Skip to content
All articles
October 8, 2026 12 min read

Ciphertext-Only to Golden Ticket: The Thirteen Cryptanalytic Attacks CISSP Tests, and What Each One Actually Breaks

Chris Rees

Chris Rees

25+ years in IT · Pluralsight author, 4.6/5 across 2,000+ ratings

Ciphertext-Only to Golden Ticket: The Thirteen Cryptanalytic Attacks CISSP Tests, and What Each One Actually Breaks
Skillthropicwww.skillthropic.com

Objective 3.7 lists thirteen attacks and hides one idea behind them: almost none of them attack the cipher. AES is unbroken. RSA at a sensible key length is unbroken. What gets broken is the nonce that repeated, the comparison that returned early, the certificate check disabled during testing, and the password hash that worked as well as the password. The exam describes what an attacker can see or do, then asks you to name the attack and its countermeasure. Sort the thirteen by what the attacker holds, and both halves answer themselves.

Almost nobody breaks the mathematics

The CISSP treats cryptanalysis as four layers, in order of difficulty. At the bottom is the algorithm: attacks that recover the key or plaintext from the cipher's own behavior. Above it is the implementation: the algorithm is sound, but the chip, library or code that runs it leaks. Above that is the protocol: cipher and code are fine, but the handshake can be intercepted, replayed or downgraded. At the top is the credential: nothing cryptographic fails, because the attacker obtained the secret and used it.

Real incidents cluster at the top: certificate validation switched off to make a test pass and never switched back on is the exam's favorite shape. Locate the layer first, because the countermeasure always lives on the same layer as the attack.

The four classical models: what the attacker holds

The classical attack models are defined by the attacker's starting position, and the exam tests them as a ladder of increasing advantage.

Model The attacker has Advantage Modern defense
Ciphertext-only encrypted messages and nothing else least any modern cipher
Known plaintext matched plaintext and ciphertext pairs more ciphers are designed assuming pairs will leak
Chosen plaintext can submit plaintexts and see the ciphertexts more still randomized IVs and nonces, so identical inputs never match
Chosen ciphertext can submit ciphertexts and see how decryption behaves most authenticated encryption, so tampered ciphertext is rejected before decryption

Two questions place any stem on this ladder. Does the attacker choose the input, or only observe it? And does the chosen input go to encryption or decryption? Chosen ciphertext is the strongest position because the target becomes a decryption oracle, and the padding oracle is the exam's favorite example: the server reveals only whether the padding was valid, and that single bit per guess recovers the whole message. The defense is authenticated encryption that rejects tampered ciphertext before decrypting, which is why GCM is the modern default over plain CBC.

Frequency analysis belongs to the ciphertext-only world: a substitution cipher preserves the language's letter distribution, and counting symbols recovers the mapping. It survives today in ECB mode, which encrypts identical blocks identically; a stem about visible structure in encrypted data is pointing at ECB.

A grid of cryptanalytic attacks sorted into four columns by what the attacker holds: only ciphertext, where brute force, ciphertext-only and frequency analysis live; plaintext pairs or hash outputs, where known plaintext, meet-in-the-middle, birthday and rainbow table attacks live; chosen inputs, where chosen plaintext, chosen ciphertext and padding oracle attacks live; and position or access, where side-channel, timing, fault injection, man-in-the-middle, replay, pass-the-hash and Kerberos attacks live, with the matching defense under each column and an arrow showing the attacker's position improving from left to right THIRTEEN ATTACKS, SORTED BY WHAT THE ATTACKER HOLDS Only ciphertext attacks the algorithm itself Plaintext pairs or hash outputs to compare Chosen inputs an oracle the attacker can query Position or access physical, network or credential Brute force Ciphertext-only Frequency analysis Known plaintext Meet-in-the-middle Birthday attack Rainbow tables Chosen plaintext Chosen ciphertext Padding oracle Side-channel and timing Fault injection Man-in-the-middle, replay Pass-the-hash, Kerberos DEFENSE adequate key length, any modern cipher, never ECB DEFENSE longer hash output, a salt, three operations rather than two DEFENSE random IV and nonce, authenticated encryption DEFENSE constant time, validation, credential isolation, backups The attacker's position improves left to right, and the countermeasure moves from the mathematics to the engineering.
Only the first column attacks the cipher. Every column to the right assumes it is sound and goes after something the attacker can hold, query, measure or steal.

Brute force and the key length answer

Brute force needs nothing but time: try every key until one produces sensible plaintext. Its only defense is a keyspace too large to search, so the exam's answer to a brute force stem against a cipher is adequate key length. A stem about a credential adds rate limiting and lockout, because a human password has far less entropy than a 256-bit key.

Rainbow tables are precomputation applied to hashes: build the chains once, reverse any unsalted hash in seconds. A per-record salt defeats them completely, because the table would have to be rebuilt for every user. Hashes cracked quickly at scale point to a missing salt, not a weak password policy.

