Saturday, January 26, 2013

Q1


ANSWERS TO QUESTIONS
1.1 The OSI Security Architecture is a framework that provides a systematic way of defining
the requirements for security and characterizing the approaches to satisfying those
requirements. The document defines security attacks, mechanisms, and services, and the
relationships among these categories.
1.2 Passive attacks have to do with eavesdropping on, or monitoring, transmissions.
Electronic mail, file transfers, and client/server exchanges are examples of
transmissions that can be monitored. Active attacks include the modification of
transmitted data and attempts to gain unauthorized access to computer systems.
1.3 Passive attacks: release of message contents and traffic analysis. Active attacks:
masquerade, replay, modification of messages, and denial of service.
1.4 Authentication: The assurance that the communicating entity is the one that it claims to be.
Access control: The prevention of unauthorized use of a resource (i.e., this service controls
who can have access to a resource, under what conditions access can occur, and what those
accessing the resource are allowed to do).
Data confidentiality: The protection of data from unauthorized disclosure.
Data integrity: The assurance that data received are exactly as sent by an authorized entity
(i.e., contain no modification, insertion, deletion, or replay).
Nonrepudiation: Provides protection against denial by one of the entities involved in a
communication of having participated in all or part of the communication.
Availability service: The property of a system or a system resource being accessible and
usable upon demand by an authorized system entity, according to performance
specifications for the system (i.e., a system is available if it provides services according to
the system design whenever users request them).
1.5 See Table 1.3.
CHAPTER 1
INTRODUCTION
-6-
ANSWERS TO PROBLEMS
1.1 Release
of
message
contents
Traffic
analysis
Masquerade Replay Modification
of messages
Denial
of
service
Peer entity
authentication
Y
Data origin
authentication
Y
Access control Y
Confidentiality Y
Traffic flow
confidentiality
Y
Data integrity Y Y
Non-repudiation Y
Availability Y
1.2 Release
of
message
contents
Traffic
analysis
Masquerade Replay Modification
of messages
Denial
of
service
Encipherment Y
Digital signature Y Y Y
Access control Y Y Y Y Y
Data integrity Y Y
Authentication
exchange
Y Y Y Y
Traffic padding Y
Routing control Y Y Y
Notarization Y Y Y
-7-
ANSWERS TO QUESTIONS
2.1 Plaintext, encryption algorithm, secret key, ciphertext, decryption algorithm.
2.2 Permutation and substitution.
2.3 One secret key.
2.4 A stream cipher is one that encrypts a digital data stream one bit or one byte at a
time. A block cipher is one in which a block of plaintext is treated as a whole and
used to produce a ciphertext block of equal length.
2.5 Cryptanalysis and brute force.
2.6 In some modes, the plaintext does not pass through the encryption function, but is
XORed with the output of the encryption function. The math works out that for
decryption in these cases, the encryption function must also be used.
2.7 With triple encryption, a plaintext block is encrypted by passing it through an
encryption algorithm; the result is then passed through the same encryption
algorithm again; the result of the second encryption is passed through the same
encryption algorithm a third time. Typically, the second stage uses the decryption
algorithm rather than the encryption algorithm.
2.8 There is no cryptographic significance to the use of decryption for the second
stage. Its only advantage is that it allows users of 3DES to decrypt data encrypted
by users of the older single DES by repeating the key.
2.9 With link encryption, each vulnerable communications link is equipped on both
ends with an encryption device. With end-to-end encryption, the encryption
process is carried out at the two end systems. The source host or terminal encrypts
the data; the data in encrypted form are then transmitted unaltered across the
network to the destination terminal or host.
2.10 For two parties A and B, key distribution can be achieved in a number of ways, as
follows:
1. A can select a key and physically deliver it to B.
2. A third party can select the key and physically deliver it to A and B.
3. If A and B have previously and recently used a key, one party can transmit
the new key to the other, encrypted using the old key.
CHAPTER 2
SYMMETRIC ENCRYPTION AND MESSAGE
CONFIDENTIALITY
-8-
4. If A and B each has an encrypted connection to a third party C, C can deliver
a key on the encrypted links to A and B.
2.11 A session key is a temporary encryption key used between two principals. A
master key is a long-lasting key that is used between a key distribution center and
a principal for the purpose of encoding the transmission of session keys. Typically,
the master keys are distributed by noncryptographic means.
2.12 A key distribution center is a system that is authorized to transmit temporary
session keys to principals. Each session key is transmitted in encrypted form, using
a master key that the key distribution center shares with the target principal.
