0

I was asked during a job interview the following question, to which I couldn't find an answer then, and this thing is still bothering me. I was hoping someone might know the answer here:

Consider two banks that communicate through an encrypted channel, where you are able to listen to the communication between them:

enter image description here

Bank A holds credit card numbers (you can refer to the credit card numbers as decimal or binary number of some length of your choice - it doesn't matter) in its database, in a plain form; meaning the credit card numbers are not encrypted at rest - they are encrypted only right before they are sent to Bank B through the channel between them.

The goal is to steal Bank A's credit card numbers. But, as I mentioned, since you are listening to an encrypted channel, we suppose you somehow gained access to Bank A's database, where it holds its credit card numbers, and you are given a chance to plug your disk on key into it, and modify the data in the database.

So basically the question comes down to: Is there any data you can add to the database, or any manipulation you can do on the credit card numbers, that will then give you the ability to figure out the numbers by listening to the encrypted channel, or to provide any advantage in attempting to decrypt the credit card?
(Thanks to Xander for helping with overcome the language barrier by rephrasing the question, I'm not an English speaker)

I hope I didn't omit any important details (I should've write that down). Is it doable?

  • 4
    Sorry but what is dok? – Abe Miessler Sep 5 '14 at 21:55
  • 3
    Also it seems like something might have been left out. If your statement, ...suppose that you somehow gained access to Bank A's database, ...and run any code you'd like on it.... is correct, then I would just query the credit card table. – Abe Miessler Sep 5 '14 at 21:58
  • 3
    What is a "dok"? Is it implied that you still need to steal the cards off the wire? If you've gained access to the database, why don't you just take them from there? It looks to me like there may be additional constraints or clarifications that are missing here. – Xander Sep 5 '14 at 22:04
  • Is the card data at Bank A encrypted at rest? – k1DBLITZ Sep 5 '14 at 23:14
  • 1
    The question boils down to: Is the connection between banks vulnerable to a known-plaintext attack or chosen-plaintext attack. And that's what the interviewer would have looked to see if you could figure out - as @Xander's answer states, such attacks are not possible with properly implemented modern crypto protocols. The interviewer wanted to see you classify the problem. – gowenfawr Sep 6 '14 at 22:45
3

Your description is a bit confusing, but from what I gather, the scenario is this:

You're able to add data to the credit card database, and then capture encrypted traffic off them wire. The question then is: "Is there any data you can add to the database that will then give you an advantage in attempting to decrypt the credit cards?"

If, that is in fact the question, and if, in fact, the encryption used is strong, and properly configured, the answer is "No." This is what is called a "chosen plaintext attack." It means that you can choose the data (or some of the data) to be encrypted, in this case, the arbitrary data that you add to the database, in an attempt to determine if you can learn something about the plaintext from the ciphertext alone. A strong encryption algorithm, properly implemented, will not allow this. You can do whatever you want to the data to be encrypted, add anything you want, but once it's encrypted and sent across the wire, it won't help you in your quest to decrypt, or discover anything about the contents of the encrypted traffic.

  • "Is there any data you can add to the database that will then give you an advantage in attempting to decrypt the credit cards?" That is in fact the question! – so.very.tired Sep 6 '14 at 9:22
  • But if the encryption is not properly implemented, it would be very plausible. – lzam Sep 7 '14 at 3:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.