Which 4 of the 8 attacks can be solved directly with cryptographic mechanisms, and which 4 require additional application-level measures?
Eavesdropping, modifying, inserting, and non-repudiation of origin are solved by crypto directly; replay, delete, masquerade, and non-repudiation of receipt need application-level measures.
* Four attacks fall to crypto primitives; four more need sequence numbers or challenge-response on top. *
Solvable by cryptographic primitives:
| Attack | Solution |
|---|---|
| Eavesdropping | Encryption (symmetric or asymmetric) |
| Modifying | MAC or Digital Signature |
| Inserting | MAC or Digital Signature |
| Non-repudiation of origin | Digital Signature (asymmetric only!) |
Require additional application measures:
| Attack | Solution |
|---|---|
| Replay | Sequence numbers covered by a MAC or signature |
| Delayed delivery (a held-back, late message) | Timestamps (date and time in the protected message) |
| Delete | Sequence numbers (detect gaps) |
| Masquerade | Challenge-Response protocols with a MAC or signature ("mutual authentication") |
| Non-repudiation of receipt | Protocol with digital signatures, like a registered letter where the recipient signs for delivery |
Key insight: The 4 basic crypto principles (symmetric/asymmetric encryption, MAC, digital signature) handle the first group elegantly. But the second group needs additional protocol design on top of the crypto primitives.
Non-repudiation of receipt is rarely required, so it is rarely implemented. One classic case is interbank clearing (Swiss Interbank Clearing, SIC), where a bank must not be able to deny having received a payment instruction. Digital registered mail is another: when Swiss Post launched its digital letter in April 2026, a "registered" variant would need exactly this protection, though it may well be solved at the application level rather than cryptographically.