4.6. Cryptanalytic Attacks
💡 First Principle: Cryptographic algorithms are not broken by finding the key — they are broken by finding a shortcut that makes brute force unnecessary. Every cryptanalytic attack exploits a mathematical, implementation, or operational weakness that reduces the work required below the theoretical maximum.
Why this matters: The CISSP tests whether you understand why specific algorithms are deprecated and what class of attack made them obsolete. You will not perform cryptanalysis on the exam, but you must recognize which attacks apply to which algorithms and which defenses neutralize each attack class. A question about "why is DES insecure" expects you to cite key length exhaustion, not a theoretical mathematical break.
⚠️ Common Misconception: "Brute force is the only way to break encryption." In practice, brute force against modern algorithms (AES-256) is computationally infeasible. Real-world cryptographic failures come from implementation errors (side channels, padding oracles), protocol weaknesses (downgrade attacks), key management failures (hardcoded keys, weak entropy), and using deprecated algorithms — not from exhausting the key space of a properly implemented modern cipher.
