Consider the following: A whole system depends on the security of one private key and if this key is, for any reason, compromised, the whole system will be compromised.

What's a suitable name for such an attack?


The whole system depends on the security of one private key (..that gets..) compromised.
Give a suitable name for such an attack.

I would call this class of attacks: Master key compromise.

Examples of such attacks (as asked in comment) include

  • The master key is revealed to an attacker by physically stealing a backup copy, bribery or duress (obligatory XKCD) of a holder of the master key. Mitigations use safes, and/or k-out-of-m secret sharing.
  • The adversary extracts the master key from a device holding it (the most obvious example of that is when the master key is in every device, which is not unseen). Mitigations include using security-certified device at least for master keys (HSMs, SAMs, Smart Cards). Method of extraction include
    • directly reading the memory/medium that stores the key,
    • examining memory where the device using the key copies it, perhaps temporarily (e.g. with a debugger, a JTAG port, exploitation of a buffer overflow vulnerability somewhere in the code..)
    • timing attack, (differential) power analysis and similar side-channel attacks (including fault attacks)
  • Cryptanalytic attack or/and brute force attack, where a secret key (including private) is inferred from public material, like ciphertext, plaintext made available to an adversary, public key. Mitigation include using larger security parameters for master keys.
  • $\begingroup$ coldboot, heartbleed, cache attack $\endgroup$ – kelalaka Oct 21 '18 at 15:54

It is not an attack model while it is a security feature for a scheme. The adversary might be able to compromise these lack of secrecy by different attacks to obtain the master key and find other session keys. Take a look at this question. Definitions of secrecy

  • $\begingroup$ Could you please mention any kind of attacks that can compromise the master key ?? $\endgroup$ – Mohamed Oct 21 '18 at 6:15
  • $\begingroup$ Shoulder surfing. $\endgroup$ – Thomas M. DuBuisson Oct 21 '18 at 6:22
  • $\begingroup$ There are different ways to obtain that in a specific agreement key protocol. One of the most famous is the Man-in-The-Middle attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other to know the first (master) key between them. Also, side-channel attack is another one if the attacker has access to the crypto system is able to try for obtaining the master key, reply attack and so on. You should evaluate one of them is applicable by considering different features for each security system. $\endgroup$ – Mahdi Sedaghat Oct 21 '18 at 6:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.