日本語

CAPEC-20

Encryption Brute Forcing
2014-06-23
00h00 +00:00
低
低
Draft
2021-06-24
00h00 +00:00
CAPEC Mitre.org
特定のCAPECのアラート
特定のCAPECの変更情報をいち早くお届けします。
通知を管理する

CAPEC の説明

An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.

CAPEC の情報

実行フロー

1) Explore

Determine the ciphertext and the encryption algorithm.

2) Experiment

Perform an exhaustive brute force search of the key space, producing candidate plaintexts and observing if they make sense.

前提条件

Ciphertext is known.
Encryption algorithm and key size are known.

必要なスキル

Brute forcing encryption does not require much skill.

必要なリソース

緩和策

Use commonly accepted algorithms and recommended key sizes. The key size used will depend on how important it is to keep the data confidential and for how long.
In theory a brute force attack performing an exhaustive key space search will always succeed, so the goal is to have computational security. Moore's law needs to be taken into account that suggests that computing resources double every eighteen months.

関連する弱点

CWE-ID 弱点名

CWE-326

 Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

CWE-327

 Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.

CWE-693

 Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

CWE-1204

 Generation of Weak Initialization Vector (IV)
The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive.

登録情報

名前 組織 日付 リリース日
CAPEC Content Team The MITRE Corporation 2014-06-23 +00:00

変更履歴

名前 組織 日付 コメント
CAPEC Content Team The MITRE Corporation 2021-06-24 +00:00 Updated Related_Attack_Patterns, Related_Weaknesses
CVE Findに掲載されている情報は、慎重に選定された複数の参照ソースから取得されています。CVEデータはMITRE Corporationおよび国家脆弱性データベース（NVD）が提供しています。既知の悪用された脆弱性（KEV）カタログはサイバーセキュリティ・インフラセキュリティ庁（CISA）から、EPSSスコアはFIRST.orgから取得しています。また、ソフトウェアの弱点（CWE）および共通攻撃パターン（CAPEC）に関するデータはMITRE Corporationが管理し、ハードウェアおよびソフトウェア構成（CPE）に関する情報はNVDが提供しています。