Home › Security Architecture & Engineering
Cryptanalytic Attacks Explained — Cryptography (Part 7)
Security Architecture & EngineeringCISSPSecurity+
Cryptanalysis is how cryptography is attacked. Each named attack is defined by what the attacker already has, or by how they hit the system. In Part 7 of our Cryptography series, we define brute force through pass-the-hash, with the working examples: WEP, Enigma, Midway, Bleichenbacher, Heartbleed, and DigiNotar.
What you will learn
- Why your job is to follow NIST / ENISA, not invent ciphers
- Three failure classes — algorithm/protocol, implementation, key management
- Brute force — try every key; defense is key length
- Ciphertext-only — attacker has only ciphertext
- Known plaintext — ciphertext plus some or all of the original message
- Chosen plaintext — attacker picks the plaintext, reads the ciphertext
- Frequency analysis — how often characters appear in ciphertext
- Chosen ciphertext — attacker picks the ciphertext, reads the plaintext
- Birthday — hunt two messages with the same hash
- Implementation vs side-channel vs fault injection vs timing
- Man-in-the-middle — intercept and swap public keys
- Meet-in-the-middle — break two-round encryption; not MITM
- Replay — resend a captured message later
- Pass-the-hash — present a stolen hash; skip the password