Can I say that 128 bit using AES provide more security than 1024 using RSA?

  • This isn't really about key-size. For example Threefish with a 1024 bit key has performance comparable to AES, not RSA. – CodesInChaos Jun 25 '13 at 19:36
  • i meant security by performance not time consuming – BOB Jun 25 '13 at 20:22
  • 2
    Performance is measured by execution within a timeframe on a certain machine. How else would you measure performance? – Lucas Kauffman Jun 25 '13 at 22:18
  • Table 2: Comparable strengths - AES & RSA ( page 63 ) Source - csrc.nist.gov/publications/nistpubs/800-57/… – guest Sep 7 '17 at 1:24
  • Note 57 part 1 has been revised twice more, July 2012 and Jan 2016, although the revisions did not change this chart except to add color-coding. I would link to the SP page, but they're just about to change the website and judging by the beta subdomain it looks like the link format will change. – dave_thompson_085 Sep 7 '17 at 2:45

They're not really directly comparable. The number commonly bandied about is 2048-bit RSA is about equivalent to 128-bit AES. But that number shouldn't be relied on without understanding the caveats.

Currently the most effective way of breaking AES crypto (and any other unbroken symmetric cipher, for that matter) is brute-force. You simply try every possibility until you reach the correct result.

This means that it is possible, and well within today's technology, to encrypt data that (assuming no better attack is ever found--not a horrible assumption), can never be broken, ever, by anyone. Simply use enough bits in your key such that there isn't enough energy in the universe to try enough candidate keys. The numbers are smaller than you'd think:

Indeed, with AES, 128-bit is secure against modern technology, 256 is secure against any likely future technology, and 512 is probably secure against even never-imagined hypothetical alien technology.

Symmetric encryption, if not broken, doesn't leave you with a math problem to solve. The numbers are truly and literally scrambled, and the system is devised such the brute-force is by far the most efficient solution.

Breaking RSA, on the other hand, is not so hard. Instead of brute-forcing the keys, you factor the modulus into primes and derive the keys yourself. This is dramatically simpler to do. It's a math problem, and we can do math.

Specifically, the speed at which primes can be factored is increasing FASTER than the speed at which symmetric keys can be brute-forced. And that's with today's technology.

But going forward, assuming quantum computers can be improved such that qbit operations are a cheap as bit operations (which many people thinks is fairly close; this century at most, possibly decades), then no matter how large you make your RSA key, breaking the key is as fast as encrypting.

So the moral of the story is this:

The "equivalent security" of RSA key length versus AES key length changes over time. Every so often, you have to increase your RSA key size relative to your AES key size to account for technological advances. And even then, it's an estimate at best.

And while a 256-bit symmetric key should be secure for hundreds, thousands, or perhaps hundreds of thousands of years, no RSA key of any length should be assumed to be secure more than a few dozen years out, since RSA is expected to be completely and utterly broken by Shor's algorithm.

  • Small nitpick: There is no AES-512. – Scott Arciszewski Oct 23 '15 at 13:06
  • so when you say 256-bit symmetric "if not broken... brute-force is by far the most efficient solution... should be secure for hundreds of thousands of years". i wanted to understand why you said you are safe for "hundreds of thousands of years". Assuming a computer that tries 1000 times a second it would take: 3.7e66 years = 2**256 / (1000 * 60 * 60 * 24 * 365.25) to crack AES-256. Is my statement correct? – Trevor Boyd Smith Sep 20 at 17:32
  • what is the calculation for rsa-4096 assuming they use some algorithm like you mentioned (e.g. "shor's" algorithm)? – Trevor Boyd Smith Sep 20 at 17:32

Any commonly used symmetric encryption algorithm (DES,3DES, AES,...) is normally faster than RSA.

From a similar question on stack overflow:

Yes, purely asymmetric encryption is much slower than symmetric cyphers (like DES or AES), which is why real applications use hybrid cryptography: The expensive public-key operations are performed only to encrypt (and exchange) an encryption key for the symmetric algorithm that is going to be used for encrypting the real message.

The problem that public-key cryptography solves is that there is no shared secret. With a symmetric encryption you have to trust all involved parties to keep the key secret. This issue should be a much bigger concern than performance (which can be mitigated with a hybrid approach)


Also have a look at this paper: http://ijsr.net/archive/v2i4/IJSRON120134.pdf The following graph on performance was taken from it: enter image description here

  • Any [common symmetric algorithm] is faster than AES? Typo? :) – Steve Jun 25 '13 at 18:28
  • that's not the case, i am working on a certain protocol that use asymmetric encryption and proposed a scheme to distribute key and use symmetric enc, and i need to compare performance can i compare 1024 RSA to 128 AES and say they provide the same security looking at some paper i found that 128 bit AES need time to be cracked the same as 2300 bit RSS. another question from what you have posted does encryption consume more time then decryption – BOB Jun 25 '13 at 20:11
  • The numbers suggest it does. – Lucas Kauffman Jun 25 '13 at 20:13

Can I say that 128 bit using AES provide more security than 1024 using RSA?


The effective security provided by AES-128 is approximately 126-bits due to some reduced rounds attacks on AES. That is, it lost a couple of bits of theoretical security.

The effective security provided by 1024-RSA is 80-bits. Breaking RSA reduces to factoring RSA or discrete logs in finite fields. The best method is the number field sieve (NFS).

126-bits of security is stronger/greater than 80-bits of security.

Effective security levels are moving target. As cryptanalysis advances, so will the loss in theoretical security. An example of a considerable loss is SHA-1. SHA-1 provides 80-bits of theoretical security due to collisions and birthday attacks. But due to Marc Stevens' 2011 HashClash attack, SHA-1 has about 61-bits of effective security.

61-bits of security is not enough to maintain security over digital certificates that require long-surviving signatures because a workload of 261 is within reach of many attackers.

Oddly, Mozilla's is Phasing out Certificates with 1024-bit RSA Keys blog. So they are risk adverse to 80-bits of security on long lived CA certificates. But SHA-1, with 61-bits of security, is OK. You do the math....

More generally, there are tables of equivalent security levels available. You can find the NIST tables below. Other organizations that publish the criteria include NESSIE, ECRYPT, ISO/IEC.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.