A security strength of s bits is said to be supported by a particular choice of algorithm, primitive, auxiliary function, parameters (etc.) for use in the implementation of a cryptographic mechanism if that choice will not prevent the resulting implementation from attaining a security strength of at least s bits. In this Recommendation, it is assume that implementation choices are intended to support a security strenght of 112 bits or more (see [NIST SP 800-57] and [NIST SP 800-131A])
Source(s):
NIST SP 800-56B Rev. 2