ANSWERS TO PROBLEMS
2.1 To see that the same algorithm with a reversed key order produces the correct
result, consider the figure following this discussion, which shows the encryption
process going down the left-hand side and the decryption process going up the
right-hand side for a 16-round algorithm (the result would be the same for any
number of rounds). For clarity, we use the notation LEi and REi for data traveling
through the encryption algorithm and LDi and RDi for data traveling through the
decryption algorithm. The diagram indicates that, at every round, the intermediate
value of the decryption process is equal to the corresponding value of the
encryption process with the two halves of the value swapped. To put this another
way, let the output of the ith encryption round be LEi||REi (Li concatenated with
Ri). Then the corresponding input to the (16 – i)th decryption round is RDi||LDi.
Let us walk through the figure to demonstrate the validity of the preceding
assertions. To simplify the diagram, it is unwrapped, not showing the swap that
occurs at the end of each iteration. But note that the intermediate result at the end
of the ith stage of the encryption process is the 2w-bit quantity formed by
concatenating LEi and REi, and that the intermediate result at the end of the ith
stage of the decryption process is the 2w-bit quantity formed by concatenating LDi
and RDi. After the last iteration of the encryption process, the two halves of the
output are swapped, so that the ciphertext is RE16||LE16. The output of that round
is the ciphertext. Now take that ciphertext and use it as input to the same algorithm.
The input to the first round is RE16||LE16, which is equal to the 32-bit swap of the
output of the sixteenth round of the encryption process.
Now we would like to show that the output of the first round of the decryption
process is equal to a 32-bit swap of the input to the sixteenth round of the
encryption process. First, consider the encryption process. We see that:
LE16 = RE15
RE16 = LE15 F(RE15, K16)
On the decryption side:
LD1 = RD0 = LE16 = RE15
RD1 = LD0 F(RD0, K16)
= RE16 F(RE15, K16)
-9-
= [LE15 F(RE15,K16)] F(RE15, K16)
The XOR has the following properties:
[A B] C = A [B C]
D D = 0
E 0 = E
Thus, we have LD1 = RE15 and RD1 = LE15. Therefore, the output of the first
round of the decryption process is LE15||RE15, which is the 32-bit swap of the
input to the sixteenth round of the encryption. This correspondence holds all the
way through the 16 iterations, as is easily shown. We can cast this process in
general terms. For the ith iteration of the encryption algorithm:
LEi = REi-1
REi = LEi-1 F(REi-1, Ki)
Rearranging terms:
REi-1 = LEi
LEi-1 = REi F(REi-1, Ki) = REi F(LEi, Ki)
Thus, we have described the inputs to the ith iteration as a function of the
outputs, and these equations confirm the assignments shown in the right-hand side
of the following figure.
Finally, we see that the output of the last round of the decryption process is
RE0||LE0. A 32-bit swap recovers the original plaintext, demonstrating the validity
of the Feistel decryption process.
-10-
Output (ciphertext)
F F
F
F
F
LE0 K1 RE0
LE14 K15 RE14
LE16 RE16
RE16 LE16
RE15 K16 LE15
LD0 = RE16 RD0 = LE16
LD2 = RE14 RD2 = LE14
K16
LD14 = RE2 RD14 = LE2
LD16 = RE0 RD16 = LE0
RD16 = LE0 LD16 = RE0
K2
RD1 = LE15 LD1 = RE15
K15
RD15 = LE1 LD15 = RE1
K1
LE2 RE2
RE1 K2 LE1
Input (plaintext)
Input (ciphertext)
Output (plaintext)
F
F
F
⊕ ⊕
⊕ ⊕
⊕ ⊕
⊕ ⊕
2.2 Use a key of length 255 bytes. The first two bytes are zero; that is K[0] = K[1] = 0.
Thereafter, we have: K[2] = 255; K[3] = 254; … K[255]= 2.
-11-
2.3 a. Simply store i, j, and S, which requires 8 + 8 + (256 × 8) = 2064 bits
b. The number of states is [256! × 2562] 21700. Therefore, 1700 bits are required.
2.4 a. No. For example, suppose C1 is corrupted. The output block P3 depends only
on the input blocks C2 and C3.
b. An error in P1 affects C1. But since C1 is input to the calculation of C2, C2 is
affected. This effect carries through indefinitely, so that all ciphertext blocks are
affected. However, at the receiving end, the decryption algorithm restores the
correct plaintext for blocks except the one in error. You can show this by
writing out the equations for the decryption. Therefore, the error only effects
the corresponding decrypted plaintext block.
