Security level: Difference between revisions

Content deleted Content added

Inline

Revision as of 23:13, 28 September 2023

In cryptography, security level is a measure of the strength that a cryptographic primitive — such as a cipher or hash function — achieves. Security level is usually expressed as a number of "bits of security" (also security strength),^[1] where n-bit security means that the attacker would have to perform 2ⁿ operations to break it,^[2] but other methods have been proposed that more closely model the costs for an attacker.^[3] This allows for convenient comparison between algorithms and is useful when combining multiple primitives in a hybrid cryptosystem, so there is no clear weakest link. For example, AES-128 (key size 128 bits) is designed to offer a 128-bit security level, which is considered roughly equivalent to a RSA using 3072-bit key.

In this context, security claim or target security level is the security level that a primitive was initially designed to achieve, although "security level" is also sometimes used in those contexts. When attacks are found that have lower cost than the security claim, the primitive is considered broken.^[4]^[5]

In symmetric cryptography

Symmetric algorithms usually have a strictly defined security claim. For symmetric ciphers, it is typically equal to the key size of the cipher — equivalent to the complexity of a brute-force attack.^[5]^[6] Cryptographic hash functions with output size of n bits usually have a collision resistance security level n/2 and a preimage resistance level n. This is because the general birthday attack can always find collisions in 2^n/2 steps.^[7] For example, SHA-256 offers 128-bit collision resistance and 256-bit preimage resistance.

However, there are some exceptions to this. The Phelix and Helix are 256-bit ciphers offering a 128-bit security level.^[5]^[8] The SHAKE variants of SHA-3 are also different: for a 256-bit output size, SHAKE-128 provides 128-bit security level for both collision and preimage resistance.^[9]

In asymmetric cryptography

The design of most asymmetric algorithms (i.e. public-key cryptography) relies on neat mathematical problems that are efficient to compute in one direction, but inefficient to reverse by the attacker. However, attacks against current public-key systems are always faster than brute-force search of the key space. Their security level isn't set at design time, but represents a computational hardness assumption, which is adjusted to match the best currently known attack.^[6]

Various recommendations have been published that estimate the security level of asymmetric algorithms, which differ slightly due to different methodologies. For the RSA cryptosystem at 128-bit security level, NIST and ENISA recommend using 3072-bit keys^[10]^[11] and IETF 3253 bits.^[12]^[13] Elliptic curve cryptography requires shorter keys, so the recommendations are 256-383 (NIST), 256 (ENISA) and 242 bits (IETF).

Typical levels

The following table are examples of typical security levels for types of algorithms as found in s5.6.1.1 of the US NIST SP-800-57 Recommendation for Key Management.^[14]

Table: Comparable Algorithm Strengths
Security Bits	Symmetric Key	Finite Field/Discrete Logarithm (i.e. DH)	Integer Factorization (i.e. RSA)	Elliptic Curve (i.e. x25519)
80	2TDEA^†	L=1024, N=160	k=1024	f=160-223
112	3TDEA^†	L=2048, N=224	k=2048	f=224-255
128	AES	L=3072, N=256	k=3072	f=256-383
192	AES	L=7680, N=384	k=7680	f=384-511
256	AES	L=15360, N=511	k=15360	f=512+

^† DES was deprecated in 2003

Meaning of "broken"

A cryptographic primitive is considered broken when an attack is found to have less than its advertised level of security. However, not all such attacks are practical: most currently demonstrated attacks take fewer than 2⁴⁰ operations, which translates to a few hours on an average PC. The costliest demonstrated attack on hash functions is the 2^61.2 attack on SHA-1, which took 2 months on 900 GTX 970 GPUs, and cost US$75,000 (although the researchers estimate only $11,000 was needed to find a collision).^[15]

Aumasson draws the line between practical and impractical attacks at 2⁸⁰ operations. He proposes a new terminology:^[16]

A broken primitive has an attack taking ≤ 2⁸⁰ operations. An attack can be plausibly carried out.
A wounded primitive has an attack taking between 2⁸⁰ and around 2¹⁰⁰ operations. An attack is not possible right now, but future improvements are likely to make it possible.
An attacked primitive has an attack that is cheaper than the security claim, but much costlier than 2¹⁰⁰. Such an attack is too far from being practical.
Finally, an analyzed primitive is one with no attacks cheaper than its security claim.

