How much of my security is improved using other levels of security when generating the seed?

Question

I had a hard time answering this question because I do not know how much security levels improve security in quantitative terms.

Is this right?

e.g. (Hashspace increment)

• 81 trits => 27^81 ^1 (low security)
• 162 trits => 27^81 ^2 (medium security)
• 243 trits => 27^81 ^3 (high security) [Citation needed]

e.g. (Attempts increment)

• 81 trits => 1* 27^81 attempts (low security)
• 162 trits => 2* 27^81 attempts (medium security) //Two times more attempts?
• 243 trits => 3* 27^81 attempts (high security) [Citation needed]

Answer 1

81 trits => 3^81 ~ 4.43×10^38 combinations

162 trits => 3^162 ~ 1.96×10^77 combinations

243 trits => 3^243 ~ 8.72×10^115 combinations

Normally security level 1 would be enough (average of about 2.2×10^38 combinations to forge a signature). The difference comes when you reuse the key (which you should not do). Then security level 2 is a lot safer than 1 (and level 3 is a lot safer than 2). I don't have specific numbers, but I think that with an "average double spend" (one that is not unlucky) level 2 is safe if the transfer is not very large.

Answer 2

The increase is significant. It's like the BIP38 in Bitcoin with 3 different indexes for a "BIP32 BIP38", because it takes a lot longer to build the seed and it requires a lot more computing power. Since this algorithm is post-quantum, you can't do much to break it and make it faster.

Let me explain:

It makes the life of your quantum attacker harder, since he has no idea what level of security (1,2 or 3) to use to get the seed X. So, as you said, the attempts are basically going to be three times the original quantity of addresses/seeds, right? Assuming no collision, of course. But the level 2 is going to take even more time than the 1st one and the 3rd level is going to be much harder than the 2nd, because the algorithm is much more complicated. And let's not forget that for each level, you will have a different result, because a security level sets basically the number of rounds of hashing.

Avelino, I have a question for you: do you find it necessary the extra 9 digits for every new address, as a checksum? Because it all uses 81 digits, while Bitcoin and other squishy-resistant cryptos are using like 32 character addresses. Don't you think it's more complicated for ordinary people to use it?