Cryptanalysis and Cryptographic Attacks
Cryptanalysis and Cryptographic Attacks
The exam tests attack classification: whether an attack targets the mathematics, the implementation, or the protocol, and what control actually stops it.
Attack families
- Exhaustive and precomputed. Brute force tries keys; dictionary attacks try likely passwords; rainbow tables trade storage for time against unsalted hashes. Salting and slow KDFs defeat the last two.
- Analytic. Differential and linear cryptanalysis examine cipher structure. Frequency analysis still breaks classical substitution ciphers.
- Attack models. Ciphertext-only, known-plaintext, chosen-plaintext, chosen-ciphertext - each assumes more attacker capability than the last.
- Protocol attacks. Man-in-the-middle against unauthenticated DH, replay, downgrade (FREAK, Logjam, POODLE), and padding oracles against CBC.
- Implementation and side channels. Timing, cache, power and fault attacks exploit code, not the cipher. Heartbleed was a buffer over-read, not a break of TLS cryptography.
- Meet-in-the-middle on double encryption explains why 2DES adds little and why 3-key 3DES yields roughly 112 bits.
Worked example
A CBC padding oracle: an attacker flips the last byte of ciphertext block C(i−1). The server returns "400 bad padding" or "200 OK". Because the modified byte XORs directly into the final plaintext byte of block i, the attacker learns when padding is valid and recovers that byte, then the next, at roughly 128 queries per byte. The fix is authenticated encryption (GCM) plus uniform error responses, not a longer key.
Traps
- Calling every incident a "cryptographic break" when the flaw was a bug or a configuration.
- Believing a 4096-bit RSA key saves a protocol that leaks padding information.
- Confusing rainbow tables with brute force.
- Forgetting that chosen-ciphertext capability is assumed in padding-oracle scenarios.
- Ignoring that side channels bypass the algorithm entirely.