References

^ NIST Special Publication 800-57 Part 1, Revision 5. Recommendation for Key Management: Part 1 – General, p. 17.
^ Lenstra, Arjen K. "Key Lengths: Contribution to The Handbook of Information Security" (PDF).
^ Bernstein, Daniel J.; Lange, Tanja (4 June 2012). "Non-uniform cracks in the concrete: the power of free precomputation" (PDF). Advances in Cryptology - ASIACRYPT 2013. Lecture Notes in Computer Science. pp. 321–340. doi:10.1007/978-3-642-42045-0_17. ISBN 978-3-642-42044-3.
^ Aumasson, Jean-Philippe (2011). Cryptanalysis vs. Reality (PDF). Black Hat Abu Dhabi.
^ ^a ^b ^c Bernstein, Daniel J. (25 April 2005). Understanding brute force (PDF). ECRYPT STVL Workshop on Symmetric Key Encryption.
^ ^a ^b Lenstra, Arjen K. (9 December 2001). "Unbelievable Security: Matching AES Security Using Public Key Systems" (PDF). Advances in Cryptology — ASIACRYPT 2001. Lecture Notes in Computer Science. Vol. 2248. Springer, Berlin, Heidelberg. pp. 67–86. doi:10.1007/3-540-45682-1_5. ISBN 978-3-540-45682-7.
^ Alfred J. Menezes; Paul C. van Oorschot; Scott A. Vanstone. "Chapter 9 - Hash Functions and Data Integrity" (PDF). Handbook of Applied Cryptography. p. 336.
^ Ferguson, Niels; Whiting, Doug; Schneier, Bruce; Kelsey, John; Lucks, Stefan; Kohno, Tadayoshi (24 February 2003). "Helix: Fast Encryption and Authentication in a Single Cryptographic Primitive" (PDF). Fast Software Encryption. Lecture Notes in Computer Science. Vol. 2887. Springer, Berlin, Heidelberg. pp. 330–346. doi:10.1007/978-3-540-39887-5_24. ISBN 978-3-540-20449-7.
^ Dworkin, Morris J. (August 2015). "SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions" (PDF): 23. doi:10.6028/nist.fips.202. {{cite journal}}: Cite journal requires |journal= (help)
^ Barker, Elaine (January 2016). "Recommendation for Key Management, Part 1: General" (PDF). NIST: 53. CiteSeerX 10.1.1.106.307. doi:10.6028/nist.sp.800-57pt1r4. {{cite journal}}: Cite journal requires |journal= (help)
^ Algorithms, key size and parameters report – 2014. ENISA. Publications Office. 2013. p. 37. doi:10.2824/36822. ISBN 978-92-9204-102-1.{{cite book}}: CS1 maint: others (link)
^ Hilarie, Orman; Paul, Hoffman (April 2004). "Determining Strengths For Public Keys Used For Exchanging Symmetric Keys". RFC 3766 (IETF). doi:10.17487/RFC3766. {{cite journal}}: Cite journal requires |journal= (help)
^ Giry, Damien. "Keylength - Compare all Methods". keylength.com. Retrieved 2017-01-02.
^ Barker, Elaine (May 2020). "Recommendation for Key Management, Part 1: General" (PDF). NIST: 158. CiteSeerX 10.1.1.106.307. doi:10.6028/nist.sp.800-57pt1r5. {{cite journal}}: Cite journal requires |journal= (help)
^ Gaëtan Leurent; Thomas Peyrin (2020-01-08). "SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1 and Application to the PGP Web of Trust" (PDF). {{cite journal}}: Cite journal requires |journal= (help)
^ Aumasson, Jean-Philippe (2020). Too Much Crypto (PDF). Real World Crypto Symposium.

