View source for Key size

{{Short description|Number of bits in a key used by a cryptographic algorithm}}
In [[cryptography]], '''key size''' or '''key length''' refers to the number of [[bit]]s in a [[key (cryptography)|key]] used by a [[Cryptography|cryptographic]] algorithm (such as a [[cipher]]).

Key length defines the upper-bound on an algorithm's [[Security level|security]] (i.e. a logarithmic measure of the fastest known attack against an algorithm), because the security of all algorithms can be violated by [[brute-force attack]]s. Ideally, the lower-bound on an algorithm's security is by design equal to the key length (that is, the algorithm's design does not detract from the degree of security inherent in the key length).

Most [[symmetric-key algorithm]]s are designed to have security equal to their key length. However, after design, a new attack might be discovered. For instance, [[Triple DES]] was designed to have a 168-bit key, but an attack of complexity 2<sup>112</sup> is now known (i.e. Triple DES now only has 112 bits of security, and of the 168 bits in the key the attack has rendered 56 'ineffective' towards security). Nevertheless, as long as the security (understood as "the amount of effort it would take to gain access") is sufficient for a particular application, then it does not matter if key length and security coincide. This is important for [[asymmetric-key algorithm]]s, because no such algorithm is known to satisfy this property; [[elliptic curve cryptography]] comes the closest with an effective security of roughly half its key length.

==Significance==
[[Key (cryptography)|Keys]] are used to control the operation of a cipher so that only the correct key can convert encrypted text ([[ciphertext]]) to [[plaintext]]. All commonly used ciphers are based on publicly known [[algorithm]]s or are [[open-source model|open source]] and so it is only the difficulty of obtaining the key that determines security of the system, provided that there is no analytic attack (i.e. a "structural weakness" in the algorithms or protocols used), and assuming that the key is not otherwise available (such as via theft, extortion, or compromise of computer systems). The widely accepted notion that the security of the system should depend on the key alone has been explicitly formulated by [[Auguste Kerckhoffs]] (in the 1880s) and [[Claude Shannon]] (in the 1940s); the statements are known as [[Kerckhoffs' principle]] and Shannon's Maxim respectively.

A key should, therefore, be large enough that a brute-force attack (possible against any encryption algorithm) is infeasible &ndash; i.e. would take too long and/or would take too much memory to execute. [[Claude Shannon|Shannon's]] work on [[information theory]] showed that to achieve so-called '[[perfect secrecy]]', the key length must be at least as large as the message and only used once (this algorithm is called the [[one-time pad]]). In light of this, and the practical difficulty of managing such long keys, modern cryptographic practice has discarded the notion of perfect secrecy as a requirement for encryption, and instead focuses on [[computational security]], under which the computational requirements of breaking an encrypted text must be infeasible for an attacker.

==Key size and encryption system==
Encryption systems are often grouped into families. Common families include symmetric systems (e.g. [[Advanced Encryption Standard|AES]]) and asymmetric systems (e.g. [[RSA (algorithm)|RSA]] and [[Elliptic-curve cryptography]] [ECC]). They may be grouped according to the central [[algorithm]] used (e.g. [[Elliptic-curve cryptography|ECC]] and [[Feistel cipher]]s). Because each of these has a different level of cryptographic complexity, it is usual to have different key sizes for the same [[level of security]], depending upon the algorithm used. For example, the security available with a 1024-bit key using asymmetric [[RSA (cryptosystem)|RSA]] is considered approximately equal in security to an 80-bit key in a symmetric algorithm.<ref name=NISTSP800-131Ar2/>

