# What are the time considerations with regard to security against birthday attack?

When designing security for a physical safe, one of the critical specifications is how long will the safe resist attack, this tells you how quickly you must detect and respond to an attack on the safe.

As I understand it for hash functions about 80 bits is considered minimally secure, in considering the number of bits for a hash to thwart a birthday attack is there a time consideration as well?

• 80-bit security was considered minimally secure (that is now 112-bit), which equates to a 160-bit hash (now 224-bit) Apr 26, 2016 at 3:46

When designing security for a physical safe, one of the critical specifications is how long will the safe resist attack, this tells you how quickly you must detect and respond to an attack on the safe.

Yes, however there's a key difference between physical safes and cryptography. With a physical safe, the attackers must be present on site (if they could drag the safe off to their own lair, then any safe can be defeated eventually). This physical presence is what allow the defenders to detect and respond.

Cryptography isn't necessarily like that; it may be that the attacker (for example) intercepts a packet flowing over the internet, and we have no clue that he has done so. He can then spend as much resources as his budget allows, and we have no idea that he is doing so. Hence, cryptography is scaled to resist attacks for an extended period of time (at least, until we don't care about whatever it was that the cryptography was protecting).

As I understand it for hash functions about 80 bits is considered minimally secure

Actually, if the hash function needs to resist a collision attack, 80 bits are quite insufficient for anything above "kid-sister-proof". An $n$-bit hash function can be attacked with a birthday attack with about $2^{n/2}$ hash operations; a single PC core might be able to do this many hashes in a week.

Unless there's a strong reason not to, we typically use hashes that are at least 256 bits in length (yes, SHA-1 is shorter; it's also being phased out). This implies that a birthday attack would require around $2^{128}$ hashes; we are fairly confident that no plausible adversary can do this.

is there a time consideration as well?

Yes, the $2^{128}$ hash evaluations is time...