Cryptanalysis Cryptanalysis ( from the Greek " kryptós " , " hidden " , and " analýein " , " to loosen " or " to untie " ) is the art and science of analyzing information system s in order to study the hidden aspects of the systems . Cryptanalysis is used to breach cryptographic security systems and gain access to the contents of encrypted messages , even if the cryptographic key is unknown . In addition to mathematical analysis of cryptographic algorithms , cryptanalysis also includes the study of side - channel attacks that do not target weaknesses in the cryptographic algorithms themselves , but instead exploit weaknesses in their implementation . Even though the goal has been the same , the methods and techniques of cryptanalysis have changed drastically through the history of cryptography , adapting to increasing cryptographic complexity , ranging from the pen - and - paper methods of the past , through machines like Bombe s and Colossus computer s at Bletchley Park in World War II , to the mathematically advanced computerized schemes of the present . Methods for breaking modern cryptosystem s often involve solving carefully constructed problems in pure mathematics , the best - known being integer factorization . Overview . Given some encrypted data ( " " ciphertext " " ) , the goal of the " cryptanalyst " is to gain as much information as possible about the original , unencrypted data ( " " plaintext " " ) . Amount of information available to the attacker . Attacks can be classified based on what type of information the attacker has available . As a basic starting point it is normally assumed that , for the purposes of analysis , the general algorithm is known ; this is Shannon ' s Maxim " the enemy knows the system " — in its turn , equivalent to Kerckhoffs ' principle . This is a reasonable assumption in practice — throughout history , there are countless examples of secret algorithms falling into wider knowledge , variously through espionage , betrayal and reverse engineering . ( And on occasion , ciphers have been reconstructed through pure deduction ; for example , the German Lorenz cipher and the Japanese Purple code , and a variety of classical schemes ) . : Computational resources required . Attacks can also be characterised by the resources they require . Those resources include : It ' s sometimes difficult to predict these quantities precisely , especially when the attack isn ' t practical to actually implement for testing . But academic cryptanalysts tend to provide at least the estimated " order of magnitude " of their attacks ' difficulty , saying , for example , " SHA - 1 collisions now 2 . " Bruce Schneier notes that even computationally impractical attacks can be considered breaks : " Breaking a cipher simply means finding a weakness in the cipher that can be exploited with a complexity less than brute force . Never mind that brute - force might require 2 encryptions ; an attack requiring 2 encryptions would be considered a break . . . simply put , a break can just be a certificational weakness : evidence that the cipher does not perform as advertised . " Partial breaks . The results of cryptanalysis can also vary in usefulness . For example , cryptographer Lars Knudsen ( 1998 ) classified various types of attack on block cipher s according to the amount and quality of secret information that was discovered : Academic attacks are often against weakened versions of a cryptosystem , such as a block cipher or hash function with some rounds removed . Many , but not all , attacks become exponentially more difficult to execute as rounds are added to a cryptosystem , so it ' s possible for the full cryptosystem to be strong even though reduced - round variants are weak . Nonetheless , partial breaks that come close to breaking the original cryptosystem may mean that a full break will follow ; the successful attacks on DES , MD5 , and SHA - 1 were all preceded by attacks on weakened versions . In academic cryptography , a " weakness " or a " break " in a scheme is usually defined quite conservatively : it might require impractical amounts of time , memory , or known plaintexts . It also might require the attacker be able to do things many real - world attackers can ' t : for example , the attacker may need to choose particular plaintexts to be encrypted or even to ask for plaintexts to be encrypted using several keys related to the secret key . Furthermore , it might only reveal a small amount of information , enough to prove the cryptosystem imperfect but too little to be useful to real - world attackers . Finally , an attack might only apply to a weakened version of cryptographic tools , like a reduced - round block cipher , as a step towards breaking of the full system . History of cryptanalysis . Cryptanalysis has coevolved together with cryptography , and the contest can be traced through the history of cryptography — new cipher s being designed to replace old broken designs , and new cryptanalytic techniques invented to crack the improved schemes . In practice , they are viewed as two sides of the same coin : in order to create secure cryptography , you have to design against possible cryptanalysis . Successful cryptanalysis has undoubtedly influenced history ; the ability to read the presumed - secret thoughts and plans of others can be a decisive advantage . For example , in England in 1587 , Mary , Queen of Scots was tried and executed for treason as a result of her involvement in three plots to assassinate Elizabeth I of England . The plans came to light after her coded correspondence with fellow conspirators was deciphered by Thomas Phelippes . In World War I , the breaking of the Zimmermann Telegram was instrumental in bringing the United States into the war . In World War II , the Allies benefitted enormously