Overview

Given some encrypted abstracts ("ciphertext"), the ambition of the cryptanalyst is to accretion as abundant advice as accessible about the original, unencrypted abstracts ("plaintext").

editAmount of advice accessible to the attacker

Attacks can be classified based on what blazon of advice the antagonist has available. As a basal starting point it is commonly affected that, for the purposes of analysis, the accepted algorithm is known; this is Shannon's Maxim "the adversary knows the system"—in its turn, agnate to Kerckhoffs' principle. This is a reasonable acceptance in convenance — throughout history, there are endless examples of abstruse algorithms falling into added knowledge, abnormally through espionage, betrayal and about-face engineering. (And on occasion, ciphers accept been reconstructed through authentic deduction; for example, the German Lorenz blank and the Japanese Purple code, and a array of classical schemes).2:

Ciphertext-only: the cryptanalyst has admission alone to a accumulating of ciphertexts or codetexts.

Known-plaintext: the antagonist has a set of ciphertexts to which he knows the agnate plaintext.

Chosen-plaintext (chosen-ciphertext): the antagonist can access the ciphertexts (plaintexts) agnate to an approximate set of plaintexts (ciphertexts) of his own choosing.

Adaptive chosen-plaintext: like a chosen-plaintext attack, except the antagonist can accept consecutive plaintexts based on advice abstruse from antecedent encryptions. Similarly Adaptive called ciphertext attack.

Related-key attack: Like a chosen-plaintext attack, except the antagonist can access ciphertexts encrypted beneath two altered keys. The keys are unknown, but the accord amid them is known; for example, two keys that alter in the one bit.

editComputational assets required

Attacks can aswell be characterised by the assets they require. Those assets include:citation needed

Time — the bulk of ciphering accomplish (like encryptions) which have to be performed.

Memory — the bulk of accumulator appropriate to accomplish the attack.

Data — the abundance of plaintexts and ciphertexts required.

It's sometimes difficult to adumbrate these quantities precisely, abnormally if the advance isn't applied to in fact apparatus for testing. But bookish cryptanalysts tend to accommodate at atomic the estimated adjustment of consequence of their attacks' difficulty, saying, for example, "SHA-1 collisions now 252."3

Bruce Schneier addendum that even computationally abstract attacks can be advised breaks: "Breaking a blank artlessly agency award a weakness in the blank that can be exploited with a complication beneath than animal force. Never apperception that brute-force ability crave 2128 encryptions; an advance acute 2110 encryptions would be advised a break...simply put, a breach can just be a certificational weakness: affirmation that the blank does not accomplish as advertised."4

editPartial breaks

The after-effects of cryptanalysis can aswell alter in usefulness. For example, cryptographer Lars Knudsen (1998) classified assorted types of advance on block ciphers according to the bulk and superior of abstruse advice that was discovered:

Total breach — the antagonist deduces the abstruse key.

Global answer — the antagonist discovers a functionally agnate algorithm for encryption and decryption, but after acquirements the key.

Instance (local) answer — the antagonist discovers added plaintexts (or ciphertexts) not ahead known.

Information answer — the antagonist assets some Shannon advice about plaintexts (or ciphertexts) not ahead known.

Distinguishing algorithm — the antagonist can analyze the blank from a accidental permutation.

Academic attacks are generally adjoin attenuated versions of a cryptosystem, such as a block blank or assortment action with some circuit removed. Many, but not all, attacks become exponentially added difficult to assassinate as circuit are added to a cryptosystem,5 so it's accessible for the abounding cryptosystem to be able even admitting reduced-round variants are weak. Nonetheless, fractional breach that appear abutting to breaking the aboriginal cryptosystem may beggarly that a abounding breach will follow; the acknowledged attacks on DES, MD5, and SHA-1 were all preceded by attacks on attenuated versions.

In bookish cryptography, a weakness or a breach in a arrangement is usually authentic absolutely conservatively: it ability crave abstract amounts of time, memory, or accepted plaintexts. It aswell ability crave the antagonist be able to do things abounding real-world attackers can't: for example, the antagonist may charge to accept accurate plaintexts to be encrypted or even to ask for plaintexts to be encrypted application several keys accompanying to the abstruse key. Furthermore, it ability alone acknowledge a baby bulk of information, abundant to prove the cryptosystem amiss but too little to be advantageous to real-world attackers. Finally, an advance ability alone administer to a attenuated adaptation of cryptographic tools, like a reduced-round block cipher, as a footfall appear breaking of the abounding system.4