CSCI 368 Q & A

I have received similar questions from several people who wrote to me to my personal mail. Initially, I try to reply to the sender directly, but i think it is better to build a list here in the blog so that the other people can join in to discuss and record our history. Below are my own thinking and if you have better answer, I sincerely request you to feedback to us.

Q1. Write a protocol, based on Needham-Schroeder, to establish a shared key between three parties, Alice, Bob and Carol using a KDC. Each party trusts the KDC and, at the end of the protocol, should have a common key and be confident that the other two parties also have it.

Ans: Needham-Schroeder Protocol is the basis form of Kerberos protocol. In this protocol, there is a trusted server by all the users known as KDC (Key Distribution Center). When the user want to communicate to other users, the user will request to KDC to generate a shared session key which the user and his intended counterpart can decrypt. It is the authentication between 2 parties. For 3 parties (A,B,C), the keys required will be more than one key with KeyAB, KeyAC and KeyBC (3 keys).

In case, you would like to have just one common key between 3 parties, then the protocol will be a little different. Basically, you will start with the keys shared between KDC and Alice, between KDC and Bob as well as between KDC and Carol. The trick to have the common key and to be confident that the other two parties also have it is to explicitly state the identities of other two parties.


Q2. Write a symmetric{key inter{domain end{to{end authentication protocol. The environment includes two mobile service domains, each with an authentication server. We use AS1 and AS2 to denote the domains and the associated authentication servers. We restrict our attention to two users, Carol and Doug. Carol is registered with AS1 while Doug is registered with AS2. You are to design a protocol for the case where Carol has moved to AS2 and Doug has moved to AS1.

Registration in this symmetric key domain means the two parties have established a shared key which can be used as a basis for authentication. The two authentication servers, AS1 and AS2, share a symmetric key.

In this protocol, we have to assume that AS1 & C are in different inter-domain from AS2 & D. AS1 and AS2 are communicating with shared key between them. In order to register C to AS2, we will have the following steps.

1. C has to request to AS1 that he wanted to communicated with AS2.
2. AS1 will inform AS2 about C's request.
3. AS2 will reply to AS1 with the Key between C and AS2.
4. AS1 will send the key to C and AS2.
Now, there is key shared between C and AS2. Similarly, for D to register with AS1, it will follow the same steps. If you like to provide data freshness, you will need to add the nonces. If you want to provide integrity, you need to hash the key. For confidentiality, you got to ensure that key can be only decrypted by sender and intended receiver. For anonymity, you might want to consider the subliminal identity or nickname for C and D.

CSCI368 Exam Note

Network Security subjects consists of lots of protocols. You need to remember some of those, cos they could ask you to write down. And you also should know what are the uses of nounce, for example... how to read and write protocols terms and notation.

Here is the link for the exam note. Important thing for this subject is to "understand".

Good Luck!

CSCI368 Assignment 3

Assignment 3 is 10 marks and it is worth of 10% for your total marks. The topic is about reading and interpreting protocols. You have to justify the answers, but it is not enough to simply say a protocol is "for authentication". In particular you would need to explain who is being authenticated to whom.

In each case purpose could be purposes. I will now again upload the answer to the web and it should be able to download from the link, here.

It is an easy topic and you should be able to score since the exam is going to tough for this subject.

CSCI368 Assignment 2

This assignment is 20 marks. This assignment is rather quite long and I would not divide it. I will write this in a single post. I will not attached the programs that i have implemented, but if you are really need the help, I think I can assist you.

Introduction

This assignment requires writing a modified Kerberos software package. We will strictly follow the requirements based on the assignment paper, therefore, it is not exactly same as Kerberos software that we can find in commercial.

It is not testing of programming, but it is for the understanding of how Kerberos works and to practice implementing a protocol.

My program is implemented with C/C++ in Linux platform. It is on Ubuntu VMware. This assignment involves: Data Encryption, Decryption & Hashing.

Description

It is to implement a modified Kerberos software package. It consists of 4 entities:
1. Client (C)
2. Authentication Server (AS)
3. Ticket Granting Server (TGS)
4. Print Server (V)

There are 3 users (Alice, Bob & Chris) in the client side. Print Server is only single service available for that moment, and is referred by the name "printServer". The server stores messages to a file "Printed.txt", in some format.

Any kind of symmetric key algorithm is allowed, but used only MD5 hashing. It can be download in course website.

Notation:
H(x) = hash of x; pw=password; s=corresponding salt; Ek(x)=encryption of x under key k.

Well, this is the extract of the assignment 2. To read & understand more, please click here.

CSCI368 Assignment 1

The assignment is consists of short questions and testing your knowledge on the topic.

1. For typical public key and symmetric key systems with similar security,
(a) How does the efficiency of encryption compare between the two?
(b) How does the size of output compare between the two?
(c) How does the storage and communication cost of hashing compare with the same factors for symmetric key and public key systems?

2. Using typical systems as in the previous questions, and these notions you have described in the previous question, place each of the following lists in order of expected time of completion, from fastest to slowest...
(a) E'(E(M)), D'(M), E'(H(M), E(M)).
(b) E'(M), H(M), E(M).
(c) E(H(M)), (E(H(M)),E(M)), H(E(M)).
(d) H(E(M,M)), H(E(M),E(M),D(E(M))), H(M,E(M)).

3. Place each of the following lists in order of the size of the resulting output, from smallest to largest.
(a) E(M,(H(M), H(E(M),M), (H(E(M)),H(M)).
(b) E(D(M)), D'(E'(M)), (E(H(M)),M).
(c) H(M,S(M)), H(E(M)), V(M,S(M,M)).
(d) E(M,D(M)), E(M,H(M)), H(E(M), H(M)).

4. For some of the calculations above you should be able to determine the output. Where this is the case, state the output and justify your answer.

5. Describe the encryption scheme ATBASH?

6. Decrypt the following English ATBASH ciphertext. Answer the question in the plaintext and justify your answer.
(a) hslfow xlnkivhhrlm lxxfi yvuliv li zugvi vmxibkgrlm?

7. What is the difference between plaintext and cleartext?

8. State and explain two relevant meanings of the term "lunchtime attack".

9. State three goals for SMTP.

10. Who owns email, the sender, the recipient or both? Who do you think should own email? Explain your answers.

11. What is the principle of least privilege?

12. Consider the "SANS Top 20 Interest Security Vulnerabilities" report for 2007; What are the two primary targets of malicious users? What was the previous typical approach of attackers?

13. Explain what a HERF gun is, and what kind of attack could be used to carry out.

14. What is the relevance of Kerchoff's principle for the design of network security protocols?

15. Describe four distinct reasons why intrusion detection systems might be used?

16. Describe the similarities and differences between the Great Wall of China and a firewall.

17. What is a botnet? Give an example to illustrate how one can be used maliciously.

18. Describe the types and level of security to illustrate how one can be used maliciously.

19. Describe the difference between polymorphic and metamorphic worms.

20. Use a diagram, with appropriate test, to illustrate the distinction between direct and reflector distributed denial of service attacks.

21. State the role of cookies in web communication and describe one security concern assoicated with them.

22. Give a list of VeriSign certificates contained in your browser. For each certificate state the lengh of lifetime and expiry year, allowed uses, the algorithm the key is for, and the key size.

This is the answer link: click here.