The actual degree of security achieved over time varies, as more computational power and more powerful mathematical analytic methods become available. For this reason, cryptologists tend to look at indicators that an algorithm or key length shows signs of potential vulnerability, to move to longer key sizes or more difficult algorithms. For example, {{As of|2007|05|lc=on}}, a 1039-bit integer was factored with the [[special number field sieve]] using 400 computers over 11 months.<ref>{{cite magazine |url=http://www.pcworld.com/article/132184/article.html |title=Researcher: RSA 1024-bit Encryption not Enough |magazine=PC World |date=2007-05-23 |access-date=2016-09-24 |archive-date=2016-06-24 |archive-url=https://web.archive.org/web/20160624173438/http://www.pcworld.com/article/132184/article.html |url-status=dead }}</ref> The factored number was of a special form; the special number field sieve cannot be used on RSA keys. The computation is roughly equivalent to breaking a 700 bit RSA key. However, this might be an advance warning that 1024 bit RSA keys used in secure online commerce should be [[deprecation|deprecated]], since they may become breakable in the foreseeable future. Cryptography professor [[Arjen Lenstra]] observed that "Last time, it took nine years for us to generalize from a special to a nonspecial, hard-to-factor number" and when asked whether 1024-bit RSA keys are dead, said: "The answer to that question is an unqualified yes."<ref>{{cite web |first=Jacqui |last=Cheng |url=https://arstechnica.com/news.ars/post/20070523-researchers-307-digit-key-crack-endangers-1024-bit-rsa.html |title=Researchers: 307-digit key crack endangers 1024-bit RSA |work=Ars Technica |date=2007-05-23 |access-date=2016-09-24}}</ref>

The 2015 [[Logjam (computer security)|Logjam attack]] revealed additional dangers in using Diffie-Hellman key exchange when only one or a few common 1024-bit or smaller prime moduli are in use. This practice, somewhat common at the time, allows large amounts of communications to be compromised at the expense of attacking a small number of primes.<ref name="logjam">{{cite web |url=https://weakdh.org |title=Weak Diffie-Hellman and the Logjam Attack |website=weakdh.org |date=2015-05-20}}</ref><ref>{{cite conference |url=https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf |archive-url=https://ghostarchive.org/archive/20221010/https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf |archive-date=2022-10-10 |url-status=live |first1=David |last1=Adrian |first2=Karthikeyan |last2=Bhargavan |first3=Zakir |last3=Durumeric |first4=Pierrick |last4=Gaudry |first5=Matthew |last5=Green |first6=J. Alex |last6=Halderman |first7=Nadia |last7=Heninger |first8=Drew |last8=Springall |first9=Emmanuel |last9=Thomé |first10=Luke |last10=Valenta |first11=Benjamin |last11=VanderSloot |first12=Eric |last12=Wustrow |first13=Santiago |last13=Zanella-Béguelin |first14=Paul |last14=Zimmermann |conference=22nd ACM Conference on Computer and Communications Security (CCS '15) |location=Denver, CO |date=October 2015 |title=Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice}}</ref>

== Brute-force attack ==
{{More citations needed section|date=August 2012}}
{{Main article|Brute-force attack}}
Even if a symmetric cipher is currently unbreakable by exploiting structural weaknesses in its algorithm, it may be possible to run through the entire [[space (mathematics)|space]] of keys in what is known as a brute-force attack. Because longer symmetric keys require exponentially more work to brute force search, a sufficiently long symmetric key makes this line of attack impractical.

With a key of length ''n'' bits, there are 2<sup>n</sup> possible keys. This number grows very rapidly as ''n'' increases. The large number of operations (2<sup>128</sup>) required to try all possible 128-bit keys is widely considered [[Large numbers#Computers and computational complexity|out of reach]] for conventional digital computing techniques for the foreseeable future.<ref>{{cite magazine |url=http://www.eetimes.com/document.asp?doc_id=1279619 |title=How secure is AES against brute force attacks? |magazine=EE Times |access-date=2016-09-24}}</ref> However, a [[quantum computer]] capable of running [[Grover's algorithm]] would be able to search the possible keys more efficiently. If a suitably sized quantum computer would reduce a 128-bit key down to 64-bit security, roughly a [[Data Encryption Standard|DES]] equivalent. This is one of the reasons why [[Advanced Encryption Standard|AES]] supports key lengths of 256 bits and longer.{{efn|See the discussion on the relationship between key lengths and [[quantum computing]] attacks at the bottom of this page for more information.}}