2.5 After decryption, the last byte of the last block is used to determine the amount of
padding that must be stripped off. Therefore there must be at least one byte of
padding.
2.6 a. Assume that the last block of plaintext is only L bytes long, where L < 2w/8.
The encryption sequence is as follows (The description in RFC 2040 has an
error; the description here is correct.):
1. Encrypt the first (N – 2) blocks using the traditional CBC technique.
2. XOR PN–1 with the previous ciphertext block CN–2 to create YN–1.
3. Encrypt YN–1 to create EN–1.
4. Select the first L bytes of EN–1 to create CN.
5. Pad PN with zeros at the end and exclusive-OR with EN–1 to create YN.
6. Encrypt YN to create CN–1.
The last two blocks of the ciphertext are CN–1 and CN.
b. PN–1 = CN–2 D(K, [CN || X])
PN || X = (CN || 00…0) D(K, [CN–1])
PN = left-hand portion of (PN || X)
where || is the concatenation function
2.7 a. Assume that the last block (PN) has j bits. After encrypting the last full block
(PN–1), encrypt the ciphertext (CN–1) again, select the leftmost j bits of the
encrypted ciphertext, and XOR that with the short block to generate the output
ciphertext.
b. While an attacker cannot recover the last plaintext block, he can change it
systematically by changing individual bits in the ciphertext. If the last few bits
of the plaintext contain essential information, this is a weakness.
2.8 Nine plaintext characters are affected. The plaintext character corresponding to the
ciphertext character is obviously altered. In addition, the altered ciphertext
character enters the shift register and is not removed until the next eight characters
are processed.
2.9 The central points should be highly fault-tolerant, should be physically secured,
and should use trusted hardware/software.
-12-
2.10 Yes. The eavesdropper is left with two strings, one sent in each direction, and their
XOR is the secret key.
-13-
ANSWERS TO QUESTIONS
3.1 Message encryption, message authentication code, hash function.
3.2 An authenticator that is a cryptographic function of both the data to be
authenticated and a secret key.
3.3 (a) A hash code is computed from the source message, encrypted using symmetric
encryption and a secret key, and appended to the message. At the receiver, the
same hash code is computed. The incoming code is decrypted using the same key
and compared with the computed hash code. (b) This is the same procedure as in
(a) except that public-key encryption is used; the sender encrypts the hash code
with the sender's private key, and the receiver decrypts the hash code with the
sender's public key. (c) A secret value is appended to a message and then a hash
code is calculated using the message plus secret value as input. Then the message
(without the secret value) and the hash code are transmitted. The receiver appends
the same secret value to the message and computes the hash value over the
message plus secret value. This is then compared to the received hash code.
3.4 1. H can be applied to a block of data of any size.
2. H produces a fixed-length output.
3. H(x) is relatively easy to compute for any given x, making both hardware and
software implementations practical.
4. For any given value h, it is computationally infeasible to find x such that H(x)
= h. This is sometimes referred to in the literature as the one-way property.
5. For any given block x, it is computationally infeasible to find y x with H(y) =
H(x).
6. It is computationally infeasible to find any pair (x, y) such that H(x) = H(y).
3.5 The compression function is the fundamental module, or basic building block, of a
hash function. The hash function consists of iterated application of the
compression function.
3.6 Plaintext: This is the readable message or data that is fed into the algorithm as
input. Encryption algorithm: The encryption algorithm performs various
transformations on the plaintext. Public and private keys: This is a pair of keys
that have been selected so that if one is used for encryption, the other is used for
decryption. The exact transformations performed by the encryption algorithm
depend on the public or private key that is provided as input. Ciphertext: This is
the scrambled message produced as output. It depends on the plaintext and the
key. For a given message, two different keys will produce two different
CHAPTER 3
PUBLIC-KEY CRYPTOGRAPHY AND MESSAGE
AUTHENTICATION
-14-
ciphertexts. Decryption algorithm: This algorithm accepts the ciphertext and the
matching key and produces the original plaintext.
3.7 Encryption/decryption: The sender encrypts a message with the recipient's public
key. Digital signature: The sender "signs" a message with its private key. Signing
is achieved by a cryptographic algorithm applied to the message or to a small
block of data that is a function of the message. Key exchange: Two sides cooperate
to exchange a session key. Several different approaches are possible, involving the
private key(s) of one or both parties.
3.8 The key used in conventional encryption is typically referred to as a secret key.
The two keys used for public-key encryption are referred to as the public key and
the private key.
