I have seen that for RSA2K the hash function SHA-256 has been used. Now my question is if I want to use RSA3K, should I change the size of the hash function for example from SHA-256 to SHA-384? Is there a relationship that one needs to consider between RSA key size and has function size? Are these parameters defined in IEEE standards?

2 Answers 2


There is no relation that matters between the size of the RSA key and the size of the hash.

There is a technical constraint: a large hash can't be used with a small key. Depending on the signature algorithm, a certain number of hashes, plus some padding, have to fit within the key size. But even a 1024-bit key is sufficient in all standard cases except for PSS with SHA-512. Any larger key is fine.

Some standards discuss the security strength of algorithms and recommend to match them. However, the notion of security strength is not really relevant and is thankfully fallen out of use. In most cases, there are really only two security strengths: breakable or unbreakable. Pick the second one.

(You can find some organizations' idea of compared security strengths https://www.keylength.com/en/compare/ . Note how different organizations match different symmetric key strengths to the same RSA key size. There's a consensus that 2048-bit RSA is likely easier to break than 128-bit symmetric cryptography, and 3072-bit likely more difficult, but not on the precise numbers. The strength of SHA is half its size for collision resistance, and its full size for first or second preimage resistance.)

SHA-256 is unbreakable using today's technology and mathematics. There is no publicly known potential advance on cryptanalysis that would threaten SHA-256 but not SHA-512. There is no known potential advance on technology that would threaten SHA-256 but not RSA. So there is no point in using SHA-512 for extra security.

Quantum computers, if they're possible the way we imagine they might be, might threaten SHA-256 in applications that require collision resistance. But they'd have to be very powerful quantum computers. And way before that, they would easily break RSA.


Because the size of the modulus of an RSA key is substantially larger than most hash functions, it's possible to use most common hash functions with any RSA key of a secure size. For example, you could take your 2048-bit RSA key and use SHA-256, SHA-512, SHA-3-512, or any other hash function you like, provided the relevant parameters are defined.

However, if you're trying to match security strengths, then a 3072-bit RSA key provides about 128 bits of security. So you could use SHA-256, which also provides 128 bits of security to match. If you're using a larger key, then SHA-384 might be more desirable. Typically, by the time you get much above 128-bit security, RSA keys tend to grow large (and hence slow), so usually we use elliptic curve algorithms for 192-bit security and above, and it is unlikely that you'll actually gain practical security by using SHA-512 with most RSA keys.

Ultimately, however, because RSA is so flexible in the hash algorithms that can be used (which contrasts with how elliptic curve algorithms are typically used), the choice of hash algorithm is often left to other considerations. For example, without hardware acceleration, SHA-384 and SHA-512 are faster on 64-bit machines than SHA-256, so for signing large amounts of data, those may be better choices. Similarly, in TLS, SHA-512 is less likely to be implemented and so SHA-256 and SHA-384 tend to be preferable for compatibility reasons.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .