Quiz Entry - updated: 2026.07.14
What are the 8 classic attacks on message authentication, and which party (Alice, Eve, or Bob) can carry out each?
There are 8 attack categories targeting confidentiality, integrity, availability, authenticity, and non-repudiation — Eve performs most, but Alice and Bob can also attack.
* Eve mounts six outsider attacks; the two repudiation attacks come from the legitimate parties themselves. *
| Attack | Who? |
|---|---|
| Eavesdropping (Confidentiality) | Eve |
| Modifying the message (Integrity) | Eve |
| Inserting a fabricated message (Insertion) | Eve |
| Replaying a captured message (Replay) | Eve |
| Deleting messages (Delete) | Eve |
| Denying sending (Non-repudiation of origin) | Alice |
| Denying receipt (Non-repudiation of receipt) | Bob |
| Impersonation (Masquerade) | Eve |
Key insight: Not all attacks come from the outside! Alice can deny she sent a message (requires digital signatures, not just a MAC, to prevent). Bob can deny he received it (requires delivery receipts).
What actually stops each attack — no single mechanism covers all eight:
- A MAC / HMAC (integrity) directly defeats Modify (2) and Insertion (3): without the key, Eve can neither alter the message nor inject a valid new one.
- A MAC plus a protocol (sequence numbers, nonces, timestamps) is needed for Replay (4) and Delete (5) — a bare MAC happily re-validates a replayed or truncated stream, so freshness and ordering must come from the protocol.
- Encryption is the only defence against Eavesdropping (1) — a MAC authenticates but does not hide content.
- User authentication is what defeats Masquerade (8).
- Digital signatures (+ delivery protocols) are the only defence against the two repudiation attacks (6-7), because those come from the legitimate parties, not an outsider — a shared-key MAC can't prove which party produced it.