Timeline for Why is the security level defined by $\log _{2} \inf \{ t_{i}/\varepsilon_{i} \mid i \in I \}$
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 8, 2019 at 16:32 | comment | added | Squeamish Ossifrage | This is largely a good answer, but beware (a) the use of time as the only cost, because in many cases you can reduce time by running more machines in parallel at the same cost; and (b) the use of single-target attacks as a proxy for the cost of multi-target attacks, when in many cases like a block cipher an attack on $n$ targets simultaneously can be $n$ times cheaper than an attack on one target and about $n^3$ times faster—so to find the first of a billion 128-bit keys for a block cipher the cost is well below $2^{100}$, which is why I advise against saying AES128 gives 128-bit security. | |
| Mar 8, 2019 at 13:40 | comment | added | Blanco | Actually, I do not know what kinds of modification should be "trivial modification". So I just give an example. I do not believe that $f(t, \varepsilon) = t/\varepsilon$ is the best function. So, I want more evidences to show that the value $t/\varepsilon$ makes sense. Your modification is about the encryption algorithm. I do not know how do you compare the security between $E$ and $E'$. It seems that you still consider some attack algorithm $A$ and the value of $t_{A}/\varepsilon_{A}$. My modification is about the attack algorithm itself. | |
| Mar 8, 2019 at 13:02 | comment | added | Blanco | The definition is cited from here (4.1.12) | |
| Mar 3, 2019 at 21:21 | history | edited | Seth | CC BY-SA 4.0 |
added 50 characters in body
|
| Mar 3, 2019 at 21:12 | history | answered | Seth | CC BY-SA 4.0 |