==Symmetric algorithm key lengths==
IBM's [[Lucifer (cipher)|Lucifer cipher]] was selected in 1974 as the base for what would become the [[Data Encryption Standard]]. Lucifer's key length was reduced from 128 bits to [[56-bit encryption|56 bits]], which the [[National Security Agency|NSA]] and NIST argued was sufficient for non-governmental protection at the time. The NSA has major computing resources and a large budget; some cryptographers including [[Whitfield Diffie]] and [[Martin Hellman]] complained that this made the cipher so weak that NSA computers would be able to break a DES key in a day through brute force [[parallel computing]]. The NSA disputed this, claiming that brute-forcing DES would take them "something like 91 years".<ref>{{cite web |url=http://www.toad.com/des-stanford-meeting.html |title=DES Stanford-NBS-NSA meeting recording & transcript |website=Toad.com |access-date=2016-09-24 |archive-url=https://web.archive.org/web/20120503083539/http://www.toad.com/des-stanford-meeting.html |archive-date=2012-05-03 |url-status=dead }}</ref>

However, by the late 90s, it became clear that DES could be cracked in a few days' time-frame with custom-built hardware such as could be purchased by a large corporation or government.<ref name="fortify">{{cite web |url=http://www.fortify.net/related/cryptographers.html |title=Minimal key lengths for symmetric ciphers to provide adequate commercial security |first1=Matt |last1=Blaze |author-link1=Matt Blaze |first2=Whitefield |last2=Diffie |author-link2=Whitfield Diffie |first3=Ronald L. |last3=Rivest |author-link3=Ron Rivest |first4=Bruce |last4=Schneier |author-link4=Bruce Schneier |first5=Tsutomu |last5=Shimomura |author-link5=Tsutomu Shimomura |first6=Eric |last6=Thompson |first7=Michael |last7=Wiener |date=January 1996 |publisher=[[Fortify (Netscape)|Fortify]] |access-date=14 October 2011 |df=ymd-all}}</ref><ref>[http://object.cato.org/sites/cato.org/files/pubs/pdf/bp51.pdf Strong Cryptography The Global Tide of Change], Cato Institute Briefing Paper no. 51, Arnold G. Reinhold, 1999</ref> The book ''Cracking DES'' (O'Reilly and Associates) tells of the successful ability in 1998 to break 56-bit DES by a brute-force attack mounted by a cyber civil rights group with limited resources; see [[EFF DES cracker]]. Even before that demonstration, 56 bits was considered insufficient length for [[symmetric-key algorithm|symmetric algorithm]] keys for general use. Because of this, DES was replaced in most security applications by [[Triple DES]], which has 112 bits of security when using 168-bit keys (triple key).<ref name=NISTSP800-131Ar2/>

The [[Advanced Encryption Standard]] published in 2001 uses key sizes of 128, 192 or 256 bits. Many observers consider 128 bits sufficient for the foreseeable future for symmetric algorithms of [[Advanced Encryption Standard|AES]]'s quality until [[quantum computer]]s become available.{{citation needed|date=September 2013}} However, as of 2015, the U.S. [[National Security Agency]] has issued guidance that it plans to switch to quantum computing resistant algorithms and now requires 256-bit AES keys for data [[classified information in the United States|classified up to Top Secret]].<ref name=NSASuiteBphaseout/>

In 2003, the U.S. National Institute for Standards and Technology, [[National Institute of Standards and Technology|NIST]] proposed phasing out 80-bit keys by 2015. At 2005, 80-bit keys were allowed only until 2010.<ref>
{{cite journal |url=https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-57p1.pdf |archive-url=https://web.archive.org/web/20161213220801/http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-57p1.pdf |archive-date=2016-12-13 |url-status=live |title=Recommendation for Key Management – Part 1: General |date=2005-08-01 |access-date=2019-01-08 |journal=NIST Special Publication |publisher=[[National Institute of Standards and Technology]] |doi=10.6028/NIST.SP.800-57p1 |first1=Elaine |last1=Barker |first2=William |last2=Barker |first3=William |last3=Burr |first4=William |last4=Polk |first5=Miles |last5=Smid |at=Table 4, p. 66 }}
</ref>