@@ Line 2: / Line 2: @@
 {{short description|Measure of cryptographic strength}}
-In cryptography, '''security level''' is a measure of the strength that a [[cryptographic primitive]] &mdash; such as a [[cipher]] or [[hash function]] &mdash; achieves. Security level is usually expressed as a number of "[[bit]]s of security" (also '''security strength'''),<ref>[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf NIST Special Publication 800-57 Part 1, Revision 5. Recommendation for Key Management: Part 1 – General], p. 17.</ref> where ''n''-bit security means that the attacker would have to perform 2<sup>''n''</sup> operations to break it,<ref>{{Cite news|url=https://infoscience.epfl.ch/record/164539/files/NPDF-32.pdf|title=Key Lengths: Contribution to The Handbook of Information Security|last=Lenstra|first=Arjen K.|author-link=Arjen Lenstra}}</ref> but other methods have been proposed that more closely model the costs for an attacker.<ref>{{Cite book|chapter-url=https://cr.yp.to/nonuniform/nonuniform-20130914.pdf|title=Advances in Cryptology - ASIACRYPT 2013|last1=Bernstein|first1=Daniel J.|last2=Lange|first2=Tanja|author2-link=Tanja Lange|date=4 June 2012|isbn=9783642420443|series=Lecture Notes in Computer Science|pages=321–340|language=en|chapter=Non-uniform cracks in the concrete: the power of free precomputation|doi=10.1007/978-3-642-42045-0_17|author-link=Daniel J. Bernstein}}</ref> This allows for convenient comparison between algorithms and is useful when combining multiple primitives in a [[hybrid cryptosystem]], so there is no clear weakest link. For example, [[Advanced Encryption Standard|AES]]-128 ([[key size]] 128 bits) is designed to offer a 128-bit security level, which is considered roughly equivalent to a [[RSA (cryptosystem)|RSA]] using 3072-bit key.
+In cryptography, '''security level''' is a measure of the strength that a [[cryptographic primitive]] &mdash; such as a [[cipher]] or [[hash function]] &mdash; achieves. Security level is usually expressed as a number of "[[bit]]s of security" (also '''security strength'''),<ref>[https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf NIST Special Publication 800-57 Part 1, Revision 5. Recommendation for Key Management: Part 1 – General], p. 17.</ref> where ''n''-bit security means that the attacker would have to perform 2<sup>''n''</sup> operations to break it,<ref>{{Cite news|url=https://infoscience.epfl.ch/record/164539/files/NPDF-32.pdf|title=Key Lengths: Contribution to The Handbook of Information Security|last=Lenstra|first=Arjen K.|author-link=Arjen Lenstra}}</ref> but other methods have been proposed that more closely model the costs for an attacker.<ref>{{Cite book|chapter-url=https://cr.yp.to/nonuniform/nonuniform-20130914.pdf|title=Advances in Cryptology - ASIACRYPT 2013|last1=Bernstein|first1=Daniel J.|last2=Lange|first2=Tanja|author2-link=Tanja Lange|date=4 June 2012|isbn={{Format ISBN|9783642420443}}|series=Lecture Notes in Computer Science|pages=321–340|language=en|chapter=Non-uniform cracks in the concrete: the power of free precomputation|doi=10.1007/978-3-642-42045-0_17|author-link=Daniel J. Bernstein}}</ref> This allows for convenient comparison between algorithms and is useful when combining multiple primitives in a [[hybrid cryptosystem]], so there is no clear weakest link. For example, [[Advanced Encryption Standard|AES]]-128 ([[key size]] 128 bits) is designed to offer a 128-bit security level, which is considered roughly equivalent to a [[RSA (cryptosystem)|RSA]] using 3072-bit key.
 In this context, '''security claim''' or '''target security level''' is the security level that a primitive was initially designed to achieve, although "security level" is also sometimes used in those contexts. When attacks are found that have lower cost than the security claim, the primitive is considered '''broken'''.<ref>{{Cite conference|url=https://media.blackhat.com/bh-ad-11/Aumasson/bh-ad-11-Aumasson-CryptanalysisVSReality_WP.pdf|first=Jean-Philippe|last=Aumasson|conference=[[Black Hat Briefings|Black Hat]] Abu Dhabi|year=2011|title=Cryptanalysis vs. Reality}}</ref><ref name=":0">{{Cite conference|url=https://cr.yp.to/snuffle/bruteforce-20050425.pdf|title=Understanding brute force|last=Bernstein|first=Daniel J.|author-link=Daniel J. Bernstein|date=25 April 2005|conference=ECRYPT STVL Workshop on Symmetric Key Encryption}}</ref>