3.9 A digital signature is an authentication mechanism that enables the creator of a
message to attach a code that acts as a signature. The signature is formed by taking
the hash of the message and encrypting the message with the creator's private key.
The signature guarantees the source and integrity of the message.
3.10 A pubic-key certificate consists of a public key plus a User ID of the key owner,
with the whole block signed by a trusted third party. Typically, the third party is a
certificate authority (CA) that is trusted by the user community, such as a
government agency or a financial institution.
3.11 Several different approaches are possible, involving the private key(s) of one or
both parties. One approach is Diffie-Hellman key exchange. Another approach is
for the sender to encrypt a secret key with the recipient's public key.
ANSWERS TO PROBLEMS
3.1 The CBC mode with an IV of 0 and plaintext blocks D1, D2, . . ., Dn and 64-bit CFB
mode with IV = D1 and plaintext blocks D2, D3, . . ., Dn yield the same result.
3.2 a. Yes. The XOR function is simply a vertical parity check. If there is an odd
number of errors, then there must be at least one column that contains an odd
number of errors, and the parity bit for that column will detect the error. Note
that the RXOR function also catches all errors caused by an odd number of
error bits. Each RXOR bit is a function of a unique "spiral" of bits in the block of
data. If there is an odd number of errors, then there must be at least one spiral
that contains an odd number of errors, and the parity bit for that spiral will
detect the error.
b. No. The checksum will fail to detect an even number of errors when both the
XOR and RXOR functions fail. In order for both to fail, the pattern of error bits
must be at intersection points between parity spirals and parity columns such
that there is an even number of error bits in each parity column and an even
number of error bits in each spiral.
c. It is too simple to be used as a secure hash function; finding multiple messages
with the same hash function would be too easy.
-15-
3.3 The statement is false. Such a function cannot be one-to-one because the number of inputs
to the function is of arbitrary, but the number of unique outputs is 2n. Thus, there are
multiple inputs that map into the same output.
3.4 a. It satisfies properties 1 through 3 but not the remaining properties. For
example, for property 4, a message consisting of the value h satisfies H(h) = h.
For property 5, take any message M and add the decimal digit 0 to the
sequence; it will have the same hash value.
b. It satisfies properties 1 through 3. Property 4 is also satisfied if n is a large
composite number, because taking square roots modulo such an integer n is
considered to be infeasible. Properties 5 and 6 are not satisfied because –M will
have the same value as M.
c. 955
3.5 a. Overall structure:
N × 16 letters
M1 M2 MN
IV = F
0000
H1
F
• • •
• • •
Message
H2
16
HN =
hash
code
16
F
16
16 letters 16 letters 16 letters
Padding
4
Compression function F:
-16-
Mi Hi–1
Column-wise mod 26 addition
Column-wise mod 26 addition
row-wise
rotations
Hi
b. BFQG
c. Simple algebra is all you need to generate a result:
AYHGDAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAA
3.6 If you examine the structure of a single round of DES, you see that the round
includes a one-way function, F, and an XOR:
Ri = Li-1 F(Ri-1, Ki)
For DES, the function F is depicted in Figure 2.4. It maps a 32-bit R and a 48-bit K
into a 32-bit output. That is, it maps an 80-bit input into a 32-bit output. This is
clearly a one-way function. Any hash function that produces a 32-bit output could
be used for F. The demonstration in the text that decryption works is still valid for
any one-way function F.
3.7
a.
M3 =
5 2 1 4 5
1 4 3 2 2
3 1 2 5 3
4 3 4 1 4
2 5 5 3 1
b. Assume a plaintext message p is to be encrypted by Alice and sent to Bob. Bob
makes use of M1 and M3, and Alice makes use of M2. Bob chooses a random
number, k, as his private key, and maps k by M1 to get x, which he sends as his
public key to Alice. Alice uses x to encrypt p with M2 to get z, the ciphertext,
which she sends to Bob. Bob uses k to decrypt z by means of M3, yielding the
plaintext message p.
-17-
c. If the numbers are large enough, and M1 and M2 are sufficiently random to
make it impractical to work backwards, p cannot be found without knowing k.
