2 cissp ® Official Study Guide Eighth Edition

Frequency Analysis and the Ciphertext Only Attack
In many cases, the only information 
you have at your disposal is the encrypted ciphertext message, a scenario known as the 
ciphertext only attack
. In this case, one technique that proves helpful against simple ciphers 
is frequency analysis—counting the number of times each letter appears in the ciphertext. 
Using your knowledge that the letters 
E
, 
T
, 
A
, 
O
, 
I
, 
N
are the most common in the English 
language, you can then test several hypotheses:
■
If these letters are also the most common in the ciphertext, the cipher was likely a 
transposition cipher, which rearranged the characters of the plain text without
altering them.
■
If other letters are the most common in the ciphertext, the cipher is probably some 
form of substitution cipher that replaced the plaintext characters.

---

Cryptographic Attacks 
267
This is a simple overview of frequency analysis, and many sophisticated variations 
on this technique can be used against polyalphabetic ciphers and other sophisticated 
cryptosystems. 
Known Plaintext
In the known plaintext attack, the attacker has a copy of the encrypted 
message along with the plaintext message used to generate the ciphertext (the copy). This 
knowledge greatly assists the attacker in breaking weaker codes. For example, imagine the 
ease with which you could break the Caesar cipher described in Chapter 6 if you had both 
a plaintext copy and a ciphertext copy of the same message. 
Chosen Ciphertext
In a chosen ciphertext attack, the attacker has the ability to decrypt 
chosen portions of the ciphertext message and use the decrypted portion of the message to 
discover the key.