The bits of encryption are calculated from the number of bits in the key.

EG: (DES again, sorry)
A key in DES is 8 bytes (64 bits) long and the 8th bit of every byte is used as parity leaving 56 bits. To brute force this you would need to attempt to decrypt the cypher text with each possible combination of the bits. This is 2^56 or 72,057,594,037,927,900 combinations. at 1,000,000 tests per second it would take 2342.7 years to search the whole key space (then of course you have to know which of the decrypted plain texts is correct as all will pass you a result of some sort). 56bit encryption is considered weak too, as 2^128 gives about 340,282,366,920,938,000,000,000,000,000,000,000,000 combinations and at 1,000,000 tests per second it would take 11,063,071,125,966,800,000,000,000 years to search the whole space (by which time the sun would have engulfed the earth!

But a key is only as secure as it's algorithm. If the method of encyphering the plain text with the key is poor then obviously better methods than brute force will be employed.

As for PGP, well, it's bit length is huge! this is because the public key is handed out and people can encrypt a message like "AAAAAAAAAAAAAAA" with the public key and see, the encrypted result. because you have the plain text and cypher text, and you can choose your plain text you are on your way to crypto-analising the private key, and if you crack it then everything encrypted with that key is yours to read (problem is you need maths at a level of a rocket scientist to attempt it)

But you get the idea about bit lengths. Remember, once the bit length gets to a certain size it become impossible to brute force in your life time, because of this, the algorithm becomes much more important than how strong in bits a certain system is.