CAPEC-97
Cryptanalysis
2014-06-23
00h00 +00:00
00h00 +00:00
Cảnh báo cho một CAPEC
Luôn được thông báo về mọi thay đổi đối với một CAPEC cụ thể.
Mô tả CAPEC
Cryptanalysis is a process of finding weaknesses in cryptographic algorithms and using these weaknesses to decipher the ciphertext without knowing the secret key (instance deduction). Sometimes the weakness is not in the cryptographic algorithm itself, but rather in how it is applied that makes cryptanalysis successful. An attacker may have other goals as well, such as: Total Break (finding the secret key), Global Deduction (finding a functionally equivalent algorithm for encryption and decryption that does not require knowledge of the secret key), Information Deduction (gaining some information about plaintexts or ciphertexts that was not previously known) and Distinguishing Algorithm (the attacker has the ability to distinguish the output of the encryption (ciphertext) from a random permutation of bits).
Thông tin CAPEC
Luồng thực thi
1) Explore
An attacker discovers a weakness in the cryptographic algorithm or a weakness in how it was applied to a particular chunk of plaintext.
2) Exploit
An attacker leverages the discovered weakness to decrypt, partially decrypt or infer some information about the contents of the encrypted message. All of that is done without knowing the secret key.
Điều kiện tiên quyết
The target software utilizes some sort of cryptographic algorithm.An underlying weaknesses exists either in the cryptographic algorithm used or in the way that it was applied to a particular chunk of plaintext.
The encryption algorithm is known to the attacker.
An attacker has access to the ciphertext.
Kỹ năng cần thiết
Cryptanalysis generally requires a very significant level of understanding of mathematics and computation.Tài nguyên cần thiết
Computing resource requirements will vary based on the complexity of a given cryptanalysis technique. Access to the encryption/decryption routines of the algorithm is also required.Các biện pháp giảm thiểu
Use proven cryptographic algorithms with recommended key sizes.Điểm yếu liên quan
| Tên điểm yếu | |
|---|---|
CWE-327 |
Use of a Broken or Risky Cryptographic Algorithm The product uses a broken or risky cryptographic algorithm or protocol. |
CWE-1204 |
Generation of Weak Initialization Vector (IV) The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive. |
CWE-1240 |
Use of a Cryptographic Primitive with a Risky Implementation To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation. |
CWE-1241 |
Use of Predictable Algorithm in Random Number Generator The device uses an algorithm that is predictable and generates a pseudo-random number. |
CWE-1279 |
Cryptographic Operations are Run Before Supporting Units are Ready Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result. |
Tài liệu tham khảo
REF-556
Wikipediahttp://en.wikipedia.org/wiki/Cryptanalysis
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Attack_Motivation-Consequences, Description, Description Summary, Examples-Instances, Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Taxonomy_Mappings | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Mitigations |
