Attack model

<h2 id="models">Models</h2>
Some common attack models are:

<ul><li><a href="/facts/Ciphertext-only_attack/m47yGXDL">Ciphertext-only attack</a> (COA) - in this type of attack it is assumed that the cryptanalyst has access only to the ciphertext, and has no access to the plaintext. This type of attack is the most likely case encountered in real life cryptanalysis, but is the weakest attack because of the cryptanalyst's lack of information. Modern ciphers are required to be very resistant to this type of attack. In fact, a successful cryptanalysis in the COA model usually requires that the cryptanalyst must have some information on the plaintext, such as its distribution, the language in which the plaintexts are written in, standard protocol data or framing which is part of the plaintext, etc.<a class="footnote-ref" id="fnref:2" href="#fn:2">2</a>
<ul><li><a href="/facts/Brute_force_attack/TXl8pkfb">Brute force attack</a> or exhaustive key search - in this attack every possible key is tried until the correct one is found. Every cipher except the unbreakable <a href="/facts/Information-theoretic_security/DG2q6XeI">Information-theoretically secure</a> methods like the <a href="/facts/One_time_pad/03hA9XSQ">one time pad</a> is vulnerable to this method, and as its difficulty does not depend on the cipher but only on the key length - it's not considered a real cryptanalysis of the cipher. If the key has N bits, there are 2N possible keys to try, so a brute-force attack can recover the cipher in a worst-case time proportional to 2N and an average time of 2N-1. This is often used as a standard of comparison for other attacks. Brute-force can be applied in ciphertext-only settings, but the cryptanalyst must have enough information about the plaintext (at least N bits) to allow the identification of the correct key once it is tried.</li></ul></li>
<li><a href="/facts/Known-plaintext_attack/MF3CweFd">Known-plaintext attack</a> (KPA) - in this type of attack it is assumed that the cryptanalyst has access to at least a limited number of pairs of plaintext and the corresponding enciphered text. An interesting example dates back to <a href="/facts/World_War_II/2efV5L1U">World War II</a>, during which the <a href="/facts/Allies_of_World_War_II/YzCdtjDY">Allies</a> used known-plaintexts in their successful <a href="/facts/Cryptanalysis_of_the_Enigma/RJB0W0S0">cryptanalysis of the Enigma</a> machine cipher. The plaintext samples are called "<a href="/facts/Crib_(cryptanalysis)/MF3CweFd">cribs</a>"; the term originated at <a href="/facts/Bletchley_Park/ID0B04WB">Bletchley Park</a>, the British <a href="/facts/World_War_II/2efV5L1U">World War II</a> decryption operation.<a class="footnote-ref" id="fnref:3" href="#fn:3">3</a><a class="footnote-ref" id="fnref:4" href="#fn:4">4</a> Very early on cribs were produced from stolen plaintext and intercepted ciphertext, and as such qualify for their classification as a known-plaintext attack. However, as knowledge and experience increased, the known-plaintexts were actually generated mostly through a series of intelligent guesses based on gained experience and logic, and not through a channel providing direct access to these plaintext. Technically the latter attacks are classified as the harder-to-execute ciphertext-only attacks.</li>
<li><a href="/facts/Chosen-plaintext_attack/uTJ0XCAN">Chosen-plaintext attack</a> (CPA) - in this attack the cryptanalyst is able to choose a number of plaintexts to be enciphered and have access to the resulting ciphertext. This allows the analyst to explore whatever areas of the plaintext <a href="/facts/State_space/H1vjb3LL">state space</a> they wish and may allow them to exploit vulnerabilities and nonrandom behavior which appear only with certain plaintexts. In the widely used <a href="/facts/Public-key_cryptosystem/gowoFTxS">public-key cryptosystems</a>, the key used to encrypt the plaintext is publicly distributed and anyone may use it, allowing the cryptanalyst to create ciphertext of any plaintext they want. So public-key algorithms must be resistant to all chosen-plaintext attacks.
<ul><li><a href="/facts/Adaptive_chosen-plaintext_attack/uTJ0XCAN">Adaptive chosen-plaintext attack</a> (CPA2) - in this attack the analyst can choose a sequence of plaintexts to be encrypted and have access to the ciphertexts. At each step they have the opportunity to analyze the previous results before choosing the next plaintext. This allows them to have more information when choosing plaintexts than if they were required to choose all the plaintexts beforehand as required in the chosen-plaintext attack.</li></ul></li>
<li><a href="/facts/Chosen-ciphertext_attack/l9fL7fYR">Chosen-ciphertext attack</a> (CCA) - in this attack the analyst can choose arbitrary ciphertext and have access to plaintext decrypted from it. In an actual real life case this would require the analyst to have access to the communication channel and the recipient end.
<ul><li><a href="/facts/Lunchtime_attack/l9fL7fYR">Lunchtime attack</a> or midnight attack - In this variant it is assumed the cryptanalyst can only have access to the system for a limited time or a limited number of plaintext-ciphertext pairs, after which he must show progress. The name comes from the common security vulnerability in which an employee signs into their encrypted computer and then leaves it unattended while they go for lunch, allowing an attacker a limited-time access to the system.</li>
<li><a href="/facts/Adaptive_chosen-ciphertext_attack/SCKGPjI6">Adaptive chosen-ciphertext attack</a> (CCA2) - in this attack the analyst can choose a series of ciphertexts and see the resulting plaintexts, with the opportunity at each step to analyze the previous ciphertext-plaintext pairs before choosing the next ciphertext.</li></ul></li>
<li>Open key model attacks - where the attacker has some knowledge about the key for the cipher being attacked.<a class="footnote-ref" id="fnref:5" href="#fn:5">5</a>
<ul><li><a href="/facts/Related-key_attack/XkVfKsSk">Related-key attack</a> - in this attack the cryptanalyst has access to ciphertext encrypted from the same plaintext using other (unknown) keys which are related to the target key in some mathematically defined way. For example, the analyst might know that the last N bits of the keys are identical. This is relevant because modern computer encryption protocols generate keys automatically, leading to the possibility of relations between them. The <a href="/facts/Wired_Equivalent_Privacy/LHqkdrCf">Wired Equivalent Privacy</a> (WEP) privacy protocol which was used to protect <a href="/facts/WiFi/u94quCsx">WiFi</a> internet devices was found to be vulnerable to a related-key attack due to a weakness in <a href="/facts/RC4/HAR5kL0T">RC4</a>.</li>
<li><a href="/facts/Known-key_distinguishing_attack/vWvQhIJ6">Known-key distinguishing attack</a> and chosen-key distinguishing attack, where an attacker can distinguish ciphertext from random along with the knowledge or ability to choose the key.<a class="footnote-ref" id="fnref:6" href="#fn:6">6</a></li></ul></li>
<li><a href="/facts/Side-channel_attack/2B1dfBty">Side-channel attack</a> - This is not strictly speaking a cryptanalytic attack, and does not depend on the strength of the cipher. It refers to using other data about the encryption or decryption process to gain information about the message, such as electronic noise produced by encryption machines, sound produced by keystrokes as the plaintext is typed, or measuring how much time various computations take to perform.</li>
<li><a href="/facts/Evil_maid_attack/bHjANJG7">Evil maid attack</a> - This is also not a cryptanalytic attack. It refers to an unauthorized person such as a maid getting physical access to the encryption equipment, and modifying it to disclose the plaintext or key when it is used. An example would be a maid with access to her employer's computer, plugging a thumbdrive into it with malware which installed a <a href="/facts/Keylogger/DQRJfEvc">keylogger</a> which sent the keystrokes to an enemy agent.</li></ul>
Different attack models are used for other cryptographic primitives, or more generally for all kind of security systems. Examples for such attack models are:

