1
$\begingroup$

I've read several articles about brute force cryptanalytic attacks, but none explicitly say what algorithm is being run for each attempt, nor what criteria is used to declare an attempt a success or a failure. If one is to try every possible every possible key value, what is one feeding those keys into? A brute force attack on a block of ciphertext implies that the cryptanalyst treats the cipher as a black box. Does the cryptanalyst have the block box and are they able to drive the black box?

Say, for example, that someone uses a GUI application that takes a file and a password as input and produces an encrypted file as output. The intended use would be for the receiver to use the encrypted file and the password to get the cleartext file as output. Is this same GUI application somehow driven by the cryptanalyst's brute force application to try every possible password? Most GUI programs are not fast enough to run billions of times in a reasonable period. Add to that the fact that most encryption is compute-intensive and can be made slower to prevent such an attack.

$\endgroup$
  • $\begingroup$ The assumption, that encryption is compute intense, is wrong. It is a design goal for new ciphers to be very fast, and the basic primitives all are. "High computation time" is only a goal in the actual usage of cryptographic primitives, e.g. in PBKDF, where you can set the number of iterations of a hash function. One more thing: GUI doesn't matter at all, and no cryptanalysis will ever deal with the actual GUI of an application. Specifications are known, and cryptanalysis or any reasonable attack happens in bits and bytes. $\endgroup$ – tylo Sep 29 '14 at 13:07
  • $\begingroup$ wrt the GUI, yes, and the password entered is not the same as the key used by the cryptosystem, so the analyst must break out the encoding in order to feed it the keys they want, instead of dealing with whatever permutation is done on the password to create the key. $\endgroup$ – user3308886 Oct 6 '14 at 20:10
  • $\begingroup$ From a cryptanalytic point of view: Any function, which is not a cryptographic one can be pretty much ignored: either they are easy to invert or it is easy to find preimages. So you just look at the cryptographic protocols and primitives, and tailor the rest around (possibly afterwards). Encodings and other things can either a) be extracted by reverse engineering or b) is known already to the attacker - unless you just assume blackbox attacks, which is an unrealistic assumption today. $\endgroup$ – tylo Oct 7 '14 at 9:17
2
$\begingroup$

Brute force attacks are usually implemented in custom hardware or software for maximum performance.

Obviously the method of encryption must be determined before the attack can be implemented. The encryption method can be determined in several ways:

  • It's publicly available e.g. open source code, or open specification
  • It's secret and gets leaked by someone with access to insider information
  • It's reverse-engineered e.g by diassembling the application
$\endgroup$
1
$\begingroup$

Apparently, you are mixing two different things. Cryptography and applications that use cryptography.

In cryptography, brute-force attacks use the strategy of testing all possible values of a certain domain looking for a match. For example, if you are interested in applying a brute-force attack on the key space of a certain cipher, you must enumerate all possible keys and test its pertinence with some low-cost testing algorithm. In general, it is expected that both testing algorithm and targeted domain are made public. This comes from the fact that the security of a cryptosystem should never rely on the ignorance of the adversary with respect to the employed cryptographic algorithm. This would be an extremely naive and fragile approach.

Regarding, your application (with or w/out an interface...), to attack it using brute-force, you would need either having the encryption application or knowing which algorithm (and how it is implemented) in order to reconstruct such encryption application. In general, this should not be considered a hard task.

$\endgroup$

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.