Britannica Sources used in this answer

How does the length of an encryption key affect resistance to brute-force attacks?

Created from Britannica articles using AI. AI can make mistakes, so verify using Britannica articles.

A Vigenere cipher table displays the alphabet in both the top row and left column, with rows shifted to create a grid for encryption and decryption. Highlighted letters illustrate how to use the table. An explanation and example using the words cipher, key, and plaintext appears to the right. — cryptology In encrypting plaintext, the cipher letter is found at the intersection of the column headed by the plaintext letter and the row indexed by the key letter. To decrypt ciphertext, the plaintext letter is found at the head of the column determined by the intersection of the diagonal containing the cipher letter and the row containing the key letter.

The length of an encryption key is a primary determinant of a system's security, specifically regarding its resistance to a brute-force attack, which involves the exhaustive search of the entire key space to find the correct key.1

The security of a cryptosystem is measured by its work function—the computational effort required to test every possible key. As the number of bits in a key increases, the size of the key space grows exponentially. For example, a system using a 40-bit key has $2^{40}$ possible keys, a space that became trivial to exhaust with late 20th-century computing power. This vulnerability necessitated the industry-wide shift to longer keys, such as 128-bit keys for single-key systems, to ensure that the work function remains computationally infeasible for an attacker.1

In two-key cryptography, such as the RSA cryptoalgorithm, key length is equally critical. Security here relies on the difficulty of solving specific mathematical problems, such as factoring large numbers. As computing techniques and processor speeds improve, standards must be updated—moving from 1,024-bit to 2,048-bit keys—to maintain security against evolving cryptanalytic capabilities.12