CompTIA Security_ Deluxe Study Guide_ SY0-201 - Emmett Dulaney [184]
You should also be aware of the following three types of attacks:
Birthday attack A birthday attack is an example of an attack targeted at the key. It isn’t an attack on the algorithm itself, just on the results. A birthday attack is built on a simple premise. If 25 people are in a room, there is some probability that two of those people will have the same birthday. The probability increases as additional people enter the room. It’s important to remember that probability doesn’t mean that something will occur, only that it’s more likely to occur.
Although two people may not share a birthday in every gathering, the likelihood is fairly high. A birthday attack works on the same premise: If your key is hashed, the possibility is that given enough time, another value can be created that will give the same hash value.
An easy way to think of a birthday attack is to look at the hashing process in Figure 7.2. The result of the operation is a value of 88. If the letters siis were hashed, they would give the same result even though they differ from the message originally used.
Weak key attack Weak key attacks are based on the premise that many common passwords are used by lots of people. If the key length is short, the resulting hash value will be easier to guess. Make sure your users use passwords and encryption keys that are hard to guess. You may even want to consider a random-password generating system. The longer and more complicated a password is, the more difficult it is to successfully launch a weak key attack against it.
A security audit performed by the U.S. Air Force uncovered a startling problem with passwords. It discovered that one of the most popular passwords used in several locations was WWJD. Upon investigation, they discovered that this was an abbreviation for “What Would Jesus Do.” Although the air force wasn’t trying to suppress religious expression, it sent out a list of unacceptable passwords and, not surprisingly, this was one of them.
Mathematical attack Mathematical attacks can be focused on the encryption algorithm itself, the key mechanism, or any potential area of weakness in the algorithm. These attacks use mathematical modeling and statistical analysis to determine how the system operates. These types of attacks depend on intercepting large amounts of data and methodically attempting to decrypt the messages using one of the methods previously described.
Understanding Cryptography Standards and Protocols
Numerous standards are available to establish secure services. Some of the standards that will be presented in the following sections have already been discussed in greater detail in earlier chapters. Here I will quickly remind you of them and introduce you to a few more standards.
The movement from proprietary governmental standards toward more unified and global standards is a growing trend that has both positive and negative implications. Higher interoperability between disparate systems will also mean that these standards will be widely utilized. The more the standards are used, the more miscreants will focus on them as they try to break them.
As a security administrator, you have to weigh the pros and cons of the different standards and evaluate them against your organization’s needs. The following sections introduce you to the major standards, discuss their focus, and describe how they were developed.
The Origins of Encryption Standards
As mentioned in the beginning of the chapter, early cryptography standards were primarily designed to secure communications for the government and military. Many different standards groups exist today, and they often provide standards that are incompatible with the standards of other groups. These standards are intended to address the