What minimum key sizes does the German BSI currently recommend for the main cryptographic algorithms, and what security level do they target?
AES 128+ bits, RSA/DH 3072+ bits, ECC 256+ bits, hash-for-signatures 256+ bits — all chosen to give roughly a 128-bit security level (the point where brute force is physically hopeless).
* For equal security, RSA/DH keys grow far faster than ECC keys (log scale). *
The BSI (Germany's Federal Office for Information Security) publishes yearly guidance in Technical Guideline TR-02102-1; these are its current recommendations. The unifying idea is that every row is dimensioned to the same ~128-bit security level — so the numbers look wildly different only because each problem (brute force vs. factoring vs. discrete log) resists attack differently.
| Algorithm | Minimum Key Size | Security Level |
|---|---|---|
| AES | 128 bits (192/256 better) | 128 bits |
| RSA | 3072 bits (since 2023) | ~128 bits |
| DH / DSA | 3072 bits | ~128 bits |
| ECC | 256 bits (384/512 better) | ~128 bits |
| SHA-2/3 for signatures | 256-bit output | min. 240-bit hash → 120-bit collision |
| HMAC | SHA-2 or SHA-3 | min. 256-bit output |
The hash rule has a subtle floor: since 2023 the minimum hash size is 240 bits, which knocks out 224-bit hashes (and 224-bit ECC, which can only sign a 224-bit hash) — so 256 bits is effectively the practical minimum.
Equivalence table:
| Symmetric | RSA/DH | ECC |
|---|---|---|
| 80 | 1024 | 160 |
| 128 | 3072 | 256 |
| 192 | 7680 | 384 |
| 256 | 15360 | 512 |
Key observation: Doubling the symmetric key size (128 → 256-bit security) takes RSA from 3072 → 15360 bits (≈5×) but ECC only from 256 → 512 bits (2×). This is why ECC scales much better.
Go deeper:
keylength.com — compare key-size recommendations — pick a target year and see every standards body's recommended sizes side by side.
Key size (Wikipedia) — the security-level equivalence between symmetric, RSA and ECC keys.