This is the fifth article in a series on Cryptography for the Everyday Developer. Follow along to learn the basics of modern cryptography and encryption.
When discussing encryption, you’ll often hear talk about the strength of a security system as measured in “bits.” For example, systems might advertise their strength as having 128-bits or 256-bits. But what exactly does security measured in bits mean? Let’s demystify this common yet sometimes misunderstood concept.
Understanding Security Bits
“Bits of security” quantify how resistant an encryption scheme is against brute-force attacks, which attempt every possible key combination until the correct one is found. This measure provides an approximate representation of how difficult it is to guess the correct key.
If an encryption scheme is “n-bit” secure, it should take about \(2^n\) attempts to discover the key compromise security. Each additional bit doubles the number of possible keys, exponentially increasing security for each additional bit added.
For example 128-bit security means there are \(2^{128}\) possible values. Converting this to base \(10\), that’s approximately \(3.4 \cdot 10^{38}\) possibilities. 256-bit security increases this complexity to about \(1.15 \cdot 10^{77}\) possibilities, making brute-force attempts that guess the key virtually unimaginable with current non-quantum technology.
You can do this calculation in reverse as well, if you know it should take an attacker about one million attempts to break a cipher, you can calculate the bit-level security by taking the logarithm of one million: if it takes one million operations, the security level is \(\log_{2}1000000\), or about \(20\) bits.
Bit strength measures theoretical brute-force resistance. It doesn’t protect against other vulnerabilities like algorithmic weaknesses, implementation errors, or social engineering attacks. And it doesn’t account for relative difficulty or cost of an attack. This means that two ciphers with the same bit security level could have vastly different real-world security levels.
Nevertheless, measuring security in bits provides a quick reference for the brute-force resistance of encryption methods and is commonly used to advertise the strength of ciphers.