19.2 Passive versus active attacks

Arguably, passive and active attacks are the two most fundamental categories describing attacks on cryptography. We already introduced the corresponding attacker models in Section 2.2 of Chapter 2, Secure Channel and the CIA Triad, where we also met two different attackers, Eve (passive) and Mallory (active).

To recap, a passive attack is an attack where the adversary, Eve, is only eavesdropping on a communication between the legitimate parties Alice and Bob. In other words, as illustrated in Figure 19.1, Eve can only read the (hopefully cryptographically protected) communication messages.

Consequently, a passive attack is only a threat to the confidentiality of information exchanged between Alice and Bob. Importantly, Eve cannot manipulate Alice’s or Bob’s messages or inject her own messages.

Figure 19.1: In a passive attack, Eve can observe the communication between Alice and Bob

In contrast, in an active attack...