3072-bit RSA Keys: NIST Recommendation

3072-bit RSA Keys: The NIST Recommendation

NIST Special Publication 800-57 (Recommendation for Key Management) identifies 3072-bit RSA keys as providing 128 bits of symmetric security, which is the target strength for protecting sensitive data beyond 2030.

Why 3072-bit?

The 3072-bit key size occupies an important middle ground:

• 2048-bit provides 112-bit security — acceptable through ~2030 but insufficient for longer-term protection
• 3072-bit provides 128-bit security — matches the AES-128 standard and is recommended for new systems
• 4096-bit provides ~140-bit security — exceeds requirements for most scenarios

128-bit security is the globally recognized target. It means an attacker would need to perform approximately 2^128 operations to break the encryption — a feat considered infeasible for classical computers.

Standards and Compliance

Several standards bodies recommend or require 3072-bit RSA:

• NIST SP 800-57 — recommends 3072-bit for key establishment beyond 2030
• CNSA 1.0 (NSA) — required 3072-bit RSA as minimum for classified information
• BSI (German Federal Office) — recommends 3072-bit for long-term security
• ANSSI (French National Agency) — recommends 3072-bit for sensitive applications

Generating 3072-bit Keys

// Web Crypto API
const keyPair = await crypto.subtle.generateKey(
  {
    name: "RSASSA-PKCS1-v1_5",
    modulusLength: 3072,
    publicExponent: new Uint8Array([1, 0, 1]),
    hash: "SHA-256",
  },
  true,
  ["sign", "verify"]
);

# OpenSSL
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out key.pem

Practical Considerations

3072-bit keys offer approximately 70% of the performance of 2048-bit keys for signing and decryption operations. For most applications, this difference is imperceptible. The signature size is 384 bytes (vs 256 bytes for 2048-bit), which has minimal impact on bandwidth.

When to Adopt 3072-bit

New deployments should default to 3072-bit unless there is a specific reason to use a different size. Legacy systems on 2048-bit keys should migrate to 3072-bit at their next rotation cycle.