A colleague argues that a 256-bit elliptic-curve key must be far weaker than a 2048-bit RSA key because 256 is much smaller than 2048. Explain what is wrong with comparing key lengths across algorithm families, and how you would reason about a key pair's security margin instead.

## What 'bits of security' means It is a work-factor statement: 128-bit security means the cheapest known attack costs about 2^128 operations. It is not a statement about key length, and it is only meaningful against known attacks - a break changes the number overnight, which is why agility matters more than a large constant. ## Why the three families diverge - **Symmetric keys.** No structure to exploit, so the attack is exhaustive search: an n-bit key gives about n bits of security. - **Integer factoring and finite-field discrete logs (RSA, classic Diffie-Hellman).** The number-field-sieve family runs in sub-exponential time, so difficulty grows much more slowly than key length. This is why the RSA ladder is steep: about 112 bits of security at 2048, 128 at 3072, 192 at 7680, 256 at 15360. Each step costs disproportionate key size and, because the operation is roughly cubic in modulus size, disproportionate CPU. - **Elliptic-curve discrete logs.** No index-calculus attack is known on well-chosen curves, so the best generic attack is a square-root method costing about 2^(n/2) for an n-bit group. A 256-bit curve therefore gives about 128 bits, a 384-bit curve about 192. That divergence is the whole answer: the same key length means three different things, so comparing the numbers across families is a category error. ## Reasoning about margin 1. **Weakest link.** A 4096-bit RSA key wrapping a 128-bit symmetric key delivers 128-bit security. Oversizing one component is wasted CPU; find the smallest number in the chain, including the hash used inside padding and key derivation. 2. **Secrecy lifetime, not key lifetime.** The requirement is how long the plaintext must remain confidential. An attacker can record ciphertext today and attack it for a decade, so data that must stay secret for twenty years needs margin sized to twenty years of attacker progress. 3. **Cost curve.** Because RSA scales so poorly, raising its level is expensive; curve-based schemes reach the same level with far smaller keys and cheaper operations, which is why new designs default to curves. 4. **Structural risk beats size.** A larger key does not compensate for a private key stored on a general-purpose host, a missing rotation story, or an implementation that leaks through timing. ## The discontinuity worth naming All of those numbers assume classical attackers. A cryptographically relevant quantum computer would break factoring and elliptic-curve discrete logs outright regardless of key size, while symmetric keys and hashes degrade far more gracefully. So the migration path for asymmetric algorithms is a change of algorithm family, not a larger key - and because of harvest-now-decrypt-later, that matters today for anything with a long secrecy lifetime.