An attacker, armed with the cipher text and the encryption algorithm used,
performs an exhaustive (brute force) search on the key space to determine
the key that decrypts the cipher text to obtain the plaintext.
Attack Execution Flow
Determine the ciphertext and the encryption
algorithm.
Perform an exhaustive brute force search of the
keyspace, producing candidate plaintexts and
observing if they make sense.
Attack Prerequisites
Ciphertext is known.
Encryption algorithm and key size are known.
Typical Likelihood of Exploit
Likelihood: Low
Methods of Attack
Brute Force
Examples-Instances
Description
In 1997 the original DES challenge used distributed net computing to
brute force the encryption key and decrypt the ciphertext to obtain the
original plaintext. Each machine was given its own section of the
keyspace to cover. The ciphertext was decrypted in 96 days.
Attacker Skills or Knowledge Required
Skill or Knowledge Level: Low
Brute forcing encryption does not require much skill.
Resources Required
A powerful enough computer for the job with sufficient CPU, RAM and HD. Exact
requirements will depend on the size of the brute force job and the time
requirement for completion. Some brute forcing jobs may require grid or
distributed computing (e.g. DES Challenge).
On average, for a binary key of size N, 2^(N/2) trials will be needed to find
the key that would decrypt the ciphertext to obtain the original
plaintext.
Obviously as N gets large the brute force approach becomes infeasible.
Indicators-Warnings of Attack
None. This attack happens offline.
Solutions and Mitigations
Use commonly accepted algorithms and recommended key sizes. The key size
used will depend on how important it is to keep the data confidential and
for how long.
In theory a brute force attack performing an exhausitve keyspace search
will always succeed, so the goal is to have computational security. Moore's
law needs to be taken into account that suggests that computing resources
double every eighteen months.
Vision and Technical Leadership provided by Cigital, Inc.
This Web site is hosted by The MITRE Corporation.
Copyright 2009, The MITRE Corporation. CAPEC and the CAPEC logo are trademarks of The MITRE Corporation.
Description
