NIST SP 800-57 Part 1 Rev. 5 (Table 2) maps classical strengths to key sizes: 112 bits = RSA or finite-field DH with 2048-bit moduli or curves of 224–255 bits; 128 bits = AES-128, RSA-3072, curves of 256–383 bits; 192 bits = AES-192, RSA-7680, 384–511-bit curves; 256 bits = AES-256, RSA-15360, curves of 512 bits and more. Hash functions give n/2 bits of collision resistance and n bits of preimage resistance, so SHA-256 offers 128-bit collision resistance.
112 bits has been the minimum for new federal use since 2014, and 128 bits is the norm for new designs. NIST IR 8547 (initial public draft) proposes deprecating 112-bit quantum-vulnerable algorithms after 2030 and disallowing all of them after 2035, regardless of their classical strength.
Post-quantum standards use security categories instead of bit counts, because quantum attack costs are uncertain: category 1 is at least as hard to break as AES-128 key search, category 3 as AES-192 and category 5 as AES-256, with categories 2 and 4 pegged to SHA-256 and SHA3-384 collisions. ML-KEM-768 and ML-DSA-65 are category 3.