What is the basis for a certain algorithm being declared secure/broken?
Is there a standard like below?
*I understand that there are certain unique flaws such as collisions based on which algorithm is used.

time to compute single = T
conditions = C
number of possibilities = N
Min time required = M

Given C: T * N > M


For passwords, for example, it is common to calculate the time needed to brute force all possibilities.

The time taken also depends on the hardware used. Brute forcing scales very well and by investing more in hardware the time to crack a password can be reduced. Typically, top of the line consumer hardware is used to calculate the time, but the scrypt paper for example takes a reverse approach; it lists the costs of a machine while limiting the time:

costs for a machine for cracking

This does not really indicate the overal security, as it only assumes a brute force attack. The security of an algorithm may be compromised in other ways. This is usually notated by the reduction in work needed to perform some action. For example, to calculate a MD5 to match another MD5, 2128 computations are normally needed. With a certain preimage attack, only 2123.4 calculations are needed.

  • Thank you, although not a standard, this does provide a concrete example of a used and rational way to handle the issue. Due to the complexity of security, I can assume that this is the closest alternative to a standard available so I have chosen it as the best answer. Jun 13 '17 at 5:13

There is no real standard for this unless you have declared one for yourself and your use case.

But here are some examples for common properties of secure algorithms:

Encryption algorithms

  • Confidentiality: encryption strength with a minimum of 100 bit
  • Integrity: Is a MAC used?
  • Authentication: Is it signed?
  • Plausible Deniability: E.g. OTR, Axolotl
  • ...

Hash algorithms

  • collision resistance
  • pre-image resistance
  • second pre-image resistance
  • time to compute a single hash
  • ...

Please note that this is not a complete list, but it might give you a small overview of the complexity of the question: Is it insecure/broken?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.