I was wondering what is the conceptual difference between these two passive attacks on a network. I was reading about them on Wikipedia and they seem quite similar to me. Is there a difference?
The Wikipedia definitions;
- Traffic analysis is the process of intercepting and examining messages in order to deduce information from patterns in communication, which can be performed even when the messages are encrypted
Eavesdropping is the act of secretly or stealthily listening to the private conversation or communications of others without their consent.
This type of network attack is generally one of the most effective as a lack of encryption services are used. It is also linked to the collection of metadata.
Wikipedia definition of Eavesdropping is a bit historical definition. In the cryptographic terms, the Eavesdropper listens to the medium and tries to break the ciphers, and the action is Eavesdropping. We call it also a passive attacker and passive attack, respectively. We don't use traffic analysis to eavesdropping.
Traffic analysis, today, is used in computer security. Traffic analysis can be executed even the channel encrypted with OTP. The time of the message, the frequency of the messages etc. All can be very important to signal intelligence. However, OTP has perfect secrecy so no passive attacker can break it.
For example; If the battleships send to their control center
we are alive message for every 8 hours in a normal day with OTP, then any increase of the messages during a day may indicate that there is an action around. So the enemy can concentrate on this region. As you can see, this leaked information. This can be prevented by on-line encryption. There are more examples in Wikipedia;
It is difficult to defeat traffic analysis without both encrypting messages and masking the channel. When no actual messages are being sent, the channel can be masked
Traffic analysis is a very broad term and it came also from the history (part of Signal Intelligence). It can still be applied if the protocols are not considered to prevent this attack as in Timing Analysis of Keystrokes and Timing Attacks on SSH