A payment terminal has a small processor and closes thousands of sessions an hour, so its operator wants the shortest keys that still reach the security of a 3072-bit RSA key. Which family of schemes answers that?

Answer

Elliptic-curve cryptography

Options - A. Elliptic-curve cryptography - B. Diffie–Hellman over a 3072-bit prime modulus - C. Triple DES with three independent keys - D. SHA-256 used as a key-derivation function Why - A. Correct — relocating the discrete-logarithm problem into the group of points on a curve makes the best known attacks much worse per key bit, so roughly 256 bits matches a 3072-bit RSA key. - B. Public-key, and standardised, but it sits at the same security-per-bit as RSA. It needs exactly the key size the operator is trying to get away from. - C. A symmetric block cipher. Whatever its key size, it cannot establish anything between two parties who share no secret yet. - D. A hash function is not a public-key scheme. It derives a key from a secret both ends already hold, which is a different problem entirely.

Stallings & Brown 5e ch2 §2.3; ch21 §21.5 · EXT: NIST SP 800-57 Part 1 Rev 5 (key-size equivalence); NISTIR 8413 (post-quantum selections)