CAPEC-20 - Encryption Brute Forcing

An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.

Severity

Likelihood

Confidentiality

Integrity

Availability

  • Attack Methods 1
  • Brute Force
  • Scopes 1
  • Read application data
  • Confidentiality

Low level: Brute forcing encryption does not require much skill.

Ciphertext is known.

Encryption algorithm and key size are known.

A powerful enough computer for the job with sufficient CPU, RAM and HD. Exact requirements will depend on the size of the brute force job and the time requirement for completion. Some brute forcing jobs may require grid or distributed computing (e.g. DES Challenge).

Step 1 -

Determine the ciphertext and the encryption algorithm..


Step 1 -

Perform an exhaustive brute force search of the key space, producing candidate plaintexts and observing if they make sense..


Use commonly accepted algorithms and recommended key sizes. The key size used will depend on how important it is to keep the data confidential and for how long.

In theory a brute force attack performing an exhaustive key space search will always succeed, so the goal is to have computational security. Moore's law needs to be taken into account that suggests that computing resources double every eighteen months.