|
In cryptanalysis and computer security, a dictionary attack is a technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by searching a large number of possibilities. In contrast with a brute force attack, where all possibilities are searched through exhaustively, a dictionary attack only tries possibilities which are most likely to succeed, typically derived from a list of words in a dictionary. Generally, dictionary attacks succeed because most people have a tendency to choose passwords which are easy to remember, and typically choose words taken from their native language. Cryptanalysis (from the Greek kryptós, hidden, and analýein, to loosen or to untie) is the study of methods for obtaining the meaning of encrypted information, without access to the secret information which is normally required to do so. ...
Computer security is the current computer science collaboration of the week! Please help improve it to featured article standard. ...
This article is about algorithms for encryption and decryption. ...
The EFFs US$250,000 DES cracking machine contained over 1,800 custom chips and could brute force a DES key in a matter of days — the photograph shows a DES Cracker circuit board fitted with several Deep Crack chips. ...
Dictionary attacks may be applied in two main situations:
- in cryptanalysis, in trying to determine the decryption key for a given piece of ciphertext;
- in computer security, in trying to circumvent an authentication mechanism for accessing a computer system by guessing passwords.
In the latter case, the effectiveness of a dictionary attack can be greatly reduced by limiting the number of authentication attempts that can be performed each minute, and even blocking further attempts after a threshold of failed authentication attempts is reached. Generally, 3 attempts is considered sufficient to cope with mistakes made by legitimate users; beyond that, one can safely assume that the user is a malicious attacker.
There is some commonality between these situations. For instance, an eavesdropper may record a challenge-response authentication exchange between two parties and use a dictionary attack to try to determine what the password was. Or, an attacker may be able to obtain a copy of the list of encrypted passwords from a remote system; assuming the users are mostly English speakers, the attacker could attempt to guess the passwords at their leisure, by encrypting each of a list of English words and comparing each encryption against the stored encrypted version of users' passwords. Since users often choose easily guessed passwords, this has historically succeeded about 4 times out of 10 when a reasonably large list is used. Dictionaries for most human languages (even those no longer used) are easily accessible on the Internet, meaning even the use of foreign words is practically useless in preventing dictionary attacks. In computer security, challenge-response authentication is a family of protocols in which one party presents a question (challenge) and another party must provide a valid answer (response) to be authenticated. ...
A password is a form of secret authentication data that is used to control access to a resource. ...
The English language is a West Germanic language that originates in England. ...
It is possible to achieve a time-space tradeoff through precomputation by encrypting and storing a list of encrypted dictionary words, sorted by the encrypted 'value'. This requires a large amount of storage and often a considerable amount of preparation time, but makes the actual attack almost instantaneous. It is particularly effective when a large number of passwords are to be cracked at once. Salting is a technique that forces the encrypted dictionary to be recomputed for each password sought, potentially making precomputation impossible, provided the salt is large enough. In computer science, a space-time or time-memory trade-off is a situation where the programmer can reduce memory use at the cost of slower program execution, or can reduce computation time at the cost of increased memory use. ...
In cryptography, a salt consists of random bits used as one of the inputs to a key derivation function. ...
An example of a dictionary attack occurred in the Second World War, when British codebreakers working on German Enigma-ciphered messages used the German word eins as part of the attack; eins, the word for the number one, appeared in 90% of all ciphertexts, as the Enigma machine's keyboard had no numerals (some might classify this as a known plaintext attack). Combatants Allied powers: China France Great Britain Soviet Union United States and others Axis powers: Germany Italy Japan and others Commanders Chiang Kai-shek Charles de Gaulle Winston Churchill Joseph Stalin Franklin Roosevelt Adolf Hitler Benito Mussolini Hideki TÅjÅ Casualties Military dead: 17,000,000 Civilian dead: 33,000...
Cryptanalysis (from the Greek kryptós, hidden, and analýein, to loosen or to untie) is the study of methods for obtaining the meaning of encrypted information without access to the secret information which is normally required to do so. ...
In the history of cryptography, the Enigma was a portable cipher machine used to encrypt and decrypt secret messages. ...
The known-plaintext attack is a cryptanalytic attack in which the attacker has samples of both the plaintext and its encrypted version (ciphertext) and is at liberty to make use of them to reveal further secret information; typically this is the secret key. ...
Spammers often use a form of dictionary attack, sometimes known as a Directory Harvest Attack, for e-mail address harvesting. For example, a spammer may try sending messages to adam@example.com, barbara@example.com, carl@example.com, etc. Any addresses to which messages are delivered, as opposed to being bounced back, can be added to the spammer's list of known-valid addresses. This article is about spam, the abuse of electronic communications media to send unsolicited bulk messages. ...
A Directory Harvest Attack or DHA is a technique used by spammers in an attempt to find e-mail addresses. ...
E-mail harvesting is the process of obtaining lists of e-mail addresses for use in bulk mail or other purposes usually grouped as spam. ...
This article is about spam, the abuse of electronic communications media to send unsolicited bulk messages. ...
Clifford Stoll's book, The Cuckoo's Egg, contains an account of a dictionary attack against the encrypted passwords kept in the passwd file on Unix systems, and of the reaction to the successful attack by the man (Robert Morris) who invented the one-way encryption system used for login passwords. Clifford Stoll (or Cliff Stoll) is an astronomer, computer systems administrator, and author. ...
For the science fiction novel by C. J. Cherryh, see Cuckoos Egg (novel). ...
passwd is a tool on most Unix and Linux systems used to change a users password. ...
Robert Morris is an American cryptographer. ...
See also
The EFFs US$250,000 DES cracking machine contained over 1,800 custom chips and could brute force a DES key in a matter of days — the photograph shows a DES Cracker circuit board fitted with several Deep Crack chips. ...
Password cracking is the process of recovering secret passwords from data that has been stored in or transmitted by a computer system. ...
Password strength is the likelihood that a password can be guessed by an unauthorized person or computer. ...
A Key derivation function (or KDF) is a cryptographic hash function which derives one or more secret keys from secret values and/or other known information. ...
E-mail harvesting is the process of obtaining lists of e-mail addresses for use in bulk mail or other purposes usually grouped as spam. ...
Examples Well known examples of dictionary attack software tools: Crack is a Unix password cracking program designed to allow system administrators to locate users who may have weak passwords vulnerable to a dictionary attack. ...
John the Ripper is a fast password cracker, currently available for many flavors of Unix (11 are officially supported, not counting different architectures), DOS, Win32, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. ...
L0phtCrack is a password auditing and recovery application (nowadays called LC5) by L0pht Heavy Industries. ...
Cain and Abel is a Windows password recovery tool. ...
External links - US Secret Service use a distributed dictionary attack on suspect's password protecting encryption keys
- List of IP addresses being used by the current top spam dictionary attackers as identified by Project Honey Pot
- Full dictionaries (in .txt format) in 16 languages (af, cr, cz, dk, nl, en, fi, fr, de, ir, it, la, no, pl, sp, se)
- Library with several Dictionaries
|
Feeds |
Contact