T3 Flashcards
What is the goal of the T3 tutorial?
To demonstrate how a dictionary attack can break symmetric encryption
- Using openSSL
- Knowing cipher and parameters used
- Assume attacker intercepted encryption message
- Assume password is word in italian dictionary
What is the role of SHA-512 in the T3 tutorial?
It is used as the hashing algorithm to derive the encryption key from the password (key derivation).
what does iter -1 imply for key derivation with SHA-512
encryption faster, but brute force attack is easier
What does the -iter 1 flag do?
Specifies the number of iterations the key derivation function performs, in this case hashing, only once.
What happens during a dictionary attack?
Each word in the dictionary is tested as a password to decrypt the ciphertext.
Why do false positives occur during the attack?
OpenSSL doesn’t validate the decrypted plaintext’s meaning, but instead the length, so gibberish output may still be considered successful decryption.
How can false positives be mitigated?
By using heuristics, such as checking for printable characters or specific patterns in the decrypted output.
What us GNU Parallel used for in the T3 turorial
To split the dictionary file into chunks and tests passwords in parallel across multiple CPU cores, speeding up brute-force attack.
How many scripts were tested in T3?
4
How does the script check if a password is correct?
It uses OpenSSL to decrypt the ciphertext and checks for an error-free ouput.
How can dictionary attacks be made more efficient (3)?
Heuristics to reduce false positives
running attack in parallel
leveraging hardware acceleration (clusters,gpu)
What is a false negative in a dictionary attack?
When the correct password is in the dictionary but not identified.
Why does this tutorial show the importance of strong passwords?
Weak passwords are easily guessed or brute-forced
script 1 basic brute force attack result
many false positives returned because by default openssl only reports errors if decrypted message doesnt match length
script 2 reduce false positives result
used heuristic algorithm that assumes message contains certain amount of consecutive letters. Reduces but doesn’t eliminate FP’s.
can u think of other contextual knowledge that could help???
This would not work for binary data