Implementation attacks: the algorithm is fine, the chip is not

Side-channel attacks never touch the mathematics. They observe something physical correlated with the secret and work backward from it.

Attack What leaks Countermeasure
Timing operation duration; a comparison that exits on the first mismatch leaks the correct prefix byte by byte constant-time comparison; duration independent of secret data
Power analysis current draw varies with the bits being processed constant-power logic, blinding, noise injection
Electromagnetic processor emissions correlate with the operations underway shielding, filtering, distance
Cache a co-resident process measures which memory lines the victim touched no secret-dependent memory access, cache partitioning
Fault injection a voltage, clock or laser glitch makes the device compute wrongly and the faulty output reveals the key; RSA-CRT signatures are the classic victim verify results before releasing them, tamper detection, physical protection

Hold the right-hand column as a phrase: constant time, constant power, blinding, noise, shielding, verification. Timing is a side channel rather than a separate category, and fault injection is the active cousin: side channels listen, fault injection provokes. The broader class of implementation attacks covers everything that goes wrong in code rather than silicon: a reused nonce, weak entropy, bad padding handling, intermediate values in a log. The countermeasure is one sentence: use vetted, current, standard libraries, and never roll your own.

Meet-in-the-middle and the birthday problem

Two attacks on the list are pieces of arithmetic, and the exam tests the arithmetic.

Meet-in-the-middle is why double DES was never adopted. Two 56-bit keys look like a 112-bit key. They are not. With one known plaintext and ciphertext pair, the attacker encrypts the plaintext under every first key and stores the results, then decrypts the ciphertext under every second key until a value already in the table appears. That match reveals both keys: two searches of 2^56 rather than one of 2^112, so double encryption bought about one extra bit. Triple DES uses three operations so that meeting in the middle still leaves a full 2^112 search on one side.

The birthday attack is why a hash's collision resistance is half its output length. A specific preimage of an n-bit hash takes about 2^n work; any two colliding inputs take only about 2^(n/2), because the number of pairs grows with the square of the samples. It is the reason 23 people, 253 pairs, have an even chance of a shared birthday. A 128-bit hash offers only 64-bit collision resistance, which is why MD5 fell and why the exam expects SHA-256 or better wherever collisions matter, above all in the signature on a certificate.

Two diagrams side by side: on the left, meet-in-the-middle against double DES, where the plaintext is encrypted under every first key and the ciphertext decrypted under every second key until the two searches meet at a shared middle value, costing about two to the fifty-seventh rather than two to the one hundred twelfth; on the right, the birthday problem, where twenty-three people form two hundred fifty-three pairs and have an even chance of a shared birthday, so an n-bit hash yields a collision in about two to the n over two tries and a 128-bit hash gives only 64-bit collision resistance TWO PIECES OF ARITHMETIC THE EXAM TESTS Meet-in-the-middle: why 2DES failed P E, key 1 middle D, key 2 C 256 encryptions of P, every result stored 256 decryptions of C, each looked up in the table a match in the middle reveals both keys work: two searches of 256, about 257 not the 2112 that two keys seemed to promise 3DES uses three operations so that one side of the meeting still faces a full 2112 search needs one known plaintext and ciphertext pair Birthday: collisions come early 23 people make 253 pairs: an even chance two share a birthday a specific preimage of an n-bit hash: about 2n tries any collision at all: about 2n/2 tries a 128-bit hash gives 64-bit collision resistance the reason MD5 fell, and why signatures and certificates need SHA-256 or better the number of pairs grows with the square of the samples
Both attacks use the same shortcut: build a table from one side and look for a match from the other. Meet-in-the-middle does it to keys; the birthday attack does it to hash outputs.

Protocol and credential attacks: nothing cryptographic broke

Man-in-the-middle intercepts and relays between two parties who each believe they are talking to the other, and from there can downgrade the negotiation, inject content or capture credentials. The defenses are mutual authentication, strict certificate validation, pinning, HSTS, and protocols with no downgrade path. Downgrade is defeated by removing weak options rather than deprioritizing them; replay by nonces, timestamps and sequence numbers. None of these break a cipher; they exploit the moment before the cipher is agreed, or the absence of freshness after it is.

Pass-the-hash is the credential attack candidates most often misread. In challenge-response authentication the client proves knowledge of the password by computing a response from the hash, so anyone holding the hash can produce the response. The password is never recovered and never needed, which is why complexity and rotation do nothing against it. The countermeasures are about where hashes appear: credential isolation, unique local administrator passwords, tiered administration so privileged credentials never touch ordinary workstations, and authentication that rejects replayed hashes.

Kerberos exploitation applies the same idea to tickets, under three names.

