Cryptographic security parameter ($\lambda$)

A cryptographic security parameter is an integer $\lambda$ indexing a family of cryptographic protocols or algorithms. It controls the scale at which efficiency and security guarantees are stated. Theoretical algorithms are often given $1^{\lambda }$, a string of $\lambda$ ones, so polynomial time in that input length means polynomial time in $\lambda$.^[ref]

A typical asymptotic guarantee requires a cryptographically negligible probability: for every fixed $c>0$, the relevant probability eventually falls below ${\lambda }^{-c}$. An exponential such as $2^{-\lambda }$ has that property; $1/\lambda$ does not, because it fails the requirement for $c=2$.

An original idealized guessing example separates a parameter from a concrete security claim. If a secret is uniform among $2^{128}$ possible values and no other information about it is supplied, one fixed guess succeeds with probability $2^{-128}$. Checking $q$ distinct guesses covers at most a fractionof those possibilities. This is a counting argument under the stated uniform-secret model, not a guarantee for every scheme described as having a128-bit key.

The parameter's numerical value, key length, algorithmic cost and actual adversary advantage are related through the particular construction. Naming the parameter alone does not establish a concrete work estimate or compensate for a flaw in the protocol.

A cryptographically negligible probability is a function $\epsilon (\lambda )$ of the cryptographic security parameter that eventually becomes smaller than every inverse power of that parameter. Formally,The threshold $N_c$ may depend on $c$. This is the inverse-polynomial definition of negligibility used in asymptotic cryptography.^[ref]

For example, $2^{-\lambda }$ is negligible because an exponential eventually dominates every fixed power. The function ${\lambda }^{-100}$ is not negligible: it exceeds ${\lambda }^{-101}$ whenever $\lambda >1$. Even the constant $10^{-30}$ is not negligible as a function of $\lambda$, although it is numerically small. Negligibility describes a family of experiments as the parameter grows, rather than a synonym for “unlikely” in one experiment.

An original closure calculation explains why the definition is useful. Suppose an adversary gets at most ${\lambda }^3$ attempts and each has success probability at most $\epsilon (\lambda )$. The union bound gives total success probability at most ${\lambda }^3\epsilon (\lambda )$, without requiring independent attempts. Given any $c>0$, negligibility with exponent $c+4$ eventually givesThus a polynomial number of opportunities preserves negligibility. A concrete numerical guarantee still requires an explicit bound at the chosen parameter; the asymptotic quantifiers alone do not supply that value.