@@ Line 8: / Line 8: @@
 == In symmetric cryptography ==
-Symmetric algorithms usually have a strictly defined security claim. For [[symmetric cipher]]s, it is typically equal to the [[key size]] of the cipher — equivalent to the [[complexity]] of a [[brute-force attack]].<ref name=":0" /><ref name=":1">{{Cite book|title=Advances in Cryptology — ASIACRYPT 2001|volume=2248|last=Lenstra|first=Arjen K.|date=9 December 2001|publisher=Springer, Berlin, Heidelberg|isbn=978-3540456827|pages=67–86|language=en|chapter=Unbelievable Security: Matching AES Security Using Public Key Systems|doi=10.1007/3-540-45682-1_5|chapter-url=https://www.iacr.org/archive/asiacrypt2001/22480067.pdf|series=Lecture Notes in Computer Science}}</ref> [[Cryptographic hash function]]s with output size of ''n'' bits usually have a [[collision resistance]] security level ''n''/2 and a [[preimage resistance]] level ''n''. This is because the general [[birthday attack]] can always find collisions in 2<sup>''n/2''</sup> steps.<ref>{{Cite book|url=http://cacr.uwaterloo.ca/hac/|title=Handbook of Applied Cryptography|pages=336|chapter=Chapter 9 - Hash Functions and Data Integrity|chapter-url=http://cacr.uwaterloo.ca/hac/about/chap9.pdf|authors=[[Alfred J. Menezes]], [[Paul C. van Oorschot]], [[Scott A. Vanstone]]}}</ref> For example, [[SHA-2|SHA-256]] offers 128-bit collision resistance and 256-bit preimage resistance.
+Symmetric algorithms usually have a strictly defined security claim. For [[symmetric cipher]]s, it is typically equal to the [[key size]] of the cipher — equivalent to the [[complexity]] of a [[brute-force attack]].<ref name=":0" /><ref name=":1">{{Cite book|title=Advances in Cryptology — ASIACRYPT 2001|volume=2248|last=Lenstra|first=Arjen K.|date=9 December 2001|publisher=Springer, Berlin, Heidelberg|isbn={{Format ISBN|978-3540456827}}|pages=67–86|language=en|chapter=Unbelievable Security: Matching AES Security Using Public Key Systems|doi=10.1007/3-540-45682-1_5|chapter-url=https://www.iacr.org/archive/asiacrypt2001/22480067.pdf|series=Lecture Notes in Computer Science}}</ref> [[Cryptographic hash function]]s with output size of ''n'' bits usually have a [[collision resistance]] security level ''n''/2 and a [[preimage resistance]] level ''n''. This is because the general [[birthday attack]] can always find collisions in 2<sup>''n/2''</sup> steps.<ref>{{Cite book|url=http://cacr.uwaterloo.ca/hac/|title=Handbook of Applied Cryptography|page=336|chapter=Chapter 9 - Hash Functions and Data Integrity|chapter-url=http://cacr.uwaterloo.ca/hac/about/chap9.pdf|author=[[Alfred J. Menezes]] |author2=[[Paul C. van Oorschot]] |author3=[[Scott A. Vanstone]] }}</ref> For example, [[SHA-2|SHA-256]] offers 128-bit collision resistance and 256-bit preimage resistance.
 However, there are some exceptions to this. The [[Phelix]] and Helix are 256-bit ciphers offering a 128-bit security level.<ref name=":0" /><ref>{{Cite book|title=Fast Software Encryption|volume=2887|last1=Ferguson|first1=Niels|last2=Whiting|first2=Doug|last3=Schneier|first3=Bruce|last4=Kelsey|first4=John|last5=Lucks|first5=Stefan|last6=Kohno|first6=Tadayoshi|date=24 February 2003|publisher=Springer, Berlin, Heidelberg|isbn=978-3-540-20449-7|pages=330–346|language=en|chapter=Helix: Fast Encryption and Authentication in a Single Cryptographic Primitive|doi=10.1007/978-3-540-39887-5_24|chapter-url=https://www.schneier.com/academic/paperfiles/paper-phelix.pdf|series=Lecture Notes in Computer Science}}</ref> The SHAKE variants of [[SHA-3]] are also different: for a 256-bit output size, SHAKE-128 provides 128-bit security level for both collision and preimage resistance.<ref>{{Cite journal|title=SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions|url=http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf|date=August 2015|page= 23|doi=10.6028/nist.fips.202|last1=Dworkin|first1=Morris J.}}</ref>
@@ Line 16: / Line 16: @@
 The design of most asymmetric algorithms (i.e. [[public-key cryptography]]) relies on neat [[mathematical problem]]s that are efficient to compute in one direction, but inefficient to reverse by the attacker. However, attacks against current public-key systems are always faster than [[brute-force search]] of the key space. Their security level isn't set at design time, but represents a [[computational hardness assumption]], which is adjusted to match the best currently known attack.<ref name=":1" />
