2 cissp ® Official Study Guide Eighth Edition

Chosen Plaintext
In a chosen plaintext attack, the attacker has the ability to encrypt 
plaintext messages of their choosing and can then analyze the ciphertext output of the 
encryption algorithm. 
Meet in the Middle
Attackers might use a meet-in-the-middle attack to defeat encryp-
tion algorithms that use two rounds of encryption. This attack is the reason that Double 
DES (2DES) was quickly discarded as a viable enhancement to the DES encryption (it was 
replaced by Triple DES, or 3DES). 
In the meet-in-the-middle attack, the attacker uses a known plaintext message. The 
plain text is then encrypted using every possible key (k1), and the equivalent ciphertext is 
decrypted using all possible keys (k2). When a match is found, the corresponding pair 
(k1, k2) represents both portions of the double encryption. This type of attack generally 
takes only double the time necessary to break a single round of encryption (or 2 
n
rather 
than the anticipated 2 
 
n
 
* 2 
 
n
 
), offering minimal added protection. 
Man in the Middle
In the man-in-the-middle attack, a malicious individual sits between 
two communicating parties and intercepts all communications (including the setup of the 
cryptographic session). The attacker responds to the originator’s initialization requests and 
sets up a secure session with the originator. The attacker then establishes a second secure 
session with the intended recipient using a different key and posing as the originator. The 
attacker can then “sit in the middle” of the communication and read all traffi c as it passes 
between the two parties. 
Be careful not to confuse the meet-in-the-middle attack with the man-
in-the-middle attack. They may have similar names, but they are quite 
different!