Attack Mechanism Countermeasure
Kerberoasting request a service ticket, crack it offline against the service account's password long random service account passwords, or group managed service accounts
Silver ticket forge a service ticket with a compromised service account key; scoped to that service the same, plus monitoring for tickets the KDC never issued
Golden ticket forge any ticket for any user with the compromised krbtgt key: total domain compromise rotate krbtgt twice, restrict privileged logon, alert on anomalous tickets

All three share a diagnosis: the credential is the key, so protect where it lives and limit where it can be replayed.

Exam tip: when a stem says the attacker never recovered a password, or the whole domain fell after one key was taken, you are in credential territory. The right answer names isolation, rotation or monitoring; a longer key, a stronger cipher or a password policy is a distractor from the wrong layer.

Ransomware as a cryptographic attack

Ransomware is on the list because it uses cryptography as the weapon rather than the target: strong encryption applied to your data with a key you do not have, usually after exfiltration for double extortion. Nothing about the encryption is weak; the files cannot be recovered by cryptanalysis. The countermeasures are therefore about everything except the cipher: immutable, tested, offline-capable backups so data can be restored without the key, segmentation so encryption cannot spread, MFA on every remote access path, rapid patching, and detection that fires before mass encryption completes. The control that makes a ransomware event survivable is the backup the attacker could not reach, not the antivirus the attacker got past.

Four stems, decoded

  1. A web application returns a different error for invalid padding than for valid, and an attacker uses the difference to recover a session token. Chosen ciphertext, specifically a padding oracle. Authenticated encryption that rejects tampered ciphertext before decrypting.
  2. A smart card takes measurably longer to reject a PIN whose first digit is correct. Timing side channel. Constant-time comparison; the algorithm was never the problem.
  3. An attacker holding a captured NTLM hash authenticates to a file server without ever learning the password. Pass-the-hash. Credential isolation and unique local administrator passwords; rotation does not help.
  4. Two certificates with different public keys carry the same signature. Birthday attack against the hash inside the signature. A hash with adequate collision resistance; 128 bits gives only 64.

Key takeaways

  • Locate the layer first. Algorithm, implementation, protocol or credential: the countermeasure lives on the same layer.
  • The classical ladder runs ciphertext-only, known plaintext, chosen plaintext, chosen ciphertext. Does the attacker choose the input, and does it go to encryption or decryption?
  • Side channels listen; fault injection provokes. Constant time, constant power, blinding, noise, shielding, verification, and vetted libraries.
  • Meet-in-the-middle made 2DES worth about 2^57; the birthday attack halves collision resistance. Hence 3DES, and SHA-256 for signatures.
  • Pass-the-hash and Kerberos attacks never recover a password; ransomware never breaks a cipher. Defend the credential's location and the backup's reachability.

Cryptanalytic attacks are objective 3.7 of CISSP Domain 3, Security Architecture and Engineering, 13% of the exam, and the counterpart to cryptographic selection in 3.6. Work all ten Domain 3 objectives with our free CISSP Domain 3 study guide.

#CISSP #ISC2 #Cryptanalysis #SideChannelAttacks #PassTheHash #Kerberoasting #BirthdayAttack #Ransomware #InfoSec #CyberSecurity

CISSP Domain 3 · security architecture and engineering

Turn the models into marks

Security models are one of ten modules in CISSP Domain 3, 13% of the exam. Study all 45 topics: secure design principles, models, cryptography, site design and the information system lifecycle, with our objective-mapped guide and 100 practice questions.

Get the CISSP Domain 3 guide

Share this article

Keep reading

CISSP deep dives

Which Layer Is It? Mapping Attacks to the OSI Model, Plus IPsec AH vs. ESP

The OSI model is on every networking exam, and the CISSP is the one that asks what attacks live at each layer. All seven layers with their unit, device and protocols, the attack the exam pins to each, the TCP/IP model's four-layer collapse, and IPsec pulled apart: AH versus ESP, transport versus tunnel mode, and what IKE and the security association actually negotiate.

Read CISSP deep dives

Roots of Trust: TPM, Secure Boot vs. Measured Boot, and the Trusted Computing Base

Every security control runs on something, and if that something is compromised the control is theater. CISSP Domain 3 on the hardware and firmware foundations: the trusted computing base and the reference monitor, protection rings, what a TPM actually stores and what a platform configuration register is for, why secure boot and measured boot answer different questions, and where trusted execution environments and hardware security modules fit.

Read CISSP deep dives

Clear, Purge, Destroy: Data Remanence, Sanitization, and End-of-Life the CISSP Way

Deleted data is not gone, and the CISSP asks about the difference in a dozen ways. Domain 2 on what happens after the useful life of data and the assets that hold it: remanence and why deletion is a lie, the clear, purge and destroy ladder and which media each applies to, cryptographic erasure and the SSD problem, end-of-life versus end-of-support, and the ownership roles that decide who is accountable at every step.

Read

Enjoyed this? Get the AI security news that matters.

Join The AI Security Brief for the top AI security news, plus what's important to the C-suite. Free, straight to your inbox.

No spam. Unsubscribe anytime.