3.8 a. n = 33; ö(n) = 20; d = 3; C = 26.
b. n = 55; ö(n) = 40; d = 27; C = 14.
c. n = 77; ö(n) = 60; d = 53; C = 57.
d. n = 143; ö(n) = 120; d = 11; C = 106.
e. n = 527; ö(n) = 480; d = 343; C = 128. For decryption, we have
128343 mod 527 = 128256 × 12864 × 12816 × 1284 × 1282 × 1281 mod 527
= 35 × 256 × 35 × 101 × 47 × 128 = 2 mod 527
= 2 mod 257
3.9 M = 5
3.10 d = 3031
3.11 Yes. If a plaintext block has a common factor with n modulo n then the encoded
block will also have a common factor with n modulo n. Because we encode
blocks that are smaller than pq, the factor must be p or q and the plaintext block
must be a multiple of p or q. We can test each block for primality. If prime, it is p
or q. In this case we divide into n to find the other factor. If not prime, we factor
it and try the factors as divisors of n.
3.12 Refer to Figure 3.8 The private key k is the pair {d, n}; the public key x is the pair
{e, n}; the plaintext p is M; and the ciphertext z is C. M1 is formed by calculating
d = e–1 mod ö(n). M2 consists of raising M to the power e (mod n). M2 consists of
raising C to the power d (mod n).
3.13 Yes.
3.14 The opponent has the two-block message B1, B2 and its hash RSAH(B1, B2). The
following attack will work. Choose an arbitrary C1 and choose C2 such that:
C2 = RSA(C1) RSA(B1) B2
then
RSA(C1) C2 = RSA(C1) RSA(C1) RSA(B1) B2
= RSA(B1) B2
so RSAH(C1, C2) = RSA[RSA(C1) C2)] = RSA[RSA(B1) B2]
= RSAH(B1, B2)
3.15 Consider a set of alphabetic characters {A, B, …, Z}. The corresponding integers,
representing the position of each alphabetic character in the alphabet, form a set
of message block values SM = {0, 1, 2, …, 25}. The set of corresponding ciphertext
block values SC = {0e mod N, 1e mod N, …, 25e mod N}, and can be computed by
everybody with the knowledge of the public key of Bob.
Thus, the most efficient attack against the scheme described in the
problem is to compute Me mod N for all possible values of M, then create a lookup
table with a ciphertext as an index, and the corresponding plaintext as a value
of the appropriate location in the table.
-18-
3.16 a. XA = 6
b. K = 3
-19-
ANSWERS TO QUESTIONS
4.1 The problem that Kerberos addresses is this: Assume an open distributed
environment in which users at workstations wish to access services on servers
distributed throughout the network. We would like for servers to be able to
restrict access to authorized users and to be able to authenticate requests for
service. In this environment, a workstation cannot be trusted to identify its users
correctly to network services.
4.2 1. A user may gain access to a particular workstation and pretend to be another
user operating from that workstation. 2. A user may alter the network address of
a workstation so that the requests sent from the altered workstation appear to
come from the impersonated workstation. 3. A user may eavesdrop on exchanges
and use a replay attack to gain entrance to a server or to disrupt operations.
4.3 1. Rely on each individual client workstation to assure the identity of its user or
users and rely on each server to enforce a security policy based on user
identification (ID). 2. Require that client systems authenticate themselves to
servers, but trust the client system concerning the identity of its user. 3. Require
the user to prove identity for each service invoked. Also require that servers
prove their identity to clients.
4.4 Secure: A network eavesdropper should not be able to obtain the necessary
information to impersonate a user. More generally, Kerberos should be strong
enough that a potential opponent does not find it to be the weak link. Reliable:
For all services that rely on Kerberos for access control, lack of availability of the
Kerberos service means lack of availability of the supported services. Hence,
Kerberos should be highly reliable and should employ a distributed server
architecture, with one system able to back up another. Transparent: Ideally, the
user should not be aware that authentication is taking place, beyond the
requirement to enter a password. Scalable: The system should be capable of
supporting large numbers of clients and servers. This suggests a modular,
distributed architecture.
4.5 A full-service Kerberos environment consists of a Kerberos server, a number of
clients, and a number of application servers.
4.6 A realm is an environment in which: 1. The Kerberos server must have the user ID
(UID) and hashed password of all participating users in its database. All users are
registered with the Kerberos server. 2. The Kerberos server must share a secret
key with each server. All servers are registered with the Kerberos server.
4.7 Version 5 overcomes some environmental shortcomings and some technical
deficiencies in Version 4.
CHAPTER 4
AUTHENTICATION APPLICATIONS
-20-
4.8 X.509 defines a framework for the provision of authentication services by the
X.500 directory to its users. The directory may serve as a repository of public-key
certificates. Each certificate contains the public key of a user and is signed with
the private key of a trusted certification authority. In addition, X.509 defines
alternative authentication protocols based on the use of public-key certificates.
