Name 
Encryption Brute Forcing 

Likelyhood of attack 
Typical severity 
Low 
Low 

Summary 
An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext. 
Prerequisites 
Ciphertext is known. Encryption algorithm and key size are known. 
Execution Flow 
Step 
Phase 
Description 
Techniques 
1 
Explore 
Determine the ciphertext and the encryption algorithm. 

2 
Experiment 
Perform an exhaustive brute force search of the key space, producing candidate plaintexts and observing if they make sense. 


Solutions  Use commonly accepted algorithms and recommended key sizes. The key size used will depend on how important it is to keep the data confidential and for how long. In theory a brute force attack performing an exhaustive key space search will always succeed, so the goal is to have computational security. Moore's law needs to be taken into account that suggests that computing resources double every eighteen months. 
Related Weaknesses 
CWE ID

Description

CWE326 
Inadequate Encryption Strength 
CWE327 
Use of a Broken or Risky Cryptographic Algorithm 
CWE693 
Protection Mechanism Failure 
CWE719 
OWASP Top Ten 2007 Category A8  Insecure Cryptographic Storage 

Related CAPECS 
CAPEC ID

Description

CAPEC112 
In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trialanderror to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. Examples of secrets can include, but are not limited to, passwords, encryption keys, database lookup keys, and initial values to oneway functions. The key factor in this attack is the attackers' ability to explore the possible secret space rapidly. This, in turn, is a function of the size of the secret space and the computational power the attacker is able to bring to bear on the problem. If the attacker has modest resources and the secret space is large, the challenge facing the attacker is intractable. Assuming a finite secret space, a brute force attack will eventually succeed. The defender must rely on making sure that the time and resources necessary to do so will exceed the value of the information. 
