Cryptanalysis, Attacks, and Cryptographic Failures
Cryptanalysis attacks the design or the implementation rather than guessing the key. This domain tests attack models, classic attacks against modes and protocols, side channels, and what quantum computing changes.
Core rules
- Attack models, weakest to strongest: ciphertext-only, known-plaintext, chosen-plaintext, chosen-ciphertext, related-key. A cipher is judged by its resistance to the strongest realistic model.
- Exhaustive search costs 2^n; the birthday bound gives collisions near 2^(n/2); meet-in-the-middle halves the exponent for double encryption.
- Classic failures: ECB pattern leakage, CBC padding oracles, CTR/GCM nonce reuse, IV reuse, weak PRNGs, hard-coded keys, and deriving keys from passwords without a KDF.
- Protocol attacks: man in the middle, replay, downgrade, cross-protocol, and certificate-validation bypasses. Implementation attacks: Heartbleed (buffer over-read), POODLE and BEAST (CBC in TLS), CRIME (compression side channel).
- Side channels leak through timing, power, cache behaviour and error messages rather than mathematics. Fault injection corrupts computation to expose keys.
- Quantum: Shor's algorithm breaks RSA, DH and ECC for key agreement and signatures; Grover's gives a quadratic speed-up, so AES-256 retains roughly 128-bit strength. Symmetric key sizes double; asymmetric algorithms must move to post-quantum schemes.
Worked example
Double DES computes C = E_k2(E_k1(P)). An attacker with a known plaintext-ciphertext pair builds a table of E_k(P) for all 2^56 values of k1, then computes D_k2(C) for every k2 and looks for a match. The cost is about 2^56 operations and 2^56 stored blocks, not 2^112, so two 56-bit keys give only about 57 bits of real strength. That is why 2DES was abandoned in favour of 3DES, and why 'double encryption is enough' is a trap.
Traps
Longer keys do not fix a broken mode or a bad random number generator. A block cipher is not a protocol. Claims of 'unbreakable' ignore implementation and key management. Quantum computing affects asymmetric and symmetric cryptography very differently.