Cryptography (CRA)

Players can discuss any type of Cryptography (CR) attack they think might be possible against the assessment target. It does not matter if the attack relates to another CR card, but if possible try to identify an attack that is fairly unique to the application/functionality/users.

Scenario: Invent your own Cryptography threat

Inventing a new cryptography threat could lead to:

1. Data Exposure: Breaking encryption or hashing reveals confidential data (passwords, PII, financial info).
2. Impersonation / Spoofing: Forging digital signatures, certificates, or tokens allows pretending to be another user/system.
3. Data Tampering: Altering messages, files, or communications without detection.
4. Privilege Escalation: Using broken cryptography in access tokens or authorization systems to gain higher privileges.
5. Replay or Forgery: Exploiting weak session keys or signed messages to repeat or fabricate transactions.
6. Denial of Service: Attacking computationally heavy cryptographic operations to exhaust system resources.
7. Loss of Auditability / Repudiation: Actions cannot be trusted as genuine if signatures or integrity checks are bypassed.

Threat Modeling

STRIDE

Any of the STRIDE categories may be applicable, but the primary concern is usually Information Disclosure or Tampering as breaking cryptography, in most cases, mean you can either disclose or modify data, depending on the context.

What can go wrong?

Data leaks, impersonation, tampering, privilege escalation, replay/forgery, DoS, loss of trust in audits.

What are we going to do about it?

Use strong cryptography, proper key management, proven libraries, integrity checks, secure storage, monitoring, and regular updates.

1. Use Strong, Approved Cryptography: Only standardized, vetted algorithms (AES, RSA, ECDSA, SHA-2/3, etc.).
2. Proper Key Management: Secure generation, storage, rotation, and destruction of keys.
3. Do Not Roll Your Own Cryptography: Avoid custom encryption, hashing, or random number implementations.
4. Use Proven Libraries: Rely on well-maintained cryptographic libraries rather than ad-hoc code.
5. Enforce Integrity Checks: Always use authenticated encryption (AES-GCM, ChaCha20-Poly1305) or MACs to prevent tampering.
6. Secure Transmission and Storage: Encrypt sensitive data in transit and at rest.
7. Monitor and Audit: Log unusual cryptographic failures, expired certificates, or invalid signatures.
8. Regularly Update Algorithms: Replace algorithms that are weak due to advances in computing power or cryptanalysis.
9. Penetration Testing and Threat Modeling: Simulate novel cryptographic attacks and assess resistance.