recommendedKeyLength

P32227 predicate

Indicates the suggested or optimal length that a cryptographic key should have for secure use in a given context.

Subject	Object
DNSSEC ZSK	typically shorter than KSK via predicate surface "keyLength" →
HMAC	at least as long as hash output →
RFC 7539	256-bit key for ChaCha20 via predicate surface "definesKeySize" →