Since 2015, NIST guidance says that "the use of keys that provide less than 112 bits of [[security strength]] for key agreement is now disallowed." NIST approved symmetric encryption algorithms include three-key [[Triple DES]], and [[Advanced Encryption Standard|AES]]. Approvals for two-key Triple DES and [[Skipjack (cipher)|Skipjack]] were withdrawn in 2015; the [[NSA]]'s Skipjack algorithm used in its [[Fortezza]] program employs 80-bit keys.<ref name=NISTSP800-131Ar2>{{cite web|url=http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf |title=Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths, NIST SP-800-131A Rev 2 |date=March 2019 |first1=Elaine |last1=Barker |first2=Allen |last2=Roginsky|website=Nvlpubs.nist.gov|access-date=2023-02-11 |df=ymd-all}}</ref>

==Asymmetric algorithm key lengths==
The effectiveness of [[public key cryptography|public key cryptosystems]] depends on the intractability (computational and theoretical) of certain mathematical problems such as [[integer factorization]]. These problems are time-consuming to solve, but usually faster than trying all possible keys by brute force. Thus, [[asymmetric key]]s must be longer for equivalent resistance to attack than symmetric algorithm keys. The most common methods are assumed to be weak against sufficiently powerful [[quantum computer]]s in the future.

Since 2015, NIST recommends a minimum of 2048-bit keys for [[RSA (algorithm)|RSA]],<ref name="keymanagement">{{cite journal |url=http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf |archive-url=https://web.archive.org/web/20150226074432/http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf |archive-date=2015-02-26 |url-status=live |title=Recommendation for Key Management; Part 3: Application-Specific Key Management Guidance |date=2015-01-22 |page=12 |access-date=2017-11-24 |journal=NIST Special Publication |publisher=[[National Institute of Standards and Technology]] |doi=10.6028/NIST.SP.800-57pt3r1 |first1=Elaine |last1=Barker |first2=Quynh |last2=Dang}}</ref> an update to the widely accepted recommendation of a 1024-bit minimum since at least 2002.<ref>{{cite web|url=http://emc.com/emc-plus/rsa-labs/historical/a-cost-based-security-analysis-key-lengths.htm |title=A Cost-Based Security Analysis of Symmetric and Asymmetric Key Lengths |publisher=[[RSA Security|RSA Laboratories]] |access-date=2016-09-24 |url-status=dead |archive-url=https://web.archive.org/web/20170113075540/https://www.emc.com/emc-plus/rsa-labs/historical/a-cost-based-security-analysis-key-lengths.htm |archive-date=2017-01-13}}</ref>

1024-bit RSA keys are equivalent in strength to 80-bit symmetric keys, 2048-bit RSA keys to 112-bit symmetric keys, 3072-bit RSA keys to 128-bit symmetric keys, and 15360-bit RSA keys to 256-bit symmetric keys.<ref>{{cite journal |url=https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf |archive-url=https://web.archive.org/web/20200509101121/https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf |archive-date=2020-05-09 |url-status=live |title=Recommendation for Key Management: Part 1 – General |page=53 |journal=NIST Special Publication |publisher=[[National Institute of Standards and Technology]] |doi=10.6028/NIST.SP.800-57pt1r5 |first=Elaine |last=Barker |date=May 2020|s2cid=243189598 }}</ref> In 2003, [[RSA Security]] claimed that 1024-bit keys were likely to become crackable sometime between 2006 and 2010, while 2048-bit keys are sufficient until 2030.<ref name="twirl">{{cite web |url=http://emc.com/emc-plus/rsa-labs/historical/twirl-and-rsa-key-size.htm|title=TWIRL and RSA Key Size |publisher=[[RSA Security|RSA Laboratories]] |archive-url=https://web.archive.org/web/20170417095741/https://www.emc.com/emc-plus/rsa-labs/historical/twirl-and-rsa-key-size.htm |archive-date=2017-04-17 |url-status=dead |access-date=2017-11-24 |first=Burt |last=Kaliski |date=May 6, 2003 |df=ymd-all}}</ref> {{As of|2020}} the largest RSA key publicly known to be cracked is [[RSA-250]] with 829 bits.<ref>{{cite web |title=Factorization of RSA-250 |date=2020-02-28 |first=Paul |last=Zimmermann |publisher=Cado-nfs-discuss |url=https://lists.gforge.inria.fr/pipermail/cado-nfs-discuss/2020-February/001166.html |access-date=2020-07-12 |archive-date=2020-02-28 |archive-url=https://web.archive.org/web/20200228234716/https://lists.gforge.inria.fr/pipermail/cado-nfs-discuss/2020-February/001166.html |url-status=dead }}</ref>

The Finite Field [[Diffie-Hellman]] algorithm has roughly the same key strength as RSA for the same key sizes. The work factor for breaking Diffie-Hellman is based on the [[discrete logarithm problem]], which is related to the integer factorization problem on which RSA's strength is based. Thus, a 2048-bit Diffie-Hellman key has about the same strength as a 2048-bit RSA key.

