Cryptanalysis - Revision history

MediaWiki spam cleanup: Reverting to last version not containing links to www.textnorodronn.com

2009-05-27T18:31:02Z

Reverting to last version not containing links to www.textnorodronn.com

Deleted user at 19:53, 22 May 2009

2009-05-22T19:53:41Z

KirstenS at 11:41, 23 April 2009

2009-04-23T11:41:18Z

KirstenS at 23:19, 7 April 2009

2009-04-07T23:19:12Z

KirstenS at 01:56, 17 February 2009

2009-02-17T01:56:19Z

KirstenS at 19:06, 14 February 2009

2009-02-14T19:06:04Z

KirstenS: /* Examples */

2009-02-14T19:05:34Z

‎Examples

KirstenS: /* Description */

2009-02-14T19:03:35Z

‎Description

KirstenS at 01:16, 14 September 2008

2008-09-14T01:16:20Z

KirstenS: /* Related Controls */

2008-09-12T21:48:52Z

‎Related Controls

← Older revision		Revision as of 18:31, 27 May 2009
Line 1:		Line 1:
−	~~http://www.textnorodronn.com~~
	{{Template:Attack}}		{{Template:Attack}}
	<br>		<br>

← Older revision		Revision as of 19:53, 22 May 2009
Line 1:		Line 1:
		+	http://www.textnorodronn.com
	{{Template:Attack}}		{{Template:Attack}}
	<br>		<br>

← Older revision		Revision as of 11:41, 23 April 2009
Line 3:		Line 3:
	[[Category:OWASP ASDR Project]]		[[Category:OWASP ASDR Project]]

		+
		+	Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

@@ Line 2: / Line 2: @@
 <br>
 [[Category:OWASP ASDR Project]]
-[[ASDR Table of Contents]]

@@ Line 1: / Line 1: @@
 {{Template:Attack}}
 <br>
 [[Category:OWASP ASDR Project]]
@@ Line 17: / Line 16: @@
 ==Risk Factors==
 TBD
 ==Examples ==
@@ Line 36: / Line 33: @@
 * [[Cryptography]]
 * [[Randomization]]
 Use proven cryptographic algorithms with recommended key sizes.

@@ Line 3: / Line 3: @@
 <br>
 [[Category:OWASP ASDR Project]]
-[[ASDR Table of Contents]]__TOC__
+[[ASDR Table of Contents]]
 ==Description==
 Cryptanalysis is a process of finding weaknesses in cryptographic algorithms and using these weaknesses to decipher the ciphertext without knowing the secret key (instance deduction).  Sometimes the weakness is not in the cryptographic algorithm itself, but rather in how it is applied that makes cryptanalysis successful.  An attacker may have other goals as well, such as:
 * Total Break - Finding the secret key.

← Older revision		Revision as of 19:05, 14 February 2009
Line 22:		Line 22:

	==Examples ==		==Examples ==
−
	A very easy to understand (but totally inapplicable to modern cryptographic ciphers) example is a cryptanalysis technique called frequency analysis that can be successfully applied to the very basic classic encryption algorithms that performed monoalphabetic substitution replacing each letter in the plaintext with its predetermined mapping letter from the same alphabet. This was considered an improvement over a more basic technique that would simply shift all of the letters of the plaintext by some constant number of positions and replace the original letters with the new letter with the resultant alphabet position. While monoalphabetic substitution ciphers are resilient to blind brute force, they can be broken easily with nothing more than a pen and paper. Frequency analysis cryptanalysis uses the fact that natural language is not random and monoalphabetic substitution does not hide the statistical properties of the natural language. So if the letter "E" in an English language occurs with a certain known frequency (about 12.7%), whatever "E" was substituted with to get to the ciphertext, will occur with the similar frequency. Having this frequency information allows the cryptanalyst to quickly determine the substitutions and decipher the ciphertext. Frequency analysis techniques are not applicable to modern ciphers as they are all resilient to it (unless this is a very bad case of a homegrown encryption algorithm). This example is just here to illustrate a rudimentary example of cryptanalysis.		A very easy to understand (but totally inapplicable to modern cryptographic ciphers) example is a cryptanalysis technique called frequency analysis that can be successfully applied to the very basic classic encryption algorithms that performed monoalphabetic substitution replacing each letter in the plaintext with its predetermined mapping letter from the same alphabet. This was considered an improvement over a more basic technique that would simply shift all of the letters of the plaintext by some constant number of positions and replace the original letters with the new letter with the resultant alphabet position. While monoalphabetic substitution ciphers are resilient to blind brute force, they can be broken easily with nothing more than a pen and paper. Frequency analysis cryptanalysis uses the fact that natural language is not random and monoalphabetic substitution does not hide the statistical properties of the natural language. So if the letter "E" in an English language occurs with a certain known frequency (about 12.7%), whatever "E" was substituted with to get to the ciphertext, will occur with the similar frequency. Having this frequency information allows the cryptanalyst to quickly determine the substitutions and decipher the ciphertext. Frequency analysis techniques are not applicable to modern ciphers as they are all resilient to it (unless this is a very bad case of a homegrown encryption algorithm). This example is just here to illustrate a rudimentary example of cryptanalysis.

@@ Line 9: / Line 9: @@
 Cryptanalysis is a process of finding weaknesses in cryptographic algorithms and using these weaknesses to decipher the ciphertext without knowing the secret key (instance deduction).  Sometimes the weakness is not in the cryptographic algorithm itself, but rather in how it is applied that makes cryptanalysis successful.  An attacker may have other goals as well, such as:
-* Total Break - Finding the secret key
+* Total Break - Finding the secret key.
 * Gobal Deduction - Finding a functionally equivalent algorithm for encryption and decryption that does not require knowledge of the secret key.
-* Information Deduction - Gaining some information about plaintexts or ciphertexts that was not previously known
+* Information Deduction - Gaining some information about plaintexts or ciphertexts that was not previously known.
-* Distinguishing Algorithm - The attacker has the ability to distinguish the output of the encryption (ciphertext) from a random permutation of bits
+* Distinguishing Algorithm - The attacker has the ability to distinguish the output of the encryption (ciphertext) from a random permutation of bits.
 The goal of the attacker performing cryptanalysis will depend on the specific needs of the attacker in a given attack context.  In most cases, if cryptanalysis is successful at all, an attacker will not be able to go past being able to deduce some information about the plaintext (goal 3).  However, that may be sufficient for an attacker, depending on the context.

@@ Line 26: / Line 26: @@
 ==Related [[Threat Agents]]==
 * [[:Category:Authentication]]
 ==Related [[Attacks]]==
 * [[Brute force attack]]
 ==Related [[Vulnerabilities]]==
 ==Related [[Controls]]==
 * [[Encryption]]
 * [[Cryptography]]

@@ Line 37: / Line 37: @@
 ==Related [[Controls]]==
 Use proven cryptographic algorithms with recommended key sizes.
@@ Line 45: / Line 49: @@
 * Generating key material using good sources of randomness and avoiding known weak keys
 * Using proven protocols and their implementations.
-* Picking the most appropriate cryptographic algorithm for your usage context and data
+* Picking the most appropriate cryptographic algorithm for your usage context and data]]
 ==References==