There’s a 50% chance of someone sharing a birthday if you have 23 people in a room. That’s how most people introduce the birthday problem. However, threat actors use that information to crack accounts instead of sharing trivia. So, what’s the birthday attack in cyber security?

The birthday attack in cybersecurity takes advantage of the birthday problem: there’s a higher chance of sharing a trait with someone as more people join the equation. Hackers use that mathematical probability to crack digital signatures and perform hash collision attacks.

What can you do to prevent a birthday attack? Is it up to the user or the developers – or both? Understanding the birthday problem is the key to fending off this attack and, at the same time, preparing yourself for the future of encryption.

Birthday Attack Explained

Simply put, hackers take advantage of the mathematical probability of the birthday problem to crack digital signatures. Websites turn passwords into hashes (these digital signatures) to validate your login credentials. Using encryption to turn passwords into hashes is a must.

Developers employ encryption to avoid storing passwords as plain text, which is a good thing. Unfortunately, there’s a limit to how many hashes a website can create (because there’s a limited number of combinations you can create with numbers and letters).

Hackers take advantage of that fact: you can crack a hash if you have enough computational power to brute force it. 

If you crack the way a password turns into a hash, you can imitate that hash to access an account. That’s the simple explanation of a complex attack. We’ll do a deep dive below.

Understanding a Birthday Attack

Threat actors don’t need to steal your password to access your account. They don’t have to infect your computer with malware either. They can play the server that stores the passwords to fool them if they want to impersonate you.

That’s right! Hackers employ brute force attacks to crack your password – but that’s only one end of the equation. You (the client) input a password on one side. On the other side, a website (the server) will validate it by comparing it to a digital signature they’ve created for you.

Unfortunately, there’s a limited number of digital signatures a computer can create. As more people register on a website, the closer a website is to reaching that limited number of signatures it can create. Since there are a limited number of hashes, a hacker may come up with yours by employing a brute force attack.

Hackers can use that information to their advantage thanks to the birthday problem: the more people who share a trait, the easier it is to share it with someone else (meaning they can crack your hash, seeing it’s not unique).  

What’s the Birthday Problem?

The birthday problem (or birthday paradox) is a simple mathematical concept: the chances of two people sharing a birthday increase as you increase the number of people. There’s a 100% chance of two people sharing a birthday if there are 366 of them in a room. However, how many do you need for a 50% chance? 183?

Wrong! You need 23. That’s right: if 23 people are in a room, there’s a 50% chance two of them share a birthday. We’ll avoid math jargon and keep things simple: as more people stand in the room, their chances of sharing a birthday compound with the next guy.

You can see the birthday problem in action here:

• 2 people sharing a birthday has a 0.27% chance of happening
• 5 people sharing a birthday has a 2.7% chance of happening
• 10 people sharing a birthday has an 11.6% chance of happening
• 23 people sharing a birthday has a 50% chance of happening
• 50 people sharing a birthday has a 96% chance of happening
• 100 people sharing a birthday has a 99.99987% chance of happening

What does sharing birthdays have to do with cybersecurity? It all makes sense when you understand how password storage and encryption work. Simply put, websites store your password using a digital signature (or hash). Unfortunately, computers have a limited number of hashes they can create, meaning threat actors may crack yours. We’ll explain it thoroughly below.

What Does the Birthday Problem Have To Do With Cybersecurity?

You can share more than a birthday with other people. In fact, you probably share a hash with countless others, though that probably means nothing to you unless you know there are several ways a company can store your password. It can be in plain text or hidden behind a cryptographic hash.

Storing passwords in plain text is exactly what it sounds like: a website will grab your login credentials and store them in their server exactly as is. Doing so poses a huge cybersecurity risk. Plain text passwords make a breach potentially catastrophic, as we’ve seen countless times before.

For that reason, most websites use hash functions to work with passwords. You input your password, an algorithm turns it into a hash (think of it as a secret code), then stores it that way. When you input your password again, your computer will turn it into a hash again, expecting it to match the one already assigned to you.

Unfortunately, computers have a limited number of hashes they can create, and they face more people (and passwords) than the number of hashes they can create. For that reason, threat actors use the birthday paradox to increase their chances of matching that hash and brute forcing your login credentials.

Why Is It Called a Birthday Attack?

The birthday attack follows the same principles as the birthday paradox: you need a limited number of permutations to guess the hash of a limited number of people. As we’ve stated above, you only need 23 people in a room if you want 50% of them to share a birthday. The more people in a room, the likelier it is that someone shares a birthday.

A birthday attack is called that way because threat actors know they can abuse the birthday paradox to have a mathematical edge over cryptographic protection. The more people register on a website, the more chances are they can perform a hash collision attack.

A hash collision attack takes place when a threat actor can duplicate a hash stored in a server to access information. Instead of brute forcing a password, hackers will come up with ingenious ways to brute force a hash. 

In other words, they don’t have to guess your password, they have to guess how a computer turns a passcode into a hash and brute force it to get the hash they want.

Signs a Birthday Attack May Happen

• Poor encryption methods. Most users choose poor passwords, though it wouldn’t be fair to blame users for a birthday attack. More often than not, hackers take advantage of encryption methods employed by developers, not password strength. For that reason, strong encryption methods must be chosen to have strong hashes.
• Short password length. Although we don’t want to blame users for a successful birthday attack, users could have the blame. A short password means a weak password – and a weak hash too. The shorter your password is, the easier it is for a threat actor to brute force it (and its hash). A ten-word password makes birthday attacks unlikely to happen.
• Computational power. Brute force attacks have computers guessing passwords one character at a time. The longer a password is, the more computational power you need to be successful. The same thing happens with hashes. As computers get stronger, encryption gets weaker – unless we find an alternative. Experts believe quantum computing may change traditional encryption forever.

Password Length, Hashes, and the Birthday Problem

Before we move forward, it’s important to note a hash relies on password length up to a point. The longer your password is, the more intricate your hash could be – but that doesn’t mean you want to use a 50-word password to fend off possible attacks.

In fact, anything longer than a 10-word password is useless (when it comes to defending yourself from birthday attacks). An 8-word password is also very secure, though anything shorter than that could prove problematic, especially if you’re dealing with hackers who have a big budget.

Remember, the more computational power a hacker has, the easier it is for them to brute force something. So, you want a longer password to prevent a threat actor from guessing your passcode or hash. However, there’s no need to go overboard.

How To Prevent a Birthday Attack

Users have little power to prevent a birthday attack if developers don’t use strong encryption methods. However, following cybersecurity best practices is the best tool to leave little to chance. Believing every website uses poor encryption methods is a must to keep your data safe.

What does that mean? Create strong passwords, don’t reuse them, and store them in a password manager if you have trouble remembering them. At the same time, make sure you don’t share too much information online: you have nothing to worry about if someone steals your login credentials but finds nothing of value in your account.

Fortunately, companies that deal with vital information (such as banks) have strong encryption methods in place, though that will help you very little unless you do your part.

Conclusion

A birthday attack in cybersecurity takes advantage of the birthday paradox: the more people register to a website, the likelier it is to share a hash. Hackers use that information to employ brute force attacks and guess these digital signatures. Developers should employ strong encryption methods while users follow cybersecurity best practices to prevent it from happening.