Cryptanalytic attacks and the move to post-quantum cryptography in the US

Sub-domain 3.7 asks you to understand methods of cryptanalytic attacks. The outline's list is deliberately broad: brute force, ciphertext only, known plaintext, frequency analysis, chosen ciphertext, implementation attacks, side channels, fault injection, timing, man in the middle, pass the hash, Kerberos exploitation and ransomware. Some are classic cryptanalysis; others attack the systems around the cryptography; and ransomware uses cryptography itself as the weapon. This lesson covers them all and then turns to the biggest change in cryptography for a generation: preparing for quantum computers that could break today's public key algorithms.

Attacks on the algorithm

Cryptanalysts classify attacks by what the attacker has. In a ciphertext-only attack the attacker has only encrypted messages and tries to recover plaintext or the key, often using statistical methods. Frequency analysis is the classic example: in English, the letter e is the most common, so in a simple substitution cipher the most frequent ciphertext letter probably stands for e. In a known-plaintext attack the attacker has some plaintext and its matching ciphertext; during the Second World War, Allied codebreakers working on the Enigma machine used expected phrases such as weather reports, which they called cribs. In a chosen-plaintext attack the attacker can have chosen messages encrypted and study the results, and in a chosen-ciphertext attack the attacker can have chosen ciphertexts decrypted, which has been used against flawed padding schemes in RSA and in TLS. Differential and linear cryptanalysis are more advanced statistical techniques that study how differences or linear relationships in inputs propagate through a cipher; modern ciphers such as AES were designed to resist them.

Brute force tries every possible key and is always possible in principle; the defense is a key space large enough to make it hopeless, as lesson 8 showed. A dictionary attack is a smarter form of brute force against passwords, trying likely words and variations first. A birthday attack exploits hash collisions, and a meet-in-the-middle attack, which is why double DES adds little strength over single DES, trades memory for time by working forwards from the plaintext and backwards from the ciphertext. Downgrade attacks trick systems into using older, weaker protocols or ciphers, as happened with the FREAK and Logjam attacks on TLS in 2015; disabling obsolete options removes the opportunity.

Attacks on the implementation

Most successful attacks today target implementations rather than algorithms. Implementation attacks exploit programming errors, such as the Heartbleed bug in OpenSSL, disclosed in 2014, which let attackers read chunks of a server's memory, including private keys, without breaking any cipher. Side-channel attacks extract secrets from physical effects of computation: how long an operation takes, how much power it draws, its electromagnetic emissions or even the sound it makes. Timing attacks measure small differences in processing time; for example, a password or MAC comparison that stops at the first wrong byte leaks how many bytes were right, so secure code uses constant-time comparison. Power analysis, simple or differential, can recover keys from smart cards by watching their power use during encryption. Fault injection deliberately disturbs a device with voltage glitches, clock changes, lasers or heat to make it miscalculate, and the faulty output can reveal key material. Cache-based attacks such as Spectre, covered in lesson 5, are side channels within shared processors.

Defenses include validated cryptographic libraries and modules rather than home-made code, constant-time implementations, hardware with side-channel and fault countermeasures certified to standards such as FIPS 140-3 Level 3 or 4 or Common Criteria smart card profiles, physical protection of devices, and prompt patching of cryptographic libraries.

Attacks on protocols and credentials

A man-in-the-middle, or on-path, attack places the attacker between two parties who believe they are talking directly. The attacker can read and alter traffic, or run separate key exchanges with each side, as with unauthenticated Diffie-Hellman. Defenses include authenticated key exchange with certificates, certificate validation, HTTP Strict Transport Security and mutual TLS. Replay attacks resend captured valid messages; timestamps, nonces and sequence numbers prevent them.

Pass the hash is an attack on Windows authentication. Because the NTLM protocol authenticates with a hash of the password rather than the password itself, an attacker who steals the hash from memory or a disk can use it directly to log in to other systems, without ever cracking it. Defenses include disabling NTLM where possible, limiting where privileged accounts log in, using tiered administration so domain administrators never sign in to ordinary workstations, enabling Credential Guard, and using unique local administrator passwords managed by a tool such as Windows LAPS.

