Which security requirements map to which attacks in the classic crypto model?
Three security requirements — confidentiality, data integrity/authenticity, and user authenticity — each protect against specific subsets of the 8 attacks.
* Each requirement defends a specific subset of the 8 attacks. *
| Security Requirement | Protects Against |
|---|---|
| Confidentiality | Eavesdropping |
| Data Integrity & Authenticity | Modifying, Inserting, Replaying, Deleting, Non-repudiation of origin, Non-repudiation of receipt |
| User Authenticity | Masquerade |
Notice that data integrity/authenticity covers the largest group (6 attacks). This is why MAC and digital signatures are so central to cryptographic protocols — they handle most of the threat landscape.
What about availability? It's deliberately absent from this model. The classic crypto model scopes the goals cryptography can enforce on a message — confidentiality, integrity/authenticity, and user authenticity. Availability (keeping a service reachable, surviving a DoS) is a systems/network property that crypto can't deliver: encrypting or signing a message does nothing to stop it being dropped or a server being flooded. It's part of the broader CIA triad, but it sits outside the cryptographic requirements.
Go deeper:
Information security — how security goals partition the threat space.