Brute Force Attacks

Brute Force Attacks

Brute force attacks are also referred to as exhaustive search attacks. This technique simply involves trying every possible combination,specifically the key, until the correct one is identified.

Brute force attacks can be mounted on any type of cipher and cryptography system. Advances in technology and computing performance have made brute force attacks increasingly practical against cryptography keys of a fixed length. For example, when DES was designed, it was considered secure against brute force attacks. But as we have seen, over the years, this type of attack has become increasingly attractive to attackers because the cost and time involved in finding a DES key has been reduced dramatically.

With today's technology, DES only offers a few hours of protection from brute force attacks mainly because its key space is no longer large enough.

An exhaustive search of DES's 56-bit key space is very feasible today, as the growth of the internet and networking has made it possible to utilize thousands of machines in a distributed search by splitting the key space and allocating those key spaces to each computer. However, key spaces offered by algorithms that support larger key lengths are still very effective against brute force attacks.

Adequate encryption is defined as encryption that is strong enough to make brute force attacks impractical because there is a higher work factor than the attacker wants, or is able, to invest into the attack. Moore's Law states that available computing power doubles every18 months. Experts suggest this advance may be slowing. However, as history has taught us, encryption strength considered adequate today will probably not be sufficient a few years from now due to technology advances in central processing units (CPU) and graphics processing units (GPU) and new attack techniques. The security professional and cryptologist need to consider this when defining encryption requirements.