For AES, use keys of at least 128 bits, ideally 256. For RSA, use at least 2048 bits and a proper padding scheme. Those are the OWASP minimums. In practice key size is rarely what fails: modes, nonces, and key storage cause far more incidents than a 128 versus 256 choice.
The numbers from OWASP
| Algorithm | OWASP guidance |
|---|---|
| AES | Key of at least 128 bits, ideally 256 bits, with a secure mode |
| RSA | If RSA must be used, key of at least 2048 bits |
| RSA encryption | Use RSAES-OAEP, and never RSA without a padding scheme |
| Certificates | RSA keys of at least 2048 bits, signed with SHA-256 |
OWASP's wording on RSA is "if RSA must be used", which signals a preference for other algorithms where you have the choice.
What key size does and does not buy
Size sets the work needed to guess a key by brute force. Past a threshold the number is large enough that guessing is not the attack anyone attempts. Attackers go around the cipher: they find the key in a repository, reuse a nonce, abuse a padding check, or steal the key from memory or a backup.
CWE-327 says to check for obsolescence periodically, since algorithms once considered strong can become unsafe, and it advises designing for crypto agility so one algorithm can be replaced by another in a future version.
Practical choices
- Default to AES-256 for new designs. The cost over 128 bits is small, and it avoids a later debate.
- Use an authenticated mode such as GCM, which OWASP names as a first preference.
- For RSA, use 2048 bits at the least, only where compatibility demands RSA, and use OAEP for encryption.
- Generate every key from a secure random source, not from a phrase. OWASP says keys should not come from common words or phrases.
- Make sure the key encrypting a key is as strong as the key it protects. OWASP says the KEK should be at least as strong as the DEK.
Quantum questions
You may be asked about quantum computers. That is a planning topic with its own timelines, and the right response is crypto agility and an inventory, not an abrupt key size change. See does quantum computing break AES-256 for that discussion.
Where size mistakes still happen
- Old certificates and keys that predate your current policy.
- Third party appliances with fixed small keys.
- Test keys, short by design, that made it into production.
- Derived keys, where a short password is stretched and the result looks long.
An inventory catches these. Search for key sizes below your floor and give each one an owner and a date.
Safeguard can generate an SBOM and scan your dependencies, so outdated cryptography libraries with known advisories show up in one inventory, and policies can gate a build on them. A free scan is at gold.safeguard.sh/scan.
Quick check
Is AES-128 acceptable?
OWASP lists at least 128 bits, so yes for the minimum. Many teams pick 256 to avoid reopening the question.
Does a bigger RSA key fix a bad padding choice?
No. Padding and key size solve different problems. Use OAEP for encryption regardless of size.
Sources
Last reviewed: 19 October 2026.