<ul><li><a href="/facts/Adaptive_chosen-message_attack/tY7e2pnW">Adaptive chosen-message attack</a> for <a href="/facts/Digital_signatures/tY7e2pnW">digital signatures</a>.</li></ul>

<h2 id="further-reading">Further reading</h2>
<ul><li>Niels Ferguson; Bruce Schneier (2003). "Introduction to Cryptography: Attacks". In Carol A. Long (ed.). Practical Cryptography (Hardcover ed.). Wiley Publishing Inc. pp. 30–32. <a href="/facts/ISBN_(identifier)/15AdSPa9">ISBN</a> 0-471-22894-X.</li>
<li>Susan Hansche; John Berti; Chris Hare (2004). <a href="https://archive.org/details/officialiscguide0000hans/page/389">"6 - Cryptography: Cryptoanalysis and attacks"</a>. Official (ISC)² Guide to the CISSP Exam (Hardcover ed.). Auerbach Publications. pp. <a href="https://archive.org/details/officialiscguide0000hans/page/389">389–393</a>. <a href="/facts/ISBN_(identifier)/15AdSPa9">ISBN</a> 0-8493-1707-X.</li>
<li><a href="/facts/Doug_Stinson/XYaqMaAt">Stinson, Douglas R.</a> (19 July 2004). <a href="https://web.archive.org/web/20110515130710/http://www.cacr.math.uwaterloo.ca/~dstinson/papers/polemic.ps">"A Polemic on Notions of Cryptographic Security"</a>. <a href="/facts/University_of_Waterloo/NANSHN5Y">University of Waterloo</a> <a href="/facts/Centre_for_Applied_Cryptographic_Research/KH2BV5on">Centre for Applied Cryptographic Research</a>. Archived from <a href="http://www.cacr.math.uwaterloo.ca/~dstinson/papers/polemic.ps">the original</a> on 15 May 2011.</li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1">Information Security Laboratory (powerpoint) <a href="https://web.archive.org/web/20060902081253/http://islab.oregonstate.edu/koc/ece575/notes/L2.ppt" target="_blank">https://web.archive.org/web/20060902081253/http://islab.oregonstate.edu/koc/ece575/notes/L2.ppt</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></li>
<li id="fn:2">Bruce Schneier (2000). "Cryptography". Secrets & Lies: Digital Security in a Networked World (Hardcover ed.). Wiley Computer Publishing Inc. pp. 90–91. ISBN 0-471-25311-1. <a href="0-471-25311-1" target="_blank">0-471-25311-1</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></li>
<li id="fn:3">Gordon Welchman, The Hut Six Story: Breaking the Enigma Codes, p. 78. <a href="/wiki/Gordon_Welchman" target="_blank">/wiki/Gordon_Welchman</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></li>
<li id="fn:4">Michael Smith, "How It Began: Bletchley Park Goes to War," in B. Jack Copeland, ed., Colossus: The Secrets of Bletchley Park's Codebreaking Computers. <a href="/wiki/B._Jack_Copeland" target="_blank">/wiki/B._Jack_Copeland</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></li>
<li id="fn:5">Elena Andreeva; Andrey Bogdanov; Bart Mennink (8 July 2014). Towards Understanding the Known-Key Security of Block Ciphers. FSE 2014. <a href="https://eprint.iacr.org/2015/222" target="_blank">https://eprint.iacr.org/2015/222</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></li>
<li id="fn:6">Elena Andreeva; Andrey Bogdanov; Bart Mennink (8 July 2014). Towards Understanding the Known-Key Security of Block Ciphers. FSE 2014. <a href="https://eprint.iacr.org/2015/222" target="_blank">https://eprint.iacr.org/2015/222</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></li>
</ol>

Attack model open-in-new

Attack model