsa/) on the [P-256](https://ssl.sh/glossary/p-256/) curve also gives about 128 bits and P-384 about 192. Symmetric ciphers such as AES-128 and AES-256 are measured on yet another scale, where the key length roughly equals the security level.

## Why it matters
The CA/Browser Forum Baseline Requirements set a minimum RSA modulus of 2048 bits for publicly trusted certificates, and RSA 2048 and ECDSA P-256 are the common choices for TLS server keys. Larger RSA keys raise the server's signing cost in every handshake, while elliptic-curve keys stay small and fast, which is why many operators prefer ECDSA. CA keys are often larger because they live much longer: Let's Encrypt's Generation Y roots are RSA-4096 (ISRG Root YR) and ECDSA P-384 (ISRG Root YE). No key size protects RSA or ECDSA against a large quantum computer, which is the motivation for [post-quantum cryptography](https://ssl.sh/glossary/post-quantum-cryptography/).

## Example
```bash
openssl x509 -in example.com.crt -noout -text | grep "Public-Key"
#                 Public-Key: (2048 bit)
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out rsa3072.key
```

## Common misconceptions
- **A 256-bit ECC key is weaker than a 2048-bit RSA key.** It is stronger; the bit counts measure different things.
- **Bigger is always better.** RSA 8192 slows handshakes and gains little in practice; RSA 2048/3072 or ECDSA P-256/P-384 cover current needs.
- **"256-bit SSL" describes the certificate.** That marketing phrase usually refers to the symmetric cipher negotiated for the session, not the certificate key.

## Related terms

- [RSA](https://ssl.sh/zh/glossary/rsa/): RSA 是 1977 年提出的公钥算法，TLS 用它对证书和握手进行签名，在 TLS 1.3 之前还用它传输会话密钥。
- [ECDSA](https://ssl.sh/zh/glossary/ecdsa/): ECDSA 是基于椭圆曲线的数字签名算法，在 TLS 证书中作为 RSA 的替代方案，密钥和签名更小、签名运算更快。
- [ECC](https://ssl.sh/zh/glossary/ecc/): ECC 即椭圆曲线密码学，是基于有限域上椭圆曲线代数结构的公钥密码技术，能用较短的密钥提供很高的安全强度。
- [P-256](https://ssl.sh/zh/glossary/p-256/): P-256 是 NIST 标准化的 256 位素数域椭圆曲线，也叫 secp256r1 或 prime256v1，广泛用于 ECDSA 证书和 ECDHE 密钥交换。
- [Ed25519](https://ssl.sh/zh/glossary/ed25519/): Ed25519 是在 Curve25519 爱德华兹形式上实现的 EdDSA 签名方案，由 RFC 8032 定义，公钥 32 字节，签名 64 字节且为确定性签名。
- [后量子密码](https://ssl.sh/zh/glossary/post-quantum-cryptography/): 后量子密码（PQC）是专为抵御大规模量子计算机攻击而设计的公钥密码算法，用来替代可能被量子计算机破解的 RSA 和 ECC。
- [私钥](https://ssl.sh/zh/glossary/private-key/): 私钥是非对称密钥对中保密的那一半，TLS 服务器用它证明自己拥有证书里的那把公钥。