from their joint success cryptanalysis of the German ciphers — including the Enigma machine and the Lorenz cipher — and Japanese ciphers , particularly ' Purple ' and JN - 25 . ' Ultra ' intelligence has been credited with everything between shortening the end of the European war by up to two years , to determining the eventual result . The war in the Pacific was similarly helped by ' Magic ' intelligence . Governments have long recognized the potential benefits of cryptanalysis for intelligence , both military and diplomatic , and established dedicated organizations devoted to breaking the codes and ciphers of other nations , for example , GCHQ and the NSA , organizations which are still very active today . In 2004 , it was reported that the United States had broken Iranian ciphers . ( It is unknown , however , whether this was pure cryptanalysis , or whether other factors were involved : ) . Classical ciphers . Although the actual word " " cryptanalysis " " is relatively recent ( it was coined by William Friedman in 1920 ) , methods for breaking codes and cipher s are much older . The first known recorded explanation of cryptanalysis was given by 9th - century Arabian polymath , Al - Kindi ( also known as " Alkindus " in Europe ) , in " A Manuscript on Deciphering Cryptographic Messages " . This treatise includes a description of the method of frequency analysis ( Ibrahim Al - Kadi , 1992 - ref - 3 ) . Italian scholar Giambattista della Porta was author of a seminal work on cryptanalysis " " De Furtivis Literarum Notis " . " Frequency analysis is the basic tool for breaking most classical cipher s . In natural languages , certain letters of the alphabet appear more frequently than others ; in English , " E " is likely to be the most common letter in any sample of plaintext . Similarly , the digraph " TH " is the most likely pair of letters in English , and so on . Frequency analysis relies on a cipher failing to hide these statistics . For example , in a simple substitution cipher ( where each letter is simply replaced with another ) , the most frequent letter in the ciphertext would be a likely candidate for " E " . Frequency analysis of such a cipher is therefore relatively easy , provided that the ciphertext is long enough to give a reasonably representative count of the letters of the alphabet that it contains . In Europe during the 15th and 16th centuries , the idea of a polyalphabetic substitution cipher was developed , among others by the French diplomat Blaise de Vigenère ( 1523 – 96 ) . For some three centuries , the Vigenère cipher , which uses a repeating key to select different encryption alphabets in rotation , was considered to be completely secure ( " le chiffre indéchiffrable " — " the indecipherable cipher " ) . Nevertheless , Charles Babbage ( 1791 – 1871 ) and later , independently , Friedrich Kasiski ( 1805 – 81 ) succeeded in breaking this cipher . During World War I , inventors in several countries developed rotor cipher machine s such as Arthur Scherbius ' Enigma , in an attempt to minimise the repetition that had been exploited to break the Vigenère system . Ciphers from World War I and World War II . Cryptanalysis of enemy messages played a significant part in the Allied victory in World War II . F . W . Winterbotham , quoted the western Supreme Allied Commander , Dwight D . Eisenhower , at the war ' s end as describing Ultra intelligence as having been " decisive " to Allied victory . Sir Harry Hinsley , official historian of British Intelligence in World War II , made a similar assessment about Ultra , saying that it shortened the war " by not less than two years and probably by four years " ; moreover , he said that in the absence of Ultra , it is uncertain how the war would have ended . In practice , frequency analysis relies as much on linguistic knowledge as it does on statistics , but as ciphers became more complex , mathematics became more important in cryptanalysis . This change was particularly evident before and during World War II , where efforts to crack Axis ciphers required new levels of mathematical sophistication . Moreover , automation was first applied to cryptanalysis in that era with the Polish Bomba device , the British Bombe , the use of punched card equipment , and in the Colossus computers — the first electronic digital computers to be controlled by a program . Indicator . With reciprocal machine ciphers such as the Lorenz cipher and the Enigma machine used by Nazi Germany during World War II , each message had its own key . Usually , the transmitting operator informed the receiving operator of this message key by transmitting some plaintext or ciphertext before the enciphered message . This is termed the " indicator " , as it indicates to the receiving operator how to set his machine to decipher the message . Poorly designed and implemented indicator systems allowed first the Poles and then the British at Bletchley Park to break the Enigma cipher system . Similar poor indicator systems allowed the British to identify " depths " that led to the diagnosis of the Lorenz SZ40 / 42 cipher system , and the comprehensive breaking of its messages without the cryptanalysts seeing the cipher machine . Depth . Sending two or more messages with the same key is an insecure process . To a cryptanalyst the messages are then said to be " " in depth " " . This may be detected by the messages having the same " indicator " by which the sending operator informs the receiving operator about the key generator initial settings for the message . Generally , the cryptanalyst may benefit from lining up identical enciphering operations among a set of messages . For example the Vernam cipher enciphers by bit - for - bit combining plaintext with a long key using the " exclusive or " operator , which is also