Which description best defines a birthday attack in cryptography?

• A. A type of attack that exploits the probability of two different inputs producing the same hash output.
• B. An attack that floods a target with UDP packets to disrupt service.
• C. An technique used to tamper cookies to gain unauthorized access or manipulate user sessions.
• D. A vulnerability that allows injecting malicious scripts into web pages viewed by other users.

Answer: (A)

The key idea is a birthday attack targets hash collisions. In cryptography, a hash function takes input data and produces a fixed-size output. Because the output space is fixed, different inputs can end up with the same hash value—these are collisions. A birthday attack looks for two distinct inputs that produce the same hash, exploiting the birthday paradox. For an n-bit hash, you typically expect to find a collision after trying around 2^(n/2) random inputs, which is much easier than trying to invert every possible hash or brute-force the entire input space. Once a collision is found, an attacker can substitute one input with the other without changing the hash, which can undermine digital signatures, integrity checks, or other security guarantees. The description that matches this scenario is the one that mentions exploiting the probability of two different inputs producing the same hash output.

The other descriptions refer to different security threats: flooding a target with UDP packets is a denial-of-service attack, tampering cookies to hijack sessions describes session hijacking or cookie manipulation, and injecting malicious scripts into web pages describes cross-site scripting.