Bit security expresses how much work the best known attack requires, using a base-two scale. An algorithm with 128-bit security demands roughly 2^128 operations to break. section 4.2.1
Use bit security to compare algorithms and understand practical tradeoffs:
- A key’s length does not automatically equal its security level. AES-128 provides 128-bit security, but another 128-bit-key algorithm could provide less. section 4.2.1
- Hash functions must account for their easiest attack. A 256-bit output supports about 128-bit collision security because of the birthday bound. section 2.3
- Future quantum attacks change parameter choices: Grover’s algorithm affects symmetric algorithms with 128-bit security, while 256-bit parameters can resist that threat. section 14.5
Why 256-bit hashes target 128-bit collision security
A hash with 256-bit outputs has 2^256 possible digests, but random collisions become likely after roughly 2^128 generated digests. The birthday bound cuts the collision-search effort in half on the exponent scale. section 2.3