4.9 A chain of certificates consists of a sequence of certificates created by different
certification authorities (CAs) in which each successive certificate is a certificate
by one CA that certifies the public key of the next CA in the chain.
4.10 The owner of a public-key can issue a certificate revocation list that revokes one
or more certificates.
ANSWERS TO PROBLEMS
4.1 An error in C1 affects P1 because the encryption of C1 is XORed with IV to produce
P1. Both C1 and P1 affect P2, which is the XOR of the encryption of C2 with the
XOR of C1 and P1. Beyond that, PN–1 is one of the XORed inputs to forming PN.
4.2 Let us consider the case of the interchange of C1 and C2. The argument will be the
same for any other adjacent pair of ciphertext blocks. First, if C1 and C2 arrive in
the proper order:
P1 = E[K, C1] IV
P2 = E[K, C2] C1 P1 = E[K, C2] C1 E[K, C1] IV
P3 = E[K, C3] C2 P2 = E[K, C3] C2 E[K, C2] C1 E[K, C1] IV
Now suppose that C1 and C2 arrive in the reverse order. Let us refer to the
decrypted blocks as Qi.
Q1 = E[K, C2] IV
Q2 = E[K, C1] C2 Q1 = E[K, C1] C2 E[K, C2] IV
Q3 = E[K, C3] C1 Q2 = E[K, C3] C1 E[K, C1] C2 E[K, C2] IV
The result is that Q1 ≠ P1; Q2 ≠ P2; but Q3 = P3. Subsequent blocks are clearly
unaffected.
4.3 The problem has a simple fix, namely the inclusion of the name of B in the signed
information for the third message, so that the third message now reads:
A B: A {rB, B}
4.4 Taking the eth root mod n of a ciphertext block will always reveal the plaintext, no
matter what the values of e and n are. In general this is a very difficult problem,
and indeed is the reason why RSA is secure. The point is that, if e is too small, then
taking the normal integer eth root will be the same as taking the eth root mod n,
and taking integer eth roots is relatively easy.
-21-
ANSWERS TO QUESTIONS
5.1 Authentication, confidentiality, compression, e-mail compatibility, and
segmentation
5.2 A detached signature is useful in several contexts. A user may wish to maintain a
separate signature log of all messages sent or received. A detached signature of an
executable program can detect subsequent virus infection. Finally, detached
signatures can be used when more than one party must sign a document, such as
a legal contract. Each person's signature is independent and therefore is applied
only to the document. Otherwise, signatures would have to be nested, with the
second signer signing both the document and the first signature, and so on.
5.3 a. It is preferable to sign an uncompressed message so that one can store only the
uncompressed message together with the signature for future verification. If one
signed a compressed document, then it would be necessary either to store a
compressed version of the message for later verification or to recompress the
message when verification is required. b. Even if one were willing to generate
dynamically a recompressed message for verification, PGP's compression
algorithm presents a difficulty. The algorithm is not deterministic; various
implementations of the algorithm achieve different tradeoffs in running speed
versus compression ratio and, as a result, produce different compressed forms.
However, these different compression algorithms are interoperable because any
version of the algorithm can correctly decompress the output of any other version.
Applying the hash function and signature after compression would constrain all
PGP implementations to the same version of the compression algorithm.
5.4 R64 converts a raw 8-bit binary stream to a stream of printable ASCII characters.
Each group of three octets of binary data is mapped into four ASCII characters.
5.5 When PGP is used, at least part of the block to be transmitted is encrypted. If only
the signature service is used, then the message digest is encrypted (with the
sender's private key). If the confidentiality service is used, the message plus
signature (if present) are encrypted (with a one-time symmetric key). Thus, part
or all of the resulting block consists of a stream of arbitrary 8-bit octets. However,
many electronic mail systems only permit the use of blocks consisting of ASCII
text.
5.6 E-mail facilities often are restricted to a maximum message length.
5.7 PGP includes a facility for assigning a level of trust to individual signers and to
keys.
5.8 RFC 822 defines a format for text messages that are sent using electronic mail.
CHAPTER 5
ELECTRONIC MAIL SECURITY
-22-
5.9 MIME is an extension to the RFC 822 framework that is intended to address some
of the problems and limitations of the use of SMTP (Simple Mail Transfer
Protocol) or some other mail transfer protocol and RFC 822 for electronic mail.
