Attack methods and basic encryption algorithms in cybersecurity

In order to design and implement a secure encryption system, you need to understand the different types of attacks that the system may be vulnerable to. This allows you to introduce additional security measures that prevent the encryption from being broken using a given method. Knowledge of potential attack methods also allows you to better assess the security of a given security system.

We distinguish the following methods of cracking ciphertexts:

• cracking with the full review method,
• cracking with ciphertexts,
• cracking with known plaintext,
• cracking with selected plaintext,
• cracking with selected ciphertext,
• cracking with adaptively selected plaintext
• and many others.

In the next part of the article, I will try to bring them closer, and also write more about the most popular one-way hash functions.

Brute-force attack

The method involves trying keys from all over the keyspace until a sensible solution is found. The strength of this method lies mainly in the computing power of the computer. The more keys we are able to try within a certain period of time, the greater the chance of success. Of course, the number of keys available in a given space is also important. In some cases, it is too large for the full review method to have a chance of success.

Ciphertext-only attack

Consists of reconstructing the plaintext only on the basis of the ciphertext. The cryptanalyst has a set of messages encrypted with the same algorithm and on the basis of them, he must deduce the encryption key or at least decrypt part of the message. Next to the full review method, this is one of the most commonly used methods, because the secret text is very often the only research material available to the cryptanalyst.

Known-plaintext attack

In case of this method, the decryptor knows the plaintext of several messages and his task is to guess the decryption key or algorithm. Often it is not about knowing the whole message, but only part of it. For example, we know that the message begins with “We regret to inform you that…” (or we can assume it with a high degree of probability). This makes it easier to deduce which key was used for encryption.

Chosen-plaintext attack

Consists of the fact that the cryptanalyst chooses the plaintext to be encrypted using the broken algorithm. This is a more convenient situation for the decryptor than in the method of breaking with known plaintext because he can choose the plaintext in such a way that it reveals more information about the key. As in plaintext cracking, the goal of the attack is to obtain a decryption key or algorithm.

Nowadays, a chosen-plaintext attack is often used against database systems – the attacker enters certain information (records) into the database and then compares it with the ciphertexts created on their basis. Such an attack is carried out after access to the database, but before breaking the encryptions protecting it, which are usually the last line of defence. Entering data into the database is usually not difficult, especially in the case of databases supporting online stores, where anyone can register and send any order.

Chosen-ciphertext attack

Allows an attacker to select specific ciphertexts and access their plaintexts. The task of the cryptanalyst is to develop a method of automatic decryption and then use it to find the key. This method is primarily used in public-key systems, but can also be effective in systems based on symmetric encryption.

Adaptive-chosen-plaintext attack

Is a rather rarely used method in which the decryptor can select the text to be encrypted several times depending on the previously obtained results. This gives great opportunities in research on the encryption system, because the cryptanalyst has the ability to check how the message ciphertext changes after certain changes are made to it.

Denial-of-service attack

Involves disrupting digital data transmission. An example may be an unauthorized change of the key preventing further communication by the users using it. In general, DoS attacks can take several different forms, such as:

• blocking access to a given service for a specific person,
• blocking the connection between two computers,
• blocking traffic in the entire network.

An example of an attack of this type is the popular SYN flood attack, which uses the mechanism used to establish a client-server connection. The client sends a message to the server that it wants to connect. The server acknowledges receipt of the message prepares the system resources needed to handle the connection and waits for the client to acknowledge receipt of the message. At this point, the connection is only halfway done. When the customer responds, the actual data exchange begins. The attacker takes advantage of the moment when the server is waiting for the client’s response.

Using the technique of IP Spoofing (creating fake IP addresses), it establishes successive “semi-open” connections. The server reserves system resources to handle it, but there is no response from the client. Soon system resources are exhausted and no more connections can be made. Even the mechanism of expiring half-open connections after a certain period of time does little to help since the attacker can establish new connections faster than the old ones will expire.

Replay attack

Is a special type of cryptanalytic attack. The decryptor stores a message here that he could not crack for future use. For example, he can authenticate under someone else’s name and, thanks to the permissions obtained in this way, break into the system or disrupt its operation. The best way to protect against this type of attack is to include a timestamp in the messages you send. Thanks to this, even after intercepting the message, the attacker will not gain anything, because its subsequent sending will be detected by the system.

A dictionary attack

Is also referred to as an attack on a reduced key space, which can be described using a dictionary of primary keys and their modifications (changed case, writing the password backwards, adding a frequently used number combination, etc.). This attack relies on the assumption that the user generally chooses a password that is easy to remember. For this reason, the actual number of passwords used is only a small part of the total possible. For example, it’s very common to use your wife’s or daughter’s name as your password, or use simple key combinations like “1234” or “abcd.”

The attacker has a program with a database containing the most frequently used passwords. To protect against this type of attack, use unusual, hard-to-guess passwords. A dictionary attack can also be used against hash-protected passwords. If an attacker gains access to users’ password hashes, they can compare them with the values ​​obtained by transforming passwords stored in a dictionary using the same algorithm. A match means either the correct password was found or a hash collision occurred.