[[Elliptic-curve cryptography]] (ECC) is an alternative set of asymmetric algorithms that is equivalently secure with shorter keys, requiring only approximately twice the bits as the equivalent symmetric algorithm. A 256-bit [[Elliptic-curve Diffie–Hellman]] (ECDH) key has approximately the same safety factor as a 128-bit [[Advanced Encryption Standard|AES]] key.<ref name="keymanagement"/> A message encrypted with an elliptic key algorithm using a 109-bit long key was broken in 2004.<ref>{{cite web|url=https://www.certicom.com/news-releases/300-solution-required-team-of-mathematicians-2600-computers-and-17-months- |title=Certicom Announces Elliptic Curve Cryptography Challenge Winner |date=2004-04-27 |access-date=2016-09-24 |publisher=[[BlackBerry Limited]] |url-status=dead |archive-url=https://web.archive.org/web/20160927063421/https://www.certicom.com/news-releases/300-solution-required-team-of-mathematicians-2600-computers-and-17-months- |archive-date=2016-09-27}}</ref>

The [[National Security Agency|NSA]] previously recommended 256-bit ECC for protecting classified information up to the SECRET level, and 384-bit for TOP SECRET;<ref name=NSASuiteBphaseout>{{cite web|url=http://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml |title=NSA Suite B Cryptography |date=2009-01-15 |access-date=2016-09-24 |url-status=dead |archive-url=https://web.archive.org/web/20090207005135/http://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml |archive-date=2009-02-07 |publisher=[[National Security Agency]]}}</ref> In 2015 it announced plans to transition to quantum-resistant algorithms by 2024, and until then recommends 384-bit for all classified information.<ref name="NSAComSuite">{{cite web|url=https://apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa-suite.cfm |archive-url=https://web.archive.org/web/20220218193742/https://apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa-suite.cfm |archive-date=2022-02-18 |title=Commercial National Security Algorithm Suite |date=2015-08-09 |access-date=2020-07-12 |publisher=[[National Security Agency]]}}</ref>

== Effect of quantum computing attacks on key strength ==
The two best known quantum computing attacks are based on [[Shor's algorithm]] and [[Grover's algorithm]]. Of the two, Shor's offers the greater risk to current security systems.

Derivatives of Shor's algorithm are widely conjectured to be effective against all mainstream public-key algorithms including [[RSA (algorithm)|RSA]], [[Diffie-Hellman]] and [[elliptic curve cryptography]]. According to Professor Gilles [[Gilles Brassard|Brassard]], an expert in quantum computing: "The time needed to factor an RSA integer is the same order as the time needed to use that same integer as modulus for a single RSA encryption. In other words, it takes no more time to break RSA on a quantum computer (up to a multiplicative constant) than to use it legitimately on a classical computer." The general consensus is that these public key algorithms are insecure at any key size if sufficiently large quantum computers capable of running Shor's algorithm become available. The implication of this attack is that all data encrypted using current standards based security systems such as the ubiquitous [[Transport Layer Security|SSL]] used to protect e-commerce and Internet banking and [[Secure Shell|SSH]] used to protect access to sensitive computing systems is at risk. Encrypted data protected using public-key algorithms can be archived and may be broken at a later time, commonly known as retroactive/retrospective decryption or "[[harvest now, decrypt later]]".

