What are the capabilities of passive and active adversaries?

Question

I have trouble understanding what exactly the capabilities of passive and active adversaries are on paper and in the real world.

Answer 1

It depends on the situation. In crypto, we tend to think of a passive adversary (Eve) as someone who can listen to all communications sent between two parties (Alice and Bob). So, you create a security goal based on the "power" of your adversary. If all that Eve is doing is listening in on communications, Alice and Bob need to ensure that Eve cannot understand whatever she reads. In the real world, this is a very real threat. For example, suppose we are both sitting in a cafe with public WiFi. If I control the network or actively sniff for packets (something like Wireshark), I can read all of your communications with the website you are talking to/browsing. So, the natural goal is to prevent me from understanding what you are communicating. The natural answer is strong encryption.

An important question is, "how strong is strong enough?" The answer is complicated and has given way to several varying degrees of strength. Most security models are described as a game between you and the adversary. One such model is chosen plain-text attack. That is, suppose the adversary Eve is given oracle access to a black box decryption algorithm. That is, she can ask for the encryption of $m_1,...,m_k$ for some reasonable number of $k$ to get cipher texts $c_1,...,c_k.$. The adversary then picks two messages $m_0^*,m_1^*$ and is given the encryption of one of the two messages chosen uniformly at random $c_b$ where $b\in\{0,1\}$. If the adversary can correctly guess if $b=0$ or $b=1$ with greater than $1/2$ probability, then the adversary wins.

Now suppose Eve is allowed to change messages in transit. That is, suppose you are logging on to the Bank of America, and you ow me \$100. If I am Mallory (the name given to an active adversary), I can flip some bits of the message in transit and hope that my changes make the amount larger. Or worse, I could throw out your message and inject my own! Now you went from paying me \$100 to \$1000. We, of course, want to prevent this.

This is where message authentication codes come into play. We want to be able to "sign" our messages so that others can be sure that they came from us and not from Mallory. In practice, if I see you sending messages, you want this signature which is a part of the message (commonly called a tag for symmetric algorithms) to be what is called existentially unforgeable. That is, even if you intercept a bunch of my messages, and see a bunch of tags, you will never be able to produce a valid message and tag pair. The model is normally described as an adversary unable to distinguish between an algorithm that rejects every single message and tag combo and one that actually uses the message authentication code. Combining these two protocols, in the theoretical world, you get authenticated encryption where you are sure that not only is it Alice's message, but even Mallory cannot read it. If Mallory tries to alter it, the message will be rejected.

In practice, many things can go wrong. Just because I write a theoretically secure cipher on a blackboard does not mean there is nothing an adversary can do! Software engineers are famous for shooting themselves in the foot, and there is always an issue of backward comparability. You could write entire books on how difficult it is to implement crypto. That is because our models pretend computers are back boxes--it turns out that they are not. There are documented attacks on just about every cipher you can think of that make use of sounds computers make, the time it takes to execute, and power consumed by the computer. You can also perform protocol downgrade attacks that force victims to use broken crypto (basically every attack on TLS that has been written about in the last few years uses this sort of attack). The short answer for this is modeling real worlds attacks is an extremely daunting task.