5.10 S/MIME (Secure/Multipurpose Internet Mail Extension) is a security
enhancement to the MIME Internet e-mail format standard, based on technology
from RSA Data Security.
ANSWERS TO PROBLEMS
5.1 CFB avoids the need to add and strip padding.
5.2 This is just another form of the birthday paradox discussed in Appendix 11A. Let
us state the problem as one of determining what number of session keys must be
generated so that the probability of a duplicate is greater than 0.5. From Equation
(11.6) in Appendix 11A, we have the approximation:
k =1.18 × n
For a 128-bit key, there are 2128 possible keys. Therefore
k =1.18 × 2128 =1.18 × 264
5.3 Again, we are dealing with a birthday-paradox phenomenon. We need to
calculate the value for:
P(n, k) = Pr [at least one duplicate in k items, with each item able to take on
one of n equally likely values between 1 and n]
In this case, k = N and n = 264. Using equation (11.5) of Appendix 1A:
P(26 4 ,N) = 1264!
(26 4 N)!264× k
> 1e[N ×(N 1]
26 5
5.4 a. Not at all. The message digest is encrypted with the sender's private key.
Therefore, anyone in possession of the public key can decrypt it and recover
the entire message digest.
b. The probability that a message digest decrypted with the wrong key would
have an exact match in the first 16 bits with the original message digest is
2–16.
5.5 We trust this owner, but that does not necessarily mean that we can trust that we
are in possession of that owner's public key.
5.6 It certainly provides more security than a monoalphabetic substitution. Because
we are treating the plaintext as a string of bits and encrypting 6 bits at a time, we
-23-
are not encrypting individual characters. Therefore, the frequency information is
lost, or at least significantly obscured.
5.7 DES is unsuitable because of its short key size. Two-key triple DES, which has a
key length of 112 bits, is suitable. AES is also suitable.
-24-
ANSWERS TO QUESTIONS
6.1 Secure branch office connectivity over the Internet: A company can build a
secure virtual private network over the Internet or over a public WAN. This
enables a business to rely heavily on the Internet and reduce its need for private
networks, saving costs and network management overhead. Secure remote access
over the Internet: An end user whose system is equipped with IP security
protocols can make a local call to an Internet service provider (ISP) and gain
secure access to a company network. This reduces the cost of toll charges for
traveling employees and telecommuters. Establishing extranet and intranet
connectivity with partners: IPSec can be used to secure communication with
other organizations, ensuring authentication and confidentiality and providing a
key exchange mechanism. Enhancing electronic commerce security: Even though
some Web and electronic commerce applications have built-in security protocols,
the use of IPSec enhances that security.
6.2 Access control; connectionless integrity; data origin authentication; rejection of
replayed packets (a form of partial sequence integrity); confidentiality
(encryption); and limited traffic flow confidentiality
6.3 A security association is uniquely identified by three parameters: Security
Parameters Index (SPI): A bit string assigned to this SA and having local
significance only. The SPI is carried in AH and ESP headers to enable the
receiving system to select the SA under which a received packet will be processed.
IP Destination Address: Currently, only unicast addresses are allowed; this is the
address of the destination endpoint of the SA, which may be an end user system
or a network system such as a firewall or router. Security Protocol Identifier:
This indicates whether the association is an AH or ESP security association.
A security association is normally defined by the following parameters:
Sequence Number Counter: A 32-bit value used to generate the Sequence
Number field in AH or ESP headers, described in Section 6.3 (required for all
implementations). Sequence Counter Overflow: A flag indicating whether
overflow of the Sequence Number Counter should generate an auditable event
and prevent further transmission of packets on this SA (required for all
implementations). Anti-Replay Window: Used to determine whether an inbound
AH or ESP packet is a replay, described in Section 6.3 (required for all
implementations). AH Information: Authentication algorithm, keys, key
lifetimes, and related parameters being used with AH (required for AH
implementations). ESP Information: Encryption and authentication algorithm,
keys, initialization values, key lifetimes, and related parameters being used with
ESP (required for ESP implementations). Lifetime of this Security Association: A
time interval or byte count after which an SA must be replaced with a new SA
(and new SPI) or terminated, plus an indication of which of these actions should
occur (required for all implementations). IPSec Protocol Mode: Tunnel, transport,
or wildcard (required for all implementations). These modes are discussed later in
CHAPTER 6
IP SECURITY
-25-
this section. Path MTU: Any observed path maximum transmission unit
(maximum size of a packet that can be transmitted without fragmentation) and
aging variables (required for all implementations).
