Comparison of RSA vs elliptical keys

[Mark]

Thanks to all the people that chimed in on my question. I was trying to
get an idea how they compared. It was (for me) even more confusing with
the 25519 choices as I didn't know the size of those keys until someone
explained them better.

On 5/11/2020 6:46 PM, Pete Stephenson via Gnupg-users wrote:
> On Mon, May 11, 2020, at 5:15 PM, Mark wrote:
>> I'm trying to understand the differences in strength between an RSA key
>> and an elliptical one such ed25519 with cv25519. I know with RSA it is
>> pretty easy to "gauge" the strength 1024 vs 2048 vs 4096. 
>>
>> I could not really find anything to say how strong these elliptical keys
>> are and how they compare to RSA ones. 
> Good question! Broadly, and with several assumptions, elliptic curves have the same security level as symmetric (e.g., AES) keys that are half the elliptic key's length. See https://en.m.wikipedia.org/wiki/Key_size and the references therein as a starting point.
>
> For example, a 256 bit elliptic curve key has a similar strength to a symmetric key of 128 bits.
>
> Due to various reasons, not all ECC keys are powers of 2 in length. For example, NIST P-521 is 521 bits long rather than 512 bits, and has equivalent security to a 256 bit symmetric key.
>
> Cheers!
> -Pete
>