Common Attack Pattern Enumeration and Classification

Common Attack Pattern Enumeration and Classification

20

Low

Ciphertext is known.

Encryption algorithm and key size are known.

Low

• Brute Force

Low: Brute forcing encryption does not require much skill.

A powerful enough computer for the job with sufficient CPU, RAM and HD. Exact requirements will depend on the size of the brute force job and the time requirement for completion. Some brute forcing jobs may require grid or distributed computing (e.g. DES Challenge). On average, for a binary key of size N, 2^(N/2) trials will be needed to find the key that would decrypt the ciphertext to obtain the original plaintext. Obviously as N gets large the brute force approach becomes infeasible.

None. This attack happens offline.

Use commonly accepted algorithms and recommended key sizes. The key size used will depend on how important it is to keep the data confidential and for how long.

In theory a brute force attack performing an exhausitve keyspace search will always succeed, so the goal is to have computational security. Moore's law needs to be taken into account that suggests that computing resources double every eighteen months.

• Information Leakage

Typically cryptography, if done right, will rarely be the weakest link in the system.  Problems begin when people either decide to play cryptographers themselves and roll out custom crypto, use key sizes that are too small, develop their own cryptographic protocols (or misuse existing cryptographic protocols).  There are some other things that can be done wrong, such as not using good sources of randomness when generating encryption keys and initialization vector values.