Mainstream symmetric ciphers (such as [[Advanced Encryption Standard|AES]] or [[Twofish]]) and collision resistant hash functions (such as [[Secure Hash Algorithm|SHA]]) are widely conjectured to offer greater security against known quantum computing attacks. They are widely thought most vulnerable to [[Grover's algorithm]]. Bennett, Bernstein, Brassard, and Vazirani proved in 1996 that a brute-force key search on a quantum computer cannot be faster than roughly 2<sup>''n''/2</sup> invocations of the underlying cryptographic algorithm, compared with roughly 2<sup>''n''</sup> in the classical case.<ref name=bennett_1997>Bennett C.H., Bernstein E., Brassard G., Vazirani U., ''[http://www.cs.berkeley.edu/~vazirani/pubs/bbbv.ps The strengths and weaknesses of quantum computation]''. [[SIAM Journal on Computing]] 26(5): 1510-1523 (1997).</ref> Thus in the presence of large quantum computers an ''n''-bit key can provide at least ''n''/2 bits of security. Quantum brute force is easily defeated by doubling the key length, which has little extra computational cost in ordinary use. This implies that at least a 256-bit symmetric key is required to achieve 128-bit security rating against a quantum computer. As mentioned above, the NSA announced in 2015 that it plans to transition to quantum-resistant algorithms.<ref name=NSASuiteBphaseout />

In a 2016 Quantum Computing FAQ, the NSA affirmed:
{{blockquote|"A sufficiently large quantum computer, if built, would be capable of undermining all widely-deployed public key algorithms used for key establishment and digital signatures. [...] It is generally accepted that quantum computing techniques are much less effective against symmetric algorithms than against current widely used public key algorithms. While public key cryptography requires changes in the fundamental design to protect against a potential future quantum computer, symmetric key algorithms are believed to be secure provided a sufficiently large key size is used. [...] The public-key algorithms ([[RSA (cryptosystem)|RSA]], [[Diffie-Hellman]], [[ECDH|[Elliptic-curve Diffie–Hellman] ECDH]], and [[Elliptic Curve Digital Signature Algorithm|[Elliptic Curve Digital Signature Algorithm] ECDSA]]) are all vulnerable to attack by a sufficiently large quantum computer. [...] While a number of interesting quantum resistant public key algorithms have been proposed external to NSA, nothing has been standardized by [[National Institute of Standards and Technology|NIST]], and NSA is not specifying any commercial quantum resistant standards at this time. NSA expects that NIST will play a leading role in the effort to develop a widely accepted, standardized set of quantum resistant algorithms. [...] Given the level of interest in the cryptographic community, we hope that there will be quantum resistant algorithms widely available in the next decade. [...] The AES-256 and SHA-384 algorithms are symmetric, and believed to be safe from attack by a large quantum computer."<ref name=cnsaquantum>{{cite web|url=https://ia801409.us.archive.org/26/items/cnsa-suite-and-quantum-computing-faq/CNSA-Suite-and-Quantum-Computing-FAQ.pdf |title=Commercial National Security Algorithm Suite and Quantum Computing FAQ |pages=6–8 |date=2016-01-01 |publisher=[[National Security Agency]] |access-date=2024-04-21}}</ref>}}

In a 2022 press release, the NSA notified:
{{blockquote|"A cryptanalytically-relevant quantum computer (CRQC) would have the potential to break public-key systems (sometimes referred to as asymmetric cryptography) that are used today. Given foreign pursuits in quantum computing, now is the time to plan, prepare and budget for a transition to [quantum-resistant] QR algorithms to assure sustained protection of [National Security Systems] NSS and related assets in the event a CRQC becomes an achievable reality."<ref name=cnsasuite>{{cite web|url=https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3148990/nsa-releases-future-quantum-resistant-qr-algorithm-requirements-for-national-se/ |title=NSA Releases Future Quantum-Resistant (QR) Algorithm Requirements for National Security Systems |date=2022-09-07 |publisher=[[National Security Agency]] |access-date=2024-04-14}}</ref>}}

