Part 1: General - Computer Security Resource Center - National ...

Table 2: Comparable strengths
Bits of
security
Symmetric
key
algorithms
80 2TDEA 19
FFC
(e.g., DSA, D-H)
L = 1024
N = 160
112 3TDEA L = 2048
N = 224
128 AES-128 L = 3072
N = 256
192 AES-192 L = 7680
N = 384
256 AES-256 L = 15360
N = 512
IFC
(e.g.,
RSA)
March, 2007
ECC
(e.g.,
ECDSA)
k = 1024 f = 160-223
k = 2048 f = 224-255
k = 3072 f = 256-383
k = 7680 f = 384-511
k = 15360 f = 512+
For hash functions, the size of the hash function will be determined by the algorithm or scheme
in which the hash function is used. For this reason, the standard for the algorithm must specify
the appropriate hash size or security strength to use. For example, the appropriate hash algorithm
for a digital signature algorithm depends upon the chosen key and parameter size, and the
security strength to be provided by the digital signature. To further illustrate this concept, Table
3 indicates the hash size with comparable strength for the listed parameter and key sizes for
digital signatures, HMAC, key derivation functions, and random number generation.
19 The assessment of at least 80-bits of security for 2TDEA is based on the assumption that an attacker has at most
2 40 matched plaintext and ciphertext blocks (see [ANSX9.52], Annex B).
63