Vendor dan Produk

CPE, singkatan dari Common Platform Enumeration, adalah skema standar untuk penamaan perangkat keras, perangkat lunak, dan sistem operasi. CPE menyediakan skema penamaan terstruktur untuk mengidentifikasi dan mengklasifikasikan sistem teknologi informasi, platform, dan paket secara unik berdasarkan atribut tertentu seperti vendor, nama produk, versi, pembaruan, edisi, dan bahasa.

Deskripsi CAPEC

An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.

Informasi CAPEC

Alur Eksekusi

1) Explore

Determine the ciphertext and the encryption algorithm.

2) Experiment

Perform an exhaustive brute force search of the key space, producing candidate plaintexts and observing if they make sense.

Prasyarat

Ciphertext is known.
Encryption algorithm and key size are known.

Keahlian yang Diperlukan

Brute forcing encryption does not require much skill.

Sumber Daya yang Diperlukan

Mitigasi

Use commonly accepted algorithms and recommended key sizes. The key size used will depend on how important it is to keep the data confidential and for how long.
In theory a brute force attack performing an exhaustive key space search will always succeed, so the goal is to have computational security. Moore's law needs to be taken into account that suggests that computing resources double every eighteen months.

Kelemahan Terkait

CWE-ID	Nama Kelemahan
CWE-326	Inadequate Encryption Strength The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
CWE-327	Use of a Broken or Risky Cryptographic Algorithm The product uses a broken or risky cryptographic algorithm or protocol.
CWE-693	Protection Mechanism Failure The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-1204	Generation of Weak Initialization Vector (IV) The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive.

Pengajuan

Nama	Organisasi	Tanggal	Tanggal rilis
CAPEC Content Team	The MITRE Corporation	2014-06-23 +00:00

Modifikasi

Nama	Organisasi	Tanggal	Komentar
CAPEC Content Team	The MITRE Corporation	2021-06-24 +00:00	Updated Related_Attack_Patterns, Related_Weaknesses

Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.

Detail CAPEC-20

CAPEC-20