I am a newbie of this topic. I have trouble understanding what exactly are the capabilities of passive adversary/active adversary in real world and ideal world.

  • 1
    $\begingroup$ What material have you read, or attempted to read? How about this? $\endgroup$ – fkraiem Apr 19 '16 at 20:02

It depends on the situation. In crypto, we tend to think of a passive adversary (Eve) as someone who is able to listen to all communications sent between two parties, (Alice and Bob). So, you create a security goal based on the "power" of your adversary. If all that Eve is doing is listening on communications, then Alice and Bob need to ensure that Eve cannot understand whatever it is she reads. In the real world, this is a very real threat. For example, suppose we are both sitting in Cafe with public WiFi. If I control the network, or I actively sniff for packets (something like WireShark) I can read all of your communications with the website you are talking to/browsing. So, the natural goal is to prevent me from understanding what you are communicating. The natural answer is strong encryption. An important question is "how strong is strong enough?" The answer is complicated and has given way to several varying degrees of strength. Most security models are described with a game between you and the adversary. One such model is Chosen Plain-text attack. That is, suppose the adversary Eve is given oracle access to a black box decryption algorithm. That is, she can ask for the encryption of $m_1,...,m_k$ for some reasonable number of $k$ to get cipher texts $c_1,...,c_k.$. The adversary then picks two messages $m_0^*,m_1^*$ and is given the encryption of one of the two messages chosen uniformly at random $c_b$ where $b\in\{0,1\}$. If the adversary can correctly guess if $b=0$ or $b=1$ with greater than $1/2$ probability, then the adversary wins. Now suppose Eve is allowed to change messages in transit. That is, suppose you are logging on to bank of america, and you ow me \$100. Then if I am Mallory (the name given to an active adversary), I can flip some bits of the message in transit and hope that my changes make the amount larger. Or worse, I could simply throw out your message and inject my own! Now you went from paying me \$100 to \$1000. We of course want to prevent this. This is were message authentication codes come into play. We want to be able to "sign" messages so that you can be sure that they came form you , and not Mallory. In practice, if I see you sending messages, you want this signature which is a part of the message (commonly called a tag for symmetric algorithms) to be what is called existentially unforgable. That is, even if you intercept a bunch of my messages, and see a bunch of tags, you will never be able to produce a valid message and tag pair. The model is normally described as an adversary is unable to distinguish between an algorithm that rejects every single message and tag combo and one that actually uses the message authentication code. Combining these two protocols, in the theoretical world, you get authenticated encryption where you are sure that not only is the message from Alice, but even Mallory cannot read it. If Mallory tries to alter it, the message will be rejected.

Now comes the fun part. In practice, there are a lot of things that can go wrong. Just because I write a theoretically secure cipher on a black board does not mean there is nothing an adversary can do! Software engineers are famous for shooting themselves in the foot, and there is always an issue of backwards comparability. really, you could write entire books on how difficult it is to actually implement crypto. The reason is because our models pretend computers are back boxes. Turns out, they are not. There are documented attacks on just about every cipher you can think of that make use of sounds computers make, time it takes to execute, and power consumed by the computer. You can also perform protocol downgrade attacks that force victims to use broken crypto (basically every attack on TLS that has been written about in the last few years uses this sort of attack). The short answer for this is modeling real worlds attacks is an extremely daunting task.

| improve this answer | |
  • $\begingroup$ I really loved reading this. $\endgroup$ – COLD ICE Sep 26 '17 at 13:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.