Since September 2022, the NSA has been transitioning from the [[Commercial National Security Algorithm Suite]] (now referred to as CNSA 1.0), originally launched in January 2016, to the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0), both summarized below:<ref name=nsaCNSA>{{cite web|url=https://media.defense.gov/2022/Sep/07/2003071834/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS_.PDF |archive-url=https://archive.today/20221121213740/https://media.defense.gov/2022/Sep/07/2003071834/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS_.PDF |url-status=dead |archive-date=November 21, 2022 |title=Announcing the Commercial National Security Algorithm Suite 2.0, U/OO/194427-22, PP-22-1338, Ver. 1.0 |date=September 2022 |publisher=[[National Security Agency]]|website=media.defense.gov|access-date=2024-04-14|at=Table IV: CNSA 2.0 algorithms, p. 9.; Table V: CNSA 1.0 algorithms, p. 10.}}</ref>{{efn|See the complete tables and the transition timeline at [[Commercial National Security Algorithm Suite]] article.}}

'''CNSA 2.0'''
{| class="wikitable"
|-
! Algorithm
! Function
! Parameters
|-
| Advanced Encryption Standard (AES)
| Symmetric block cipher for information protection
| 256-bit keys
|-
| CRYSTALS-Kyber
| Asymmetric algorithm for key establishment
| Level V
|-
| CRYSTALS-Dilithium
| Asymmetric algorithm for digital signatures
| Level V
|-
| Secure Hash Algorithm (SHA)
| Algorithm for computing a condensed representation of information
| SHA-384 or SHA-512
|-
| Leighton-Micali Signature (LMS)
| Asymmetric algorithm for digitally signing firmware and software
| All parameters approved. SHA256/192 recommended.
|-
| Xtended Merkle Signature Scheme (XMSS)
| Asymmetric algorithm for digitally signing firmware and software
| All parameters approved
|}

'''CNSA 1.0'''
{| class="wikitable"
|-
! Algorithm
! Function
! Parameters
|-
| Advanced Encryption Standard (AES)
| Symmetric block cipher for information protection
| 256-bit keys
|-
| Elliptic Curve Diffie-Hellman (ECDH) Key Exchange
| Asymmetric algorithm for key establishment
| Curve P-384
|-
| Elliptic Curve Digital Signature Algorithm (ECDSA)
| Asymmetric algorithm for digital signatures
| Curve P-384
|-
| Secure Hash Algorithm (SHA)
| Algorithm for computing a condensed representation of information
| SHA-384
|-
| Diffie-Hellman (DH) Key Exchange
| Asymmetric algorithm for key establishment
| Minimum 3072-bit modulus
|-
| [Rivest-Shamir-Adleman] RSA
| Asymmetric algorithm for key establishment
| Minimum 3072-bit modulus
|-
| [Rivest-Shamir-Adleman] RSA
| Asymmetric algorithm for digital signatures
| Minimum 3072-bit modulus
|}

==See also==
* [[Key stretching]]

==Notes==
{{notelist}}

==References==
{{Reflist|30em}}

==Further reading==
* [http://csrc.nist.gov/publications/PubsSPs.html ''Recommendation for Key Management &mdash; Part 1: general,''] {{Webarchive|url=https://web.archive.org/web/20170912090949/http://csrc.nist.gov/publications/PubsSPs.html |date=2017-09-12 }} NIST Special Publication 800-57. March, 2007
* Blaze, Matt; Diffie, Whitfield; Rivest, Ronald L.; et al. "Minimal Key Lengths for Symmetric Ciphers to Provide Adequate Commercial Security". January, 1996
* Arjen K. Lenstra, Eric R. Verheul: Selecting Cryptographic Key Sizes. J. Cryptology 14(4): 255-293 (2001) &mdash; [http://citeseer.ist.psu.edu/lenstra99selecting.html Citeseer link]

==External links==
* [https://www.keylength.com/ www.keylength.com: An online keylength calculator]
* [https://web.archive.org/web/20140101053420/http://www.synaptic-labs.com/resources/expert-opinions/94-quantum-computing.html Articles discussing the implications of quantum computing]
* NIST [http://csrc.nist.gov/groups/ST/toolkit cryptographic toolkit] {{Webarchive|url=https://web.archive.org/web/20150820045057/http://csrc.nist.gov/groups/ST/toolkit/ |date=2015-08-20 }}
* [[Burt Kaliski]]: [https://apj.emc.com/emc-plus/rsa-labs/historical/twirl-and-rsa-key-size.htm TWIRL and RSA key sizes] (May 2003)

{{Cryptography navbox}}

{{DEFAULTSORT:Key Size}}
[[Category:Key management]]