Download Document

CSCI5233 Computer Security & Integrity (F’02)
Midterm Solutions
Prepared by Mallikarjun Merla (based on Charles Moen’s solutions)
1. Vulnerability = a weakness of a system that can be exploited to cause loss or
harm.
Threat = circumstances that may lead to a potential loss or harm, for
example, a software flaw, a natural disaster, or a human attack.
Control = a protective measure that is used to reduce a vulnerability, for
example a hardware device such as a lock, or policy such as changing
passwords frequently, a software device, or a procedure.
2. Numbers generated by random number generators are called “pseudorandom numbers” because they are numbers that form a sequence that is
generated by an algorithm. Since this sequence is algorithm – generated, it
is predictable if one knows the algorithm. Furthermore, this sequence of
numbers; repeats, and if one can examine each repeating sequence, then one
can determine the algorithm by looking at the pattern of repetition. Being
able to predict the pattern of pseudorandom numbers is vulnerability.
3. Diffusion means that the data in the original message is spread throughout
the cipher text. A change in the original message will be propagated
throughout the cipher text.
An example of an encryption method that uses diffusion is columnar
transposition. We can se how this method achieves diffusion by the following
example.
The plain text, message is: “Now is the time for all good men to”
The cipher text message is: “ntflmohogeweronitaotsildo”.
Diffusion is achieved by creating the cipher text by reading left to right across
the columns after the plain text was written from top to bottom in the
columns. Diffusion occurs because the letters of each plain test word are
scattered throughout the cipher text by the resulting permutation. Changing
one word of plaintext will change many parts of the cipher text. We can
further enhance by doing a second columnar transposition.
4. First calculate the differences
34-10 = 24
62-21 = 41
109-37 = 72
105-49 = 56
162-58 = 104
132-72 = 60
Then look for common factors
24 – 3, 4, 6, 8
41 – 1, 41
72 – 2, 3, 4, 6, 8, 9, 12
56 – 2, 4, 7, 8
104 – 2, 4, 8, 13
60 – 2, 4, 5,15
One of these common factors will be the number of alphabets. Since 4 is a
common factor in most differences, it is likely that there were 4 alphabets
used. That is the keyword is probably 4 characters long – each letter of the
keyword is used to control the encryption of one character in the plain text
with a different permutation of the alphabet used for each letter in the key
word.
5. E – encrypt
D – decrypt
S – sender
R – receiver
M – message
DS (M) – encrypting M with the private key of S.
ER (M) – encrypting M with the public key of R.
Authenticity – is achieved when the sender encrypts the message with private
key. We can write it like this: DS (M). Authenticity is achieved because only
S has the private key and only a message that is encrypted with S’s private
key can be decrypted with S’s public key. So when R receives the message
and decrypts it with S’s public key, R can be sure that S is the sender.
Unforgeability is achieved because both R and S can keep DS (M) and use it
to prove the content of the original message S cannot change the M because
R keeps the message. R cannot change the message because he doesn’t
have the private key of S.
Secrecy is achieved by a second encryption with R’s public key like this: ER
(DS (M)). Only R can decrypt this message because it can only be decrypted
with R’s private key. A diagram of the final procedure is as follows
ER (DS (M))
R
S
6. x = a^(p-2) mod p
[1,3,5,11,23,47,97] = Simple knapsack
Calculate the hard knapsack
[7, 10, 2, 0, 7, 10, 8]
1 0 1 1 0 1 1
7 + 2+0+0+10+8 = 27
[7, 10, 2, 0, 7, 10, 8]
0 1 0 0 1 0 1
10+7+8 = 25
7.
Leaf
M
K
n,a
2
u
k
f
K is encrypted separately and included so that law enforcement authority will
have access to it.
K is the key used to encrypt the message M.
K is encrypted with the escrowed key u and included in the LEAF, which is
encrypted by family key f.
The LEAF can be decrypted by law enforcement authority that may want to
access K. They already have f which they use to get n = the unique number
of the unit (a= the aunthenticator). Then they get a court order to retrieve
the unique key u from the two escrow authorities that possess the two
separate parts of u. Then they can be used to decrypt the message
7. Symmetric key digital signature protocol – Both parties must share a secret
key with the arbiter.
P – Pablo, the signer
A – Arbiter
R – Renee, the receiver of the signed message
M – Message
KP – Pablo’s secret key, shared with A
KR – Renee’s secret key, shared with A
P
1
A
2
3
R
1 - E (M, KP)
2 - A verifies message by decoding with KP
3 – A encodes and sends to Renee
E ((P, M, E (M, KP)), KR)
The digital signature
Renee’s secret key
The message
Pablo’s identity
3