Hmmm. The person who wrote this took quite some liberties. Somewhat unavoidable for the excerpt, because you can't explain all the nuances in a few words, but the wiki body should be more precise.
Roughly speaking, the security level (also called strength) of a cryptographic algorithm is the amount of computation that's necessary to break it. It's the logarithm number of required elementary operations; for example, an algorithm with a 128-bit security level is one that requires $2^{128}$ operations. What counts as one operation is not defined precisely; typically, it's one call to the function in question, and other computations of roughly the same complexity.
The security level does not consider specific attacks: it measures the minimum amount of computation by an optimally clever adversary. In other words, it takes the best known attacks into account.
What is missing in this statement is that the security level considers a specific problem. For example, the security level of AES-128-CBC encryption would be based on decrypting a message without having the key. It's still meaningful to talk about “the security level of AES-128” because the value is the same for all common problems. To state that AES-256 has a 256-bit security level, on the other hand, is not quite true: that's the security level for encryption, but there are problems such as MAC forgery that can be broken by brute-forcing one block's worth, and an AES-256 block is only 128 bits.
A cryptographic hash like SHA-256 has several fundamental properties, and the strength is not the same for all of them:
- Preimage resistance: given $h$, find $m$ such that $h = \mathrm{SHA256}(m)$. This has a 256-bit security level.
- Second preimage resistance: given $m_1$, find $m_2$ such that $m_1 \ne m_2$ and $\mathrm{SHA256}(m_1) = \mathrm{SHA256}(m_2)$. This has a 256-bit security level.
- Collision resistance: find $m_1$ and $m_2$ such that $m_1 \ne m_2$ and $\mathrm{SHA256}(m_1) = \mathrm{SHA256}(m_2)$. This has a (roughly) 128-bit security level because this problem is susceptible to a birthday attack.
As we saw with AES-256, the security level is not necessarily the key size, even for algorithms that are not broken. The key size is not always the determining factor for brute force attacks, just like the hash size is not always the determining factor for a hash. In both cases, birthday attacks halve the security level for problems that only require finding a collision.
Even for encryption algorithms, the security level is not always the key size. That's the case for AES with any key size and decent modes, but here are some examples where it isn't:
- For DES, a key has only 56 “useful” bits, but is represented as 8 bytes with 8 parity bits. So a 64-bit key only has a 56-bit security level (i.e. the original security level back when the algorithm was considered unbroken, less so now that it's partly broken).
- 2DES — successive DES operations with two keys — only has a 57-bit theoretical security level because meet-in-the-middle attacks effectively make the second key only double the amount of computations required to break it.
- 3DES — successive DES with 3 keys — has a 112-bit security level (the strength of two keys).
- Asymmetric algorithms generally have a security level that's significantly less than their key size, because they're based on mathematical objects which have some structure that allow better attacks than trying all possible keys. The definition of an elementary operation can lead to relatively large variations, so strengths quoted for asymmetric algorithms are estimates. Security strength of RSA in relation with the modulus size is an instructive read on this topic. keylength.com lists references on the strength of some common algorithms.
