Field Guide · term

Also known as: ciphertext-only attack, COA

A ciphertext-only attack (COA) assumes the attacker has only intercepted ciphertext — no matching plaintext and no ability to query the cipher.1 It is the weakest set of assumptions, so a cipher that falls to it is badly broken; the attack works by exploiting structure the plaintext is known to have even when its exact contents are unknown.

ciphertext constrain with knownplaintext structure recovery
With ciphertext alone, the attacker leans on what the plaintext must look like — character set, length rules, or fixed framing.

How it works

The attacker constrains the unknown plaintext using properties it is guaranteed to have: a restricted character set (e.g. printable ASCII), known field lengths or framing, language statistics, or a checksum that must validate. Each such constraint rules out candidate keys or algorithm parameters; with enough intercepted messages, the surviving candidates collapse to the true one. Classical frequency analysis of a substitution cipher is the textbook example — only ciphertext is needed because letter frequencies are a known property of the language.

Where it sits among attack models

Cryptanalytic attack models form a ladder of increasing attacker power, and a cipher is expected to withstand all of them.2 Ciphertext-only is the bottom rung — the least the attacker can have, so the hardest position from which to work:

  • Ciphertext-only — intercepted ciphertext, nothing else.
  • Known-plaintext — matched plaintext–ciphertext pairs the attacker observed but did not choose.
  • Chosen-plaintext — the attacker picks plaintexts and sees the resulting ciphertexts.

Because passive interception yields exactly the ciphertext-only condition, it is also the most realistic setting for an eavesdropper on a radio channel — which is why a scheme that leaks under it, like a system whose effective key is far shorter than advertised, is a serious practical failure rather than a theoretical curiosity.

Relevance to SDR

Over-the-air interception naturally yields ciphertext-only conditions. In GopherTrunk’s clean-room effort to reverse-engineer the Motorola P25 talker-alias obfuscation (issue #773), a ciphertext-only angle was available because every even-position byte must decode to a 0x00 UTF-16 pad and every alias byte must be printable — constraints derived purely from the captured bytes. It complements the stronger known-plaintext and chosen-plaintext settings.

Sources

  1. Ciphertext-only attack — Wikipedia, for the attack model and its reliance on known plaintext structure. ↩

  2. Attack model — Wikipedia, for the ladder of cryptanalytic attack models by attacker capability. ↩

See also