What is key length?
Key length, also called key size, is the number of bits in a cryptographic key. A key of n bits can take 2^n different values, and an attacker who knows the algorithm but not the key has to search that space. Every extra bit doubles the number of candidates, so the gap between short and long keys is exponential rather than gradual. Administrators set it directly in cipher suites, certificate requests and key generation commands, so it turns up in configuration reviews and scan findings.
What brute force costs at different lengths
The table assumes a hypothetical cracking rig that tests one trillion (10^12) keys per second and has to try every key. On average the right key turns up about halfway through.
| Key length | Possible keys | Time to try them all |
|---|---|---|
| 40 bits (1990s export grade) | About 1.1 × 10^12 | About 1 second |
| 56 bits (DES) | About 7.2 × 10^16 | About 20 hours |
| 80 bits | About 1.2 × 10^24 | About 38,000 years |
| 128 bits (AES-128) | About 3.4 × 10^38 | About 10^19 years |
That is why 56-bit DES fell to purpose-built hardware in the late 1990s, while 128-bit keys are beyond brute force.
Bit counts only compare within one family
A 2048-bit RSA key sounds sixteen times stronger than a 128-bit AES key, but it is weaker. Nobody attacks RSA by trying every possible key; they factor the modulus, and the best factoring methods need vastly fewer than 2^2048 steps. Elliptic curve keys fall in between. Strength is therefore expressed as bits of security, the brute-force effort an equivalent symmetric key would require. NIST SP 800-57 lines the families up like this:
| Symmetric | RSA or classic Diffie-Hellman | Elliptic curve | Bits of security |
|---|---|---|---|
| Three-key 3DES, now deprecated | RSA-2048, today's minimum | 224-bit curve | 112 |
| AES-128 | RSA-3072 | P-256 | 128 |
| AES-192 | RSA-7680 | P-384 | 192 |
| AES-256 | RSA-15360 | P-521 | 256 |
Current guidance follows from those equivalents: AES-128 or AES-256 for data, RSA keys of at least 2048 bits and 3072 or more for keys that must hold up beyond 2030, and curves such as P-256, P-384 or Curve25519.
Choosing a length in practice
Longer keys cost time. AES-256 runs 14 rounds to AES-128's 10, a difference that hardware acceleration mostly hides, but RSA gets slower quickly as keys grow, which is one reason many sites now use 256-bit ECDSA keys on their certificates instead of 3072-bit RSA. The usual approach is to match strength to how long the data must stay secret. Session traffic and short-lived certificates are well served by 128-bit strength, while archives, root CA keys and records protected for decades justify 192 or 256 bits. Tools make the choice explicit: ssh-keygen -t rsa -b 4096 creates a 4096-bit RSA key, with -b setting the length.
What a longer key does not fix
- Weak key generation. A 256-bit key derived straight from a guessable password, or produced by a poor random number generator, is only as hard to find as its source.
- Broken algorithms and modes. 3DES and RC4 are retired for structural flaws, and AES in ECB mode leaks patterns at any key length.
- Stolen keys. Length defends against guessing, not copying. A private key lifted from a server or backup is useful to an attacker whatever its size.
- Quantum attacks on public keys. Grover's algorithm would roughly halve the effective strength of symmetric keys, leaving AES-256 a wide margin. Shor's algorithm would break RSA and elliptic curve keys of any practical length, so the answer there is post-quantum algorithms, not bigger keys.
Key length vs. block size vs. digest length
Three different bit counts get confused. Key length is the size of the secret. Block size is how much data a block cipher processes at once: AES always uses 128-bit blocks, whether its key is 128, 192 or 256 bits long. Digest length is the size of a hash output, and because of the birthday problem a hash gives only about half its length in collision resistance, so SHA-256 offers roughly 128-bit collision strength.
Key length on the CompTIA Security+ exam
Key length is taught with symmetric and asymmetric encryption under SY0-801 objective 1.3, the objective on choosing appropriate cryptographic solutions. Wording such as "records must stay confidential for decades" or "increase resistance to brute-force attacks" points to a longer key, usually AES-256. "The same strength with smaller keys on mobile or IoT devices" points to elliptic curve cryptography rather than a longer RSA key. Watch for distractors that offer a longer key as the fix for problems it doesn't touch: a stolen private key, missing forward secrecy, a weak password behind the key or a deprecated algorithm such as 3DES. And never compare key sizes across algorithm families bit for bit.