= Cryptographic security parameter
{title2=$\lambda$}
A \b[cryptographic security parameter] is an integer $\lambda$ indexing a family of <cryptographic protocols> or algorithms. It controls the scale at which efficiency and security guarantees are stated. Theoretical algorithms are often given $1^\lambda$, a string of $\lambda$ ones, so <polynomial time> in that input length means polynomial time in $\lambda$.<Zero-Knowledge chapter draft of Foundations of Cryptography by Oded Goldreich>[Protocol Input Specification, unary security parameter]{ref}
A typical asymptotic guarantee requires a <cryptographically negligible probability>: for every fixed $c>0$, the relevant probability eventually falls below $\lambda^{-c}$. An exponential such as $2^{-\lambda}$ has that property; $1/\lambda$ does not, because it fails the requirement for $c=2$.
An original idealized guessing example separates a parameter from a concrete security claim. If a secret is uniform among $2^{128}$ possible values and no other information about it is supplied, one fixed guess succeeds with probability $2^{-128}$. Checking $q$ distinct guesses covers at most a fraction
$$
\frac{q}{2^{128}}
$$
of those possibilities. This is a counting argument under the stated uniform-secret model, not a guarantee for every scheme described as having a128-bit key.
The parameter's numerical value, key length, algorithmic cost and actual adversary advantage are related through the particular construction. Naming the parameter alone does not establish a concrete work estimate or compensate for a flaw in the protocol.
Back to article page