In both cases, the aggressor gains access to the system. For this reason, many administrators carry out this type of attack themselves from time to time. If any of the passwords turns out to be too weak, the user using it is informed about the need to change it.

Side-channel attacks

Are possible that the attacker has some additional technical information about the system and the encryption process. For example, it can measure message encryption time or interference with other data channels. System knowledge can also be useful if the random number generator used in the cryptosystem uses the parameters of a given computer to create the seed. It is then possible to determine with greater probability what number has been generated at a given moment.

Another problem is the electromagnetic radiation emitted by the cables that carry the signals we send. This radiation can be read from a distance of up to several hundred meters with the use of appropriate equipment. Another method of security is to shield the cables that transmit data in an unencrypted form inside the computer (for example, the cable that connects the monitor, keyboard and peripheral devices to the central processing unit) or to place the computer inside the so-called. Faraday cage protects against interception of information by this technique. You can also use fibre optic cables that do not emit electromagnetic radiation. It is also possible to read the data by analyzing the radiation emitted by the monitor or the sounds produced by pressing the keys.

Another example of this type of attack, the acoustic method, consists in analyzing the relationship between the sounds emitted by the processor and the operations performed by it. Also, the power consumption of the encryption device can be an indication of the operations performed – differential power analysis is based on the study of differences in power consumption by different parts of the device during the encryption process. On their basis, it is possible to obtain information about some bits of the encryption key.

The method of differential error analysis is also very interesting. The attacker deliberately disrupts the operation of the encryption device and then analyzes the resulting errors in the obtained plaintexts or cryptograms. The differences between the data obtained in this way and the correct results for the same operations are the basis for further cryptanalysis of the algorithm.

The Man in the Middle attack

Sometimes referred to as an attack from within the system, consists in intercepting information transmitted between two computers on an ongoing basis. It does not necessarily mean the loss of the transmitted data. Much more often, the attacker observes the connection, gaining the data he needs. It can also change the content of the message before it reaches the recipient. This is especially dangerous when encryption keys are sent this way, i.e. all protocols that do not use predetermined secrets (the Diffie-Hellman protocol can be cited as an example).

In the case of PGP, the easiest way to verify that we have received the correct key is to check its “fingerprint”. In general, the best way to defend against this type of attack is to use certificates that confirm the identity of the parties in the communication.

The Meet in the Middle attack

Is used against double encryption cryptosystems, i.e. those in which a message is encrypted twice with the same algorithm, but using different keys. This is a combination of a full-feature attack with known-plaintext cryptanalysis. The cryptanalyst simultaneously encrypts the plaintext and decrypts the cryptogram with all possible keys, assuming that the results of both operations coincide.

For example, in the case of double encryption with an algorithm with a key length of 128 bits, it is theoretically necessary to perform 2¹²⁸ * 2¹²⁸ operations in a look-through attack. In the case of the Meet in the Middle attack, this number drops to 2¹²⁸ + 2¹²⁸.

Secure encryption algorithms – how to ensure data security

The techniques and methods of attacking secret data described above do not exhaust the wide range of possibilities in this field. They should also not be treated as individual methods, i.e. unrelated to each other. In fact, the attacker usually combines several different methods to achieve his goal. For example, you can discover 80% of the key bits by linear cryptanalysis and the remaining 20% ​​by full scan
 
Secure encryption algorithms, also known as SHA, are a family of cryptographic functions designed to keep your data secure. It works by transforming data using a hash function: an algorithm consisting of bitwise operations, modular addition and compression functions. The hash function then creates a fixed-size string that looks nothing like the original.

These algorithms are designed as one-way functions, which means that once they have been converted to their respective hashes, it is virtually impossible to convert them back to the original data.

This article covers the most popular one-way hash functions:

• MD5,
• SHA-1,
• SHA-2,
• SHA-3.

each of which was successively designed with increasingly stronger encryption in response to hacker attacks. For example, SHA-0 is now deprecated due to widely disclosed vulnerabilities. They can be implemented in independent programs as long as they are defined in the libraries of the language used. They are used to generate digests of large messages, which makes it easier to sign and verify the correctness of the transmitted data.

Use of SHAs

A common use of SHA is to encrypt passwords because the server side only needs to keep track of the hash value of a specific user, not the actual password. This is helpful in case of an attacker breaks into the database because he will only find hashed functions, not actual passwords, so if he enters an encrypted value as a password, the hash function will convert it to another string and then deny access.

In addition, SHAs exhibit an avalanche effect where modification of very few encrypted letters results in a large change in the output; or vice versa, drastically different strings produce similar hashes. This effect causes hash values ​​to provide no information about the input string, such as its original length.

Apart from, SHAs are also used to detect data manipulation by attackers, where if a text file is slightly altered and barely noticeable, the hash value of the modified file will be different from the hash value of the original file, and the manipulation will be rather noticeable
 
Cryptographic hash functions are used to secure data by providing three primary security features:

• pre-image resistance,
• second pre-image resistance,
• collision resistance.

