# The attacker model of the Lucky13 attack in TLS

Lucky13 is a timing attack against the MAC in the CBC MAC-then-encrypt ciphersuites. In the attack's page:

The attacks involve detecting small differences in the time at which TLS error messages appear on the network in response to attacker-generated ciphertexts.

My question is: Can a passive adversary perform Lucky13? In other words, I need to know if Lucky13 attacker's model is active MitM or passive network attacker who just collect traffic and perform analysis afterwards?

Can a passive adversary perform Lucky13?

No. The attacker must have the capability to inject chosen ciphertexts into the stream. A passive adversary (who listens into the encrypted traffic but cannot modify it) cannot do this.

The Lucky13 article on Our Results;

... attacks can be mounted by a standard man-in-the-middle (MITM) attacker who sees only ciphertext and can inject ciphertexts of his own composition into the network.

Definition of passive and active MTIM from sll.com

Passive MITM: In a passive MITM attack attackers ‘tap’ the communication, capturing information in transit without changing it.

Active MITM: If attackers attempt to modify or tamper with the information itself they are committing an active MITM attack. A very common way to launch a MITM attack is by creating a fake node on a publicly-available computer network, such as a coffee shop's WiFi network.

Injection is an attempt to modify therefore it is an active MITM attack.

on the discussion;

We reiterate that the attacks are ciphertext-only, and so can be carried out by the standard MITM attacker, without a chosen-plaintext capability.

Chosen plaintext attack means; the attacker obtains encryption of plaintexts of his choice. So, in Luck13, the attacker only used ciphertext that they can obtain and injected them into the network.

• Thank you. The question was whether it is passive or active MITM. Since ..can inject ciphertexts then it is an active as @poncho answer that I accepted. I have looked at these parts already. It was confusing as the second part says: ..by the standard MITM attacker, without a chosen-plaintext capability.. and it is not specifying whether active or passive MITM? also I do not know if without a chosen-plaintext capability means passive? – user9371654 Oct 28 '18 at 8:18
• Yes, poncho's answer more for into you. On results it says ...and inject. Therefore active. The attack performed only on ciphertext. No it is not passive, to have chosen plaintexts you have to be active to ask the queries to the server. – kelalaka Oct 28 '18 at 8:46