Reduce Key Space (T1600.001) is a sub-technique of Weaken Encryption, in the Defense Impairment tactic, for the Network Devices platform.
How attackers use it
MITRE says adversaries may reduce the effort needed to decrypt network traffic by reducing cipher strength. On a compromised device, they can shrink the key size the software uses to convert plaintext to ciphertext. MITRE's description of the extreme is a drop from hundreds or thousands of bytes to just a couple of bytes, which dramatically cuts the work needed to decrypt protected data without the key.
Adversaries may change the key size and other encryption parameters with specialized commands in a Network Device CLI introduced to the system through Modify System Image.
How to detect it
MITRE's detection strategy looks for attempts to alter cryptographic settings that reduce key strength or the allowed cipher suites. Indicators include configuration changes that downgrade algorithms or key length, strong encryption disabled in favor of legacy ciphers, CLI commands that modify crypto policy, firmware changes touching crypto libraries, and unexpected updates to key management files.
Correlating device configuration logs with traffic analysis that shows weaker ciphers gives higher confidence.
How to reduce the risk
MITRE lists no separate mitigations for this sub-technique. Because it depends on the adversary getting CLI access and introducing a modified image, apply the controls for Modify System Image: multi-factor authentication for administrators, signed images and boot integrity checks, and tightly limited administrator access.
Keep an approved baseline of key sizes and cipher suites, compare it on a schedule, and test what real tunnels negotiate.
Quick check
What would make this change visible outside the device?
Traffic analysis that shows weaker ciphers than before, which you can correlate with configuration change logs.
