SecurityDatabase\Encrypt\Encryption Brute Forcing
Attack Pattern ID: 20 (Standard Attack Pattern Completeness: Complete)Typical Severity: LowStatus: Draft
+ Description

Summary

An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.

Attack Execution Flow

  1. Determine the ciphertext and the encryption algorithm.

  2. Perform an exhaustive brute force search of the keyspace, producing candidate plaintexts and observing if they make sense.

+ Attack Prerequisites

Ciphertext is known.

SecurityDatabase\Encrypt\Encryption algorithm and key size are known.

+ Typical Likelihood of Exploit

Likelihood: Low

+ Methods of Attack
  • Brute Force
+ Examples-Instances

Description

In 1997 the original DES challenge used distributed net computing to brute force the encryption key and decrypt the ciphertext to obtain the original plaintext. Each machine was given its own section of the keyspace to cover. The ciphertext was decrypted in 96 days.

+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: Low

Brute forcing encryption does not require much skill.

+ Resources Required

A powerful enough computer for the job with sufficient CPU, RAM and HD. Exact requirements will depend on the size of the brute force job and the time requirement for completion. Some brute forcing jobs may require grid or distributed computing (e.g. DES Challenge).

On average, for a binary key of size N, 2^(N/2) trials will be needed to find the key that would decrypt the ciphertext to obtain the original plaintext.

Obviously as N gets large the brute force approach becomes infeasible.

+ Indicators-Warnings of Attack

None. This attack happens offline.

+ Solutions and Mitigations

Use commonly accepted algorithms and recommended key sizes. The key size used will depend on how important it is to keep the data confidential and for how long.

In theory a brute force attack performing an exhausitve keyspace search will always succeed, so the goal is to have computational security. Moore's law needs to be taken into account that suggests that computing resources double every eighteen months.

+ Attack Motivation-Consequences
  • Information Leakage
+ Related Weaknesses
CWE-IDWeakness NameWeakness Relationship Type
326Inadequate SecurityDatabase\Encrypt\Encryption StrengthTargeted
327Use of a Broken or Risky Cryptographic AlgorithmTargeted
693Protection Mechanism FailureTargeted
719OWASP Top Ten 2007 Category A8 - Insecure Cryptographic StorageSecondary
+ Related Attack Patterns
NatureTypeIDNameDescriptionView(s) this relationship pertains toView\(s\)
ChildOfAttack PatternAttack Pattern112Brute Force 
Mechanism of Attack (primary)1000
ParentOfAttack PatternAttack Pattern97Cryptanalysis 
Mechanism of Attack1000
+ Content History
Submissions
SubmitterOrganizationDate
Eugene LebanidzeCigital, Inc2007-02-26
Modifications
ModifierOrganizationDateComments
Sean BarnumCigital, Inc2007-03-01Review and revision of content
Richard StruseVOXEM, Inc2007-03-26Review and feedback leading to changes in Description, Resources Required and Context Description
Sean BarnumCigital, Inc2007-04-13Modified pattern content according to review and feedback
Back to top