6.4 Transport mode provides protection primarily for upper-layer protocols. That is,
transport mode protection extends to the payload of an IP packet. Tunnel mode
provides protection to the entire IP packet.
6.5 A replay attack is one in which an attacker obtains a copy of an authenticated
packet and later transmits it to the intended destination. The receipt of duplicate,
authenticated IP packets may disrupt service in some way or may have some
other undesired consequence.
6.6 1. If an encryption algorithm requires the plaintext to be a multiple of some
number of bytes (e.g., the multiple of a single block for a block cipher), the
Padding field is used to expand the plaintext (consisting of the Payload Data,
Padding, Pad Length, and Next Header fields) to the required length. 2. The ESP
format requires that the Pad Length and Next Header fields be right aligned
within a 32-bit word. Equivalently, the ciphertext must be an integer multiple of
32 bits. The Padding field is used to assure this alignment. 3. Additional padding
may be added to provide partial traffic flow confidentiality by concealing the
actual length of the payload.
6.7 Transport adjacency: Refers to applying more than one security protocol to the
same IP packet, without invoking tunneling. This approach to combining AH and
ESP allows for only one level of combination; further nesting yields no added
benefit since the processing is performed at one IPSec instance: the (ultimate)
destination. Iterated tunneling: Refers to the application of multiple layers of
security protocols effected through IP tunneling. This approach allows for
multiple levels of nesting, since each tunnel can originate or terminate at a
different IPSec site along the path.
6.8 ISAKMP by itself does not dictate a specific key exchange algorithm; rather,
ISAKMP consists of a set of message types that enable the use of a variety of key
exchange algorithms. Oakley is the specific key exchange algorithm mandated for
use with the initial version of ISAKMP.
ANSWERS TO PROBLEMS
6.1 a. Immutable: Version, Internet Header Length, Total Length, Identification,
Protocol (This should be the value for AH.), Source Address, Destination
Address (without loose or strict source routing). None of these are changed by
routers in transit.
Mutable but predictable: Destination Address (with loose or strict source
routing). At each intermediate router designated in the source routing list, the
Destination Address field is changed to indicate the next designated address.
However, the source routing field contains the information needed for doing
the MAC calculation.
Mutable (zeroed prior to ICV calculation): Type of Service (TOS), Flags,
Fragment Offset, Time to Live (TTL), Header Checksum. TOS may be altered
by a router to reflect a reduced service. Flags and Fragment offset are altered if
-26-
an router performs fragmentation. TTL is decreased at each router. The Header
Checksum changes if any of these other fields change.
b. Immutable: Version, Payload Length, Next Header (This should be the value
for AH.), Source Address, Destination Address (without Routing Extension
Header)
Mutable but predictable: Destination Address (with Routing Extension
Header)
Mutable (zeroed prior to ICV calculation): Class, Flow Label, Hop Limit
c. IPv6 options in the Hop-by-Hop and Destination Extension Headers contain a
bit that indicates whether the option might change (unpredictably) during
transit.
Mutable but predictable: Routing
Not Applicable: Fragmentation occurs after outbound IPSec processing and
reassembly occur before inbound IPSec processing , so the Fragmentation
Extension Header, if it exists, is not seen by IPSec.
6.2 From RFC 2401
IPv4 Header Fields Outer Header at
Encapsulator
Inner Header at
Decapsulator
version 4 (1) no change
header length constructed no change
TOS copied from inner header
(5)
no change
total length constructed no change
ID constructed no change
Flags constructed, DF (4) no change
Fragment offset constructed no change
TTL constructed decrement (2)
protocol AH, ESP, routing header no change
checksum constructed no change
source address constructed (3) no change
destination address constructed (3) no change
options never copied no change
IPv6 Header Fields Outer Header at
Encapsulator
Inner Header at
Decapsulator
version 6 (1) no change
class copied or configured (6) no change
flow id copied or configured no change
length constructed no change
next header AH, ESP, routing header no change
hop count constructed (2) decrement (2)
source address constructed (3) no change
dest address constructed (3) no change
extension headers never copied no change
1. The IP version in the encapsulating header can be different from the value in
the inner header.
-27-
2. The TTL in the inner header is decremented by the encapsulator prior to
forwarding and by the decapsulator if it forwards the packet.
3. src and dest addresses depend on the SA, which is used to determine the dest
address, which in turn determines which src address (net interface) is used to
forward the packet.
4. configuration determines whether to copy from the inner header (IPv4 only),
clear or set the DF.
5. If Inner Hdr is IPv4, copy the TOS. If Inner Hdