Class SecurityStrengthAdvisor

java.lang.Object
zeroecho.core.policy.SecurityStrengthAdvisor
public final class SecurityStrengthAdvisor extends Object
Estimates conservative security strength in bits for a given algorithm identifier and key.

SecurityStrengthAdvisor normalizes an algorithm family name (for example, "RSA", "AES", "HMAC", "ML-KEM", "SPHINCS+") and inspects the provided key to infer an approximate strength in bits. The mappings are deliberately coarse and favor safe lower bounds over optimistic assumptions.

How estimation works

  • RSA / ElGamal (FF-DL): uses the modulus size to map to NIST-like strengths (for example, 2048 -> ~112, 3072 -> ~128, 7680 -> ~192, 15360 -> ~256).
  • AES: uses the secret key size (128/192/256) when available; otherwise assumes 128.
  • HMAC: strength is min(key bits, hash output bits); attempts to parse the underlying SHA variant from key.getAlgorithm() (for example, HmacSHA256 -> 256 output bits). If unknown or opaque, caps at a conservative 256.
  • Post-quantum KEMs (ML-KEM/Kyber, FrodoKEM, Saber, BIKE, HQC, CMCE, NTRU families): tries to extract parameters either from numeric hints in key.getAlgorithm() (for example, 512, 768, 1024 for ML-KEM; 640/976/1344 for FrodoKEM) or from NIST security levels labeled as L1/L3/L5. If neither is present, defaults to 128.
  • ML-DSA: estimated from the parameter set markers (44/65/87 mapped to 128/192/256, or L1/L3/L5).
  • SLH-DSA: parse 128/192/256 from key.getAlgorithm() similarly to SPHINCS+; else default 128.
  • SPHINCS+: parses the parameter size 128/192/256 from the algorithm string; otherwise defaults to 128.
  • EdDSA: returns fixed strengths (Ed25519 -> 128, Ed448 -> 224).
  • Digest-only and unknown families: returns a conservative 128.

Inputs and parsing

  • The algoId argument selects the family mapping. It should be a stable id such as "RSA", "AES", "HMAC", "ML-KEM", "SPHINCS+".
  • When applicable, key.getAlgorithm() is scanned for numeric tokens or level markers like "L1", "L3", "L5" to refine the estimate.
  • Opaque keys or provider-specific names may limit visibility; in such cases, the result intentionally errs on the conservative side.

Security notes

  • These values are heuristic, implementation-agnostic estimates for policy gating and coarse comparisons. They are not a substitute for a full cryptographic review.
  • When in doubt, the advisor returns at least 128 bits to avoid accidental underestimation in modern deployments.

Examples

// AES-256 secret key
int s1 = SecurityStrengthAdvisor.estimateBits("AES", secretKey256);   // -> 256

// RSA 3072-bit public key
int s2 = SecurityStrengthAdvisor.estimateBits("RSA", rsa3072Pub);     // -> 128

// ML-KEM-768 (Kyber768) as indicated in key algorithm string
int s3 = SecurityStrengthAdvisor.estimateBits("ML-KEM", kemKey768);   // -> 192

// HmacSHA256 with a 160-bit key (not recommended)
int s4 = SecurityStrengthAdvisor.estimateBits("HMAC", shortHmacKey);  // -> min(160, 256) = 160

Thread-safety

This utility is stateless and thread-safe.
Since:
1.0

  • Method Details

    • estimateBits

      public static int estimateBits(String algoId, Key key)
      Estimates the security strength in bits for a given algorithm family id and key.

      The method first normalizes algoId to select a family-specific mapping. It then inspects the key (for example, modulus bit length for RSA; encoded length for AES SecretKey; hash output size inferred from HMAC algorithm name; parameter levels for post-quantum schemes) to compute a conservative estimate.

      Parameters:
      algoId - algorithm family identifier such as "RSA", "AES", "HMAC", "ML-KEM", "SPHINCS+"
      key - key instance to inspect; may be opaque for some providers
      Returns:
      estimated security strength in bits; never negative