MD5

The MD5 algorithm (short for Message Digest) was developed by Ron Rivest, co-inventor of the RSA algorithm. This algorithm is a hash function that converts 512-bit blocks of data into 128-bit blocks. It was used e.g. in PGP package and SSL protocol.

SHA-1

SHA-1 (SHA – Secure Hash Algorithm) is a set of cryptographic hashing functions that assigns a short, fixed-size, quasi-random value to any large number. These functions allow you to set short and easy-to-verify signatures (signatures) for large data sets. SHA-1 is a set of functions designed by the NSA (National Security Agency), published in 1995 by NIST (National Institute of Standards and Technology), which replaced the discontinued SHA-0.

SHA-2

In 2005, vulnerabilities were identified in the security of SHA-1, which turned out to be too weak and vulnerable to attacks against which SHA-2 is resistant, therefore in 2015 certification authorities replaced products based on SHA-1 with products using the SHA-2 algorithm 2. There are four hash functions under the name SHA-2:

• SHA-224,
• SHA-256,
• SHA-384,
• SHA-512.

The numbers assigned to them indicate the number of bits that the generated hash consists of. The first two SHA-2 family algorithms process messages with a maximum size of 264-1 bits in 512-bit blocks, breaking them up into sixteen 32-bit words. SHA-384 and SHA-512 operate on 1024-bit blocks divided into sixteen 64-bit words. Their maximum message size is 2128-1 bits. They are also more secure. There are still a few differences between these algorithms, but the general principle of operation remains the same for each of them.

SHA-256 – what is a hash function?

SHA-256 is a standard hash function. A cryptographic hash function generates a “fingerprint” of the input string. For example, if we were to encrypt the entire text of JRR Tolkien’s The Lord of the Rings series using the SHA 256 algorithm, we would get a 256-bit result unique to the text of that book. If we changed even one letter in the book, the output abbreviation would be completely different.
 
It’s worth noting that the hash output is “almost unique” because there are a finite number of output strings. After all, SHA-256 output is always 256 bits long, meaning it’s a fixed size. However, the number of possible inputs is infinite, meaning some inputs will hash to the same output. When this happens, it’s called a “collision” and it’s almost impossible. After all, there are 2²⁵⁶ possible outputs in SHA-256.

What is SHA-256 used for?

SHA-256 is useful in so many circumstances! It is a quick and safe shortcut function, here are some of the most common ways to use it:

• to creat website authentication schemes,
• to create digital signatures,
• to secure blockchains like Bitcoin and Ethereum,
• to compare the fingerprints of files and programs in antivirus programs,
• in version control systems like Git to see if data has changed.

Can SHA-256 be used to encrypt passwords?

While it is possible, SHA 256 should absolutely not be used to hash passwords! SHA-256 is designed for very fast computation, which means that if someone brute force a user’s passwords, they wouldn’t be secure. Instead, you’ll want to use a key derivation function, which is simply a password-hashing algorithm meant to slow attackers down.
 
SHA-2 is known for its security and speed (it didn’t break like SHA-1). In cases where keys are not generated, such as proof-of-work bitcoin mining, a fast hashing algorithm such as SHA-2 often has an advantage. In fact, SHA-256 is formally defined in FIPS 180-4 of the National Institute of Standards and Technology. With standardization and formalization comes a list of test vectors that allow developers to ensure that they have implemented the algorithm correctly. As of 2022, SHA-256 is secure enough.

Podsumowanie

Cybersecurity is of key importance for the good operation of any company, office or institution. Protection against unwanted attacks and data flow is the basis of well-functioning units. Digitization of processes and the development of digital technologies enable more effective management of resources in the organization. However, this involves an increased risk of data leakage. A successful cyberattack can cause irreparable damage to the system of any entity. Awareness of this problem is growing significantly, as evidenced by the creation of projects such as Cyfrowa Gmina.

To protect yourself from serious attacks, you should know the rules of safe use of information resources and the network. It is very important not only to implement appropriate safeguards in the form of systems and procedures, but also to train employees and research current knowledge in the field of cyber security.

Among the types of cybersecurity attacks described in this article, it is difficult to distinguish those that happen most often or are the most popular. Nevertheless, we can list good and known practices that can protect us from cybersecurity attacks, which include:

• building awareness of threats among employees, e.g. through training,
• updating the software on all Internet-connected devices,
• using of anti-virus and anti-spam software,
• checking the senders of messages, emails and messages.

***
If you are interested in the subject, we also recommend other articles by our experts in the field of cybersecurity, including (PL) Cyberbezpieczeństwo na urządzeniach mobilnych, CHARLIE-CRP – co to właściwie jest? and Open-source Intelligence czyli Biały wywiad.

***

Sources

Karbowski M., Podstawy kryptografii, Wyd. III, Wydawnictwo Helion