Threat models and attacker models

Saying that a system is "secure" means nothing until one question has been answered: secure against whom, and against what? A safe that resists an amateur burglar is not necessarily safe against an intelligence service. Evaluating security therefore requires first setting a threat model.

The threat model

The threat model describes against whom we are protecting ourselves and what that adversary is capable of doing. It specifies:

• the attacker's resources (a curious individual? a company? a state?);
• their objectives (read a message? impersonate an identity? modify data?);
• their capabilities for accessing the system.

Without this framework, the question "is it secure?" has no answer.

Passive or active attacker

A first fundamental distinction:

• a passive attacker merely listens to the channel; they observe without modifying anything;
• an active attacker can modify, inject, delete, or replay messages. This is the case of the man-in-the-middle, who slips in between two correspondents and can impersonate each one to the other.

A system can resist passive eavesdropping while being vulnerable to an active attacker.

The classic attack models

Depending on what the attacker can obtain or provoke, attacks are classified as follows:

+---------------------------+------------------------------------------+
| Modele d'attaque          | Ce que l'attaquant possede / peut faire  |
+---------------------------+------------------------------------------+
| Texte chiffre seul        | Il n'a que des messages chiffres.        |
| (ciphertext-only)         | Le cas le plus difficile pour lui.       |
+---------------------------+------------------------------------------+
| Texte clair connu         | Il connait des couples (clair, chiffre)  |
| (known-plaintext)         | qu'il n'a pas choisis.                    |
+---------------------------+------------------------------------------+
| Texte clair choisi        | Il peut faire chiffrer des messages      |
| (chosen-plaintext)        | de son choix et voir le resultat.        |
+---------------------------+------------------------------------------+
| Texte chiffre choisi      | Il peut faire dechiffrer des chiffres    |
| (chosen-ciphertext)       | de son choix (sauf la cible).            |
+---------------------------+------------------------------------------+

The further down this table you go, the more powerful the attacker is. A modern cipher is required to resist even the strongest model (chosen ciphertext): this is the level of guarantee expected today.

Why set the model

You cannot evaluate security in the absolute. The same primitive can be secure in one model and broken in another. Setting the model allows you to:

• make the analysis rigorous: you know what you claim to guarantee;
• avoid false promises: "secure" with no model is an empty phrase;
• compare two systems honestly on the same ground.

In summary

A system is never "secure" in the absolute: it is secure against a given adversary. The threat model sets who we protect against and what the attacker can do — passive (eavesdropping) or active (modification, man-in-the-middle). The attack models range from ciphertext-only to chosen ciphertext, from the weakest to the strongest. Security can only be evaluated by first setting this framework.