ASVS 5.0 V11.2.3 (Level 2) requires every cryptographic primitive in the application to provide at least 128 bits of security. Security bits depend on algorithm and key size together: a 256 bit elliptic curve key gives roughly 128 bits, while RSA needs 3072 bits to reach the same level.
Why it matters
A 2048 bit RSA key or a 112 bit symmetric cipher feels fine in a code review and quietly falls short of the bar. Attackers keep getting cheaper compute, so the margin is the point.
How to implement it
Use this as a quick reference:
| Use | Meets 128 bits | Falls short |
|---|---|---|
| Symmetric | AES 128, AES 256 | 3DES, RC4 |
| RSA | 3072 bits and up | 2048 bits and under |
| ECC | P-256, Ed25519 | 192 bit curves |
| Hash (collision) | SHA-256 and up | SHA-1, MD5 |
Generate keys with an explicit size, never a library default you have not read:
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out key.pem
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out rsa.pem
How to test it
Scan the inventory and certificates for key sizes. For a live host, openssl s_client -connect host:443 shows the certificate key type and size. Search code for KeyPairGenerator.getInstance("RSA") style calls and confirm the size passed in.
Common mistakes
- Trusting a library default that is still 2048 bits
- Counting key length without checking the algorithm
- Forgetting legacy internal certificates
Quick check
How many RSA bits give about 128 bits of security?
Sources
- OWASP ASVS
- NIST SP 800-57 Part 1
