Maybe a silly question but I am wondering what the correct way to specify a security level is:
- 128-bit security
- 128 bits of security
- Something else entirely
The term used in the Security level article in Wikipedia is n-bit security or for example: 128-bit security level
In cryptography, security level is a measure of the strength that a cryptographic primitive — such as a cipher or hash function — achieves. Security level is usually expressed in "bits", where n-bit security means that the attacker would have to perform $2^n$ operations to break it, but other methods have been proposed that more closely model the costs for an attacker. This allows for convenient comparison between algorithms and is useful when combining multiple primitives in a hybrid cryptosystem, so there is no clear weakest link. For example, AES-128 (key size 128 bits) is designed to offer a 128-bit security level, which is considered roughly equivalent to 3072-bit RSA.
This NIST spec uses the same term of n-bit security
SHA-1 does provide the 112 bits of preimage resistance that is needed to achieve the 112-bit security strength for HMAC