# “128-bit security” or “128 bits of security”?

Maybe a silly question but I am wondering what the correct way to specify a security level is:

1. 128-bit security
2. 128 bits of security
3. Something else entirely
• In my experience, both are used interchangeably without much thought. You probably want to fix one for consistency (especially in a written document), and I suppose "$n$-bit security" is more common, but in my opinion neither is "correct" or "incorrect". – CurveEnthusiast Apr 21 '17 at 7:47

## 1 Answer

The term used in the Security level article in Wikipedia is n-bit security or for example: 128-bit security level

In cryptography, security level is a measure of the strength that a cryptographic primitive — such as a cipher or hash function — achieves. Security level is usually expressed in "bits", where n-bit security means that the attacker would have to perform $2^n$ operations to break it, but other methods have been proposed that more closely model the costs for an attacker. This allows for convenient comparison between algorithms and is useful when combining multiple primitives in a hybrid cryptosystem, so there is no clear weakest link. For example, AES-128 (key size 128 bits) is designed to offer a 128-bit security level, which is considered roughly equivalent to 3072-bit RSA.

This NIST spec uses the same term of n-bit security

SHA-1 does provide the 112 bits of preimage resistance that is needed to achieve the 112-bit security strength for HMAC