Cryptographic Clé Taille Recommendations
NIST et ECRYPT recommended clé sizes pour symmetric, asymmetric, et hachage algorithmes à travers 2030+.
Security Level Bands
Key sizes are grouped by equivalent security level measured in bits of symmetric security. The 128-bit band is the minimum acceptable level for general use today, while 192 and 256-bit bands provide margin against future cryptanalysis. NIST maps these bands to specific algorithm parameter sizes in publication SP 800-57. Choosing a band above the minimum is prudent for long-term secrets that must remain confidential past 2030.
- 128-bit
- AES-128, RSA-3072, ECC-256, SHA-256
- 192-bit
- AES-192, RSA-7680, ECC-384, SHA-384
- 256-bit
- AES-256, RSA-15360, ECC-512, SHA-512
minimum 2026intermediatelong-termAsymmetric Growth
RSA key sizes must grow faster than symmetric key sizes to maintain equivalent security due to sub-exponential factoring algorithms. A 3072-bit RSA key provides roughly 128 bits of security, while a 256-bit elliptic curve key provides the same level. This asymmetry makes ECC increasingly attractive for constrained environments. The cost of RSA operations scales roughly with the cube of the key size.
Hash Output Sizes
A hash function needs an output of at least 2n bits to provide n bits of collision resistance, because birthday attacks find collisions in about 2 to the n/2 work. SHA-256 therefore provides 128-bit collision resistance, matching AES-128. For preimage resistance, the full output length counts, so SHA-256 gives 256-bit preimage security. Signature schemes inherit their security from both the hash and the signing algorithm.