Also known as: brute-force attack, exhaustive key search
A brute-force attack (exhaustive key search) simply tries every candidate key or parameter set until one reproduces the observed ciphertext.1 It always works in principle; in practice it is bounded by the size of the search space and the cost of testing each candidate, so it is decisive only when that space is small — or when a cheap early-exit test rejects most candidates quickly.
How it works
The attacker fixes a candidate structure with a few unknown constants and loops over all their values, simulating the cipher and comparing against the data. Two practices make large sweeps tractable: a cheap early-exit — reject a candidate after a few mismatched bytes on a small sample, before running the full corpus — and parallelism across cores. When the unknowns number in the millions it is feasible; when they number a full 256-entry table it is not, and an algebraic or SAT/SMT approach is needed instead.
Variants
Pure enumeration is the baseline; several refinements cut the cost when the space is too large for a naive sweep. A dictionary attack tries only likely values (common passwords, default keys) instead of the whole space. A rainbow table trades memory for time by precomputing chains of hash outputs so a later lookup is cheap — devastating against unsalted password hashes. A meet-in-the-middle attack halves the exponent for constructions that apply a cipher twice (the reason 2-key Triple-DES gives far less than 112 bits of real strength). Each exploits some structure to shrink the effective 2ⁿ into something searchable.
In practice
Feasibility is a moving target set by hardware and key length. The 56-bit key of DES was searchable in days by the EFF’s purpose-built “Deep Crack” machine in 1998, demonstrating that a once-standard cipher had fallen to brute force outright.2 A 32-bit effective key — the size the TETRA TEA1 algorithm was reduced to — is trivially searchable on a laptop. This is exactly why key length matters: every added bit doubles the work, so 128-bit and larger keys keep the exhaustive search permanently out of reach while a short or deliberately weakened key collapses.
Relevance to SDR
Reverse-engineering an undocumented encoder often reduces to a few unknown constants — a multiplier, an additive step, a seed. GopherTrunk’s clean-room analysis of the Motorola P25 talker-alias obfuscation (issue #773) used parallel brute-force sweeps over such constants to rule out whole families of update rules (linear congruential, multiplicative-mod-prime, multiply-with-carry) against a known-plaintext corpus, each with a fast early-exit on the longest messages.
Sources
-
Brute-force attack — Wikipedia, for exhaustive key search and its dependence on key-space size. ↩
-
EFF DES cracker — Wikipedia, for a concrete demonstration that a 56-bit key is brute-forceable in practice. ↩