Kerberos exploitation targets Active Directory's main authentication protocol. In Kerberoasting, any authenticated user requests service tickets for accounts with service principal names; part of each ticket is encrypted with the service account's password hash, which can then be cracked offline if the password is weak. Defenses are long random passwords for service accounts, preferably managed service accounts that rotate automatically, and AES rather than RC4 ticket encryption. A golden ticket attack forges ticket-granting tickets after stealing the hash of the KRBTGT account, giving the attacker effectively unlimited access to the domain; recovery requires resetting the KRBTGT password twice. A silver ticket forges a service ticket for one service. Pass the ticket reuses stolen tickets. These attacks show that the security of authentication cryptography depends heavily on how keys, passwords and privileged accounts are managed.

Ransomware

Ransomware turns cryptography against its victims. Attackers gain access, often through phishing, exposed remote desktop services or unpatched edge devices, spread through the network, steal data and then encrypt files and backups with strong algorithms, typically a symmetric key per file protected by the attacker's public key. Victims are then pressured to pay for the decryption key and, in double extortion, to stop publication of the stolen data. Because the encryption is usually sound, recovery without the key is rarely possible unless the attackers made mistakes. The defenses are architectural: offline or immutable backups that are tested regularly, segmentation, multifactor authentication on remote access, rapid patching of internet-facing systems, endpoint detection and response, least privilege and an incident response plan. Both the Canadian Center for Cyber Security and the US Cybersecurity and Infrastructure Security Agency publish ransomware guidance, and both governments discourage paying ransoms because payment funds further crime and does not guarantee recovery.

Quantum computing and cryptography

A sufficiently large, fault-tolerant quantum computer would change cryptography dramatically. Shor's algorithm, published in 1994, could factor large numbers and solve discrete logarithms efficiently, breaking RSA, Diffie-Hellman and elliptic curve cryptography completely. Grover's algorithm gives a quadratic speed-up for searching, which effectively halves the strength of symmetric keys and hashes: a 128-bit key would offer about 64 bits of security against a quantum attacker, so the usual response is to use 256-bit AES keys and longer hashes, not to abandon symmetric cryptography. No quantum computer today can break real RSA keys, and estimates of when one might exist vary widely. The urgent concern is harvest now, decrypt later: adversaries may record encrypted traffic today and decrypt it once a capable machine exists, so data that must stay secret for many years is already at risk.

NIST ran an international competition from 2016 to select post-quantum algorithms, which run on ordinary computers but resist known quantum attacks. In August 2024 it published the first three standards: FIPS 203, ML-KEM, a key encapsulation mechanism based on the CRYSTALS-Kyber lattice design; FIPS 204, ML-DSA, a signature scheme based on CRYSTALS-Dilithium; and FIPS 205, SLH-DSA, a stateless hash-based signature scheme based on SPHINCS+. A further signature standard based on FALCON, to be called FN-DSA, is in development, and in March 2025 NIST selected HQC, a code-based scheme, as a backup key encapsulation mechanism built on different mathematics from ML-KEM. Stateful hash-based signatures, LMS and XMSS, are already approved for uses such as firmware signing. During the transition many systems use hybrid key exchange, combining a classical algorithm such as X25519 with ML-KEM, so the connection stays secure if either one holds; major browsers and messaging apps began deploying hybrid post-quantum key exchange in 2023 and 2024.

In the United States, National Security Memorandum 10, issued in 2022, set the goal of mitigating quantum risk in federal systems by 2035, and OMB memorandum M-23-02 requires agencies to inventory their cryptographic systems annually. The National Security Agency's Commercial National Security Algorithm Suite 2.0, CNSA 2.0, sets dates for national security systems to move to quantum-resistant algorithms, with software and firmware signing and network equipment expected to transition first, around 2030, and all systems by 2035. NIST has proposed in its draft report IR 8547 that classical public key algorithms at the 112-bit security level be deprecated after 2030 and disallowed after 2035. Check the current versions of these documents, because dates and details are still being refined.

Whatever the jurisdiction, the migration steps are similar: build a cryptographic inventory, identify data with long confidentiality needs and systems with long lifetimes, prioritize them, test post-quantum and hybrid algorithms, ask vendors for their roadmaps, and design for crypto agility so future changes are easier. Post-quantum keys and signatures are larger than classical ones, so protocols, certificates and constrained devices may need changes.

Thinking like a manager

When an exam scenario describes stolen hashes being reused, think pass the hash and controls on privileged account use. When it describes weak service account passwords in Active Directory, think Kerberoasting. When it describes keys extracted from a smart card by measuring power, think side channels and certified hardware. For ransomware, the answer that best protects the organization is usually tested, offline or immutable backups combined with prevention, not payment. For quantum risk, the first step is a cryptographic inventory and prioritization of long-lived data, not replacing everything at once.