It's fairly normal in crypto papers to express vulnerabilities and potential vulnerabilities in base two, as so many other bits of crypto, like key sizes, etc, are also expressed in that base.