-Various recommendations have been published that estimate the security level of asymmetric algorithms, which differ slightly due to different methodologies. For the [[RSA (cryptosystem)|RSA cryptosystem]] at 128-bit security level, [[National Institute of Standards and Technology|NIST]] and [[European Union Agency for Network and Information Security|ENISA]] recommend using 3072-bit keys<ref>{{Cite journal|last=Barker|first=Elaine|others=NIST|title=Recommendation for Key Management, Part 1: General|url=http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf|date=January 2016|pages=53|doi=10.6028/nist.sp.800-57pt1r4|citeseerx=10.1.1.106.307}}</ref><ref>{{Cite book|year=2013|others=ENISA|title=Algorithms, key size and parameters report – 2014|url=https://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/algorithms-key-size-and-parameters-report-2014/at_download/fullReport|page= 37|publisher=Publications Office|doi=10.2824/36822|isbn=9789292041021 }}</ref> and [[Internet Engineering Task Force|IETF]] 3253 bits.<ref>{{Cite journal|url=https://tools.ietf.org/html/rfc3766|title=Determining Strengths For Public Keys Used For Exchanging Symmetric Keys|last1=Hilarie|first1=Orman|last2=Paul|first2=Hoffman|others=RFC 3766 (IETF)|date=April 2004|doi=10.17487/RFC3766 }}</ref><ref>{{Cite web|url=https://www.keylength.com/en/compare/|title=Keylength - Compare all Methods|last=Giry|first=Damien|website=keylength.com|access-date=2017-01-02}}</ref> [[Elliptic curve cryptography]] requires shorter keys, so the recommendations are 256-383 (NIST), 256 (ENISA) and 242 bits (IETF).
+Various recommendations have been published that estimate the security level of asymmetric algorithms, which differ slightly due to different methodologies. For the [[RSA (cryptosystem)|RSA cryptosystem]] at 128-bit security level, [[National Institute of Standards and Technology|NIST]] and [[European Union Agency for Network and Information Security|ENISA]] recommend using 3072-bit keys<ref>{{Cite journal|last=Barker|first=Elaine|others=NIST|title=Recommendation for Key Management, Part 1: General|url=http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf|date=January 2016|page=53|doi=10.6028/nist.sp.800-57pt1r4|citeseerx=10.1.1.106.307}}</ref><ref>{{Cite book|year=2013|others=ENISA|title=Algorithms, key size and parameters report – 2014|url=https://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/algorithms-key-size-and-parameters-report-2014/at_download/fullReport|page= 37|publisher=Publications Office|doi=10.2824/36822|isbn={{Format ISBN|9789292041021}} }}</ref> and [[Internet Engineering Task Force|IETF]] 3253 bits.<ref>{{Cite journal|url=https://tools.ietf.org/html/rfc3766|title=Determining Strengths For Public Keys Used For Exchanging Symmetric Keys|last1=Hilarie|first1=Orman|last2=Paul|first2=Hoffman|others=RFC 3766 (IETF)|date=April 2004|doi=10.17487/RFC3766 }}</ref><ref>{{Cite web|url=https://www.keylength.com/en/compare/|title=Keylength - Compare all Methods|last=Giry|first=Damien|website=keylength.com|access-date=2017-01-02}}</ref> [[Elliptic curve cryptography]] requires shorter keys, so the recommendations are 256-383 (NIST), 256 (ENISA) and 242 bits (IETF).
 == Typical levels ==
-The following table are examples of typical security levels for types of algorithms as found in s5.6.1.1 of the US NIST SP-800-57 Recommendation for Key Management.<ref>{{Cite journal|last=Barker|first=Elaine|others=NIST|title=Recommendation for Key Management, Part 1: General|url=https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf|date=May 2020|pages=158|doi=10.6028/nist.sp.800-57pt1r5|citeseerx=10.1.1.106.307}}</ref>
+The following table are examples of typical security levels for types of algorithms as found in s5.6.1.1 of the US NIST SP-800-57 Recommendation for Key Management.<ref>{{Cite journal|last=Barker|first=Elaine|others=NIST|title=Recommendation for Key Management, Part 1: General|url=https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf|date=May 2020|page=158|doi=10.6028/nist.sp.800-57pt1r5|citeseerx=10.1.1.106.307}}</ref>
 {| class="wikitable"
 |-style="background:#DADADA"