What is a 'rubber-hose' attack in cryptanalysis?

• A. It provides no practical benefit and is rarely used.
• B. It refers to the extraction of cryptographic secrets through coercion or torture.
• C. It is a digital signature technique.
• D. It is a method of intercepting communications.

Answer: (B)

A rubber-hose attack targets the human element rather than the math of the cryptosystem. It involves coercion, threats, or even torture to force someone to reveal cryptographic secrets such as a password, passphrase, or private key. Because many defenses assume secrets are kept private by the person who knows them, this kind of attack bypasses cryptographic strength by exploiting psychology or physical pressure instead of breaking the algorithm. It’s about extracting what’s secret through people, not through digital methods like forging signatures or intercepting data. This concept highlights why strong cryptography must be paired with robust key management, multi-factor authentication, and protections against coercion.