known as " modulo - 2 addition " ( symbolized by ⊕ ) : Deciphering combines the same key bits with the ciphertext to reconstruct the plaintext : ( In modulo - 2 arithmetic , addition is the same as subtraction . ) When two such ciphertexts are aligned in depth , combining them eliminates the common key , leaving just a combination of the two plaintexts : The individual plaintexts can then be worked out linguistically by trying " probable words " ( or phrases ) at various locations ; a correct guess , when combined with the merged plaintext stream , produces intelligible text from the other plaintext component : The recovered fragment of the second plaintext can often be extended in one or both directions , and the extra characters can be combined with the merged plaintext stream to extend the first plaintext . Working back and forth between the two plaintexts , using the intelligibility criterion to check guesses , the analyst may recover much or all of the original plaintexts . ( With only two plaintexts in depth , the analyst may not know which one corresponds to which ciphertext , but in practice this is not a large problem . ) When a recovered plaintext is then combined with its ciphertext , the key is revealed : Knowledge of a key of course allows the analyst to read other messages encrypted with the same key , and knowledge of a set of related keys may allow cryptanalysts to diagnose the system used for constructing them . The development of modern cryptography . Even though computation was used to great effect in Cryptanalysis of the Lorenz cipher and other systems during World War II , it also made possible new methods of cryptography orders of magnitude more complex than ever before . Taken as a whole , modern cryptography has become much more impervious to cryptanalysis than the pen - and - paper systems of the past , and now seems to have the upper hand against pure cryptanalysis . The historian David Kahn notes : Kahn goes on to mention increased opportunities for interception , bugging , side channel attack s , and quantum computers as replacements for the traditional means of cryptanalysis . In 2010 , former NSA technical director Brian Snow said that both academic and government cryptographers are " moving very slowly forward in a mature field . " However , any postmortems for cryptanalysis may be premature . While the effectiveness of cryptanalytic methods employed by intelligence agencies remains unknown , many serious attacks against both academic and practical cryptographic primitives have been published in the modern era of computer cryptography : Thus , while the best modern ciphers may be far more resistant to cryptanalysis than the Enigma , cryptanalysis and the broader field of information security remain quite active . Cryptanalysis of asymmetric ciphers . Asymmetric cryptography ( or public key cryptography ) is cryptography that relies on using two keys ; one private , and one public . Such ciphers invariably rely on " hard " mathematical problem s as the basis of their security , so an obvious point of attack is to develop methods for solving the problem . The security of two - key cryptography depends on mathematical questions in a way that single - key cryptography generally does not , and conversely links cryptanalysis to wider mathematical research in a new way . Asymmetric schemes are designed around the ( conjectured ) difficulty of solving various mathematical problems . If an improved algorithm can be found to solve the problem , then the system is weakened . For example , the security of the Diffie - Hellman key exchange scheme depends on the difficulty of calculating the discrete logarithm . In 1983 , Don Coppersmith found a faster way to find discrete logarithms ( in certain groups ) , and thereby requiring cryptographers to use larger groups ( or different types of groups ) . RSA ' s security depends ( in part ) upon the difficulty of integer factorization — a breakthrough in factoring would impact the security of RSA . In 1980 , one could factor a difficult 50 - digit number at an expense of 10 elementary computer operations . By 1984 the state of the art in factoring algorithms had advanced to a point where a 75 - digit number could be factored in 10 operations . Advances in computing technology also meant that the operations could be performed much faster , too . Moore ' s law predicts that computer speeds will continue to increase . Factoring techniques may continue to do so as well , but will most likely depend on mathematical insight and creativity , neither of which has ever been successfully predictable . 150 - digit numbers of the kind once used in RSA have been factored . The effort was greater than above , but was not unreasonable on fast modern computers . By the start of the 21st century , 150 - digit numbers were no longer considered a large enough key size for RSA . Numbers with several hundred digits were still considered too hard to factor in 2005 , though methods will probably continue to improve over time , requiring key size to keep pace or other methods such as elliptic curve cryptography to be used . Another distinguishing feature of asymmetric schemes is that , unlike attacks on symmetric cryptosystems , any cryptanalysis has the opportunity to make use of knowledge gained from the public key . Quantum computing applications for cryptanalysis . Quantum computer s , which are still in the early phases of research , have potential use in cryptanalysis . For example , Shor ' s Algorithm could factor large numbers in polynomial time , in effect breaking some commonly used forms of public - key encryption . By using Grover ' s algorithm on a quantum computer , brute - force key search can be made quadratically faster . However , this could be countered by doubling the key length .