We can say that a cryptographic primitive has $n$ bits security against a type of attack if it cannot break it in less than $2^n$ time (time-area product in some cases). The cryptographic primitive could be said to be $n$ bits secure if the fastest possible attack (theoretical and future attacks of the same type included) takes at least $2^n$ time.
To make such security proofs, we need to analyze our crypto primitive. If we have more complex design, we may have more security (and performance, whatever else is desired) out of the box, but we won't be able to prove it.
Examples:
- Salsa20/15 according to Wikipedia is 128-bit secure against differential cryptanalysis, and uses only add, rotate, xor with nonlinearity from add
- SHA3 has 24 rounds and for $n$ output bits is $\frac{n}{2}$-bit secure against collisions with some reasonable assumptions, and uses only rotate, xor, not, and with nonlinearity from and
So we could use a simpler design, and thus make it easier enough to cryptanalyze that we can make a security proof. With that, we can know exactly how many rounds are needed and use only that many. In contrast:
- AES-128 was 128-bit secure against all attacks with 6 rounds at the time of creation, 4 rounds were added as a security margin, for total of 10 rounds, uses s-box, xor, shift, add with nonlinearity mostly from s-box
- SHA-256 has 64 rounds (no reason?) and is 128-bit secure against collisions for 47 rounds, uses add, rotate, xor, and (for Choose/Majority) with nonlinearity from add, and
We expect that with their more elaborate design, they are more efficient, needing less rounds for the same security and offering better performance. Their complexity makes designing an attack against them much harder.
What is better practice now, to design something simply so it can be proved secure, or design something more complex and rely on it not being broken in its lifetime?
There is always the possibility that a new attack can come up in the future and break something that was proven secure against every type of attack known at the time. But nothing can defend against that really.
Also, the comparison here is of the designs - it wouldn't be fair to put a 256-bit stream cipher up against a 128-bit block cipher, and a sponge hash against a Merkle-Damgard hash. It also happens to be that Salsa20 and SHA3 are newer than AES and SHA2.
