> Security isn't measured in time, it's measured in money.
That's not how cryptography works though: many schemes (for sufficiently large keys) are, in our current understanding of mathematics, totally unbreakable over a period of time that stretches from now until the heath death of the universe.
That's measured in time and no amount of money is going to change anything about it right?
Security is measured in resources. Money is the best one but its often hard to put a $ figure on things, especially when you are making a standard for everyone, so often people will use cpu time instead.
If you can make the cost to break effectively "infinite" ,that's great as its really easy to analyze.
The assumed time requirement simply establishes an infinite present value lower bound on the cost in money. This becomes clear once you admit the possibility of an incorrect current understanding of the mathematics.
(Admitting the possibility of an incorrect current understanding of the mathematics is, like, a major reason to go with the enormous overkill on key sizes we do.)
Whenever you say how long something takes, you need to specify how much computing power is used to achieve it in that duration (FLOPS or whatever appropriate unit). Then you see what it costs to manufacturer and operate the device that operates at that speed. Then you spend double to have 2 such devices and parallelize the job, completing it in half the time. Repeat that last part until the time is reasonable (TFA is all about this). It doesn't break down until you exceed the available natural resources and our ability to put them to work.
Brute-forcing 2^256 is impossible at any price; if you could convert all the matter in the Sun to energy and capture all the energy and drive the lowest power computers physics allows, you wouldn't have a billionth of the required energy:
Typically we calculate assuming the total energy needed at the Landauer limit at 3K. It's usually going to be multiples of the entire sun's energy output for billions of years, more if not using a quantum computer. Money isn't the relevant metric at the scales of modern cryptography.
But the Landauer limit, even at 300K, for a first preimage of even a completely secure hash is essentially zero. Define:
f(s, n, h) = 1 if there exists an n-bit preimage of h that starts with s, else 0
Computing f by brute force costs one bit erasure to prepare room for the answer. (And takes 2^(n - len(s)) operations, but we’re imagining a civilization that can build Dyson spheres and has quantum, and hence at least somewhat reversible, computers. We’re talking about the Landauer limit in particular.)
Now choose an appropriate n (slightly greater than the length of the hash) and compute f for s=[0] and s=[1]. After at most two tries, you’ll get a match, assuming a preimage exists. Call the first match s_1. Now repeat for s_1||0 and s_1||1. Call the first match s_2. Repeat this up to s_n. Now s_n is the lexicographically first n-bit preimage!
This costs O(n) energy at the Landauer limit. All crypto is broken! Never mind that the actual computation involved exceeds 2^n.
With reversible computing, yes. I strongly suspect that'll never be practically realized, or in the event that they are that the slowdown will be large enough that other fundamental limits on the speed (rather than the energy) of computing will instead dominate.
With little money you need a long time, with a lot of money a shorter time is enough.
The security is good enough when the attackers need either more money than they have to break the cryptographic scheme in a useful time, or when using the amount of money that they afford results in breaking the cryptographic scheme after a time that is too long to be useful.
For cryptographic problems which are ideally parallelizable, the product of money by time is constant.
For most real problems the amount of required money increases much faster than the solving time is reduced (except that there are some thresholds where slightly more money can produce a large decrease in the solving time, e.g. when you can afford to design and make a dedicated ASIC for the problem; however after such a threshold and the corresponding step in the required time, the quantity of money still increases faster than the time decreases).
That collisions theoretically exist is not a problem, only being able to compute them reasonably. (Reasonably being the sum of a human lifetime)