1
$\begingroup$

I've read several articles about brute force cryptanalytic attacks, but none explicitly say what algorithm is being run for each attempt, nor what criteria is used to declare an attempt a success or a failure. If one is to try every possible every possible key value, what is one feeding those keys into? A brute force attack on a block of ciphertext implies that the cryptanalyst treats the cipher as a black box. Does the cryptanalyst have the block box and are they able to drive the black box?

Say, for example, that someone uses a GUI application that takes a file and a password as input and produces an encrypted file as output. The intended use would be for the receiver to use the encrypted file and the password to get the cleartext file as output. Is this same GUI application somehow driven by the cryptanalyst's brute force application to try every possible password? Most GUI programs are not fast enough to run billions of times in a reasonable period. Add to that the fact that most encryption is compute-intensive and can be made slower to prevent such an attack.

Improve this question
$\endgroup$
3
  • $\begingroup$ The assumption, that encryption is compute intense, is wrong. It is a design goal for new ciphers to be very fast, and the basic primitives all are. "High computation time" is only a goal in the actual usage of cryptographic primitives, e.g. in PBKDF, where you can set the number of iterations of a hash function. One more thing: GUI doesn't matter at all, and no cryptanalysis will ever deal with the actual GUI of an application. Specifications are known, and cryptanalysis or any reasonable attack happens in bits and bytes. $\endgroup$
    – tylo
    Sep 29, 2014 at 13:07
  • $\begingroup$ wrt the GUI, yes, and the password entered is not the same as the key used by the cryptosystem, so the analyst must break out the encoding in order to feed it the keys they want, instead of dealing with whatever permutation is done on the password to create the key. $\endgroup$
    – user3308886
    Oct 6, 2014 at 20:10
  • $\begingroup$ From a cryptanalytic point of view: Any function, which is not a cryptographic one can be pretty much ignored: either they are easy to invert or it is easy to find preimages. So you just look at the cryptographic protocols and primitives, and tailor the rest around (possibly afterwards). Encodings and other things can either a) be extracted by reverse engineering or b) is known already to the attacker - unless you just assume blackbox attacks, which is an unrealistic assumption today. $\endgroup$
    – tylo
    Oct 7, 2014 at 9:17

2 Answers 2

Reset to default
2
$\begingroup$

Brute force attacks are usually implemented in custom hardware or software for maximum performance.

Obviously the method of encryption must be determined before the attack can be implemented. The encryption method can be determined in several ways:

  • It's publicly available e.g. open source code, or open specification
  • It's secret and gets leaked by someone with access to insider information
  • It's reverse-engineered e.g by diassembling the application
Improve this answer
$\endgroup$
1
$\begingroup$

Apparently, you are mixing two different things. Cryptography and applications that use cryptography.

In cryptography, brute-force attacks use the strategy of testing all possible values of a certain domain looking for a match. For example, if you are interested in applying a brute-force attack on the key space of a certain cipher, you must enumerate all possible keys and test its pertinence with some low-cost testing algorithm. In general, it is expected that both testing algorithm and targeted domain are made public. This comes from the fact that the security of a cryptosystem should never rely on the ignorance of the adversary with respect to the employed cryptographic algorithm. This would be an extremely naive and fragile approach.

Regarding, your application (with or w/out an interface...), to attack it using brute-force, you would need either having the encryption application or knowing which algorithm (and how it is implemented) in order to reconstruct such encryption application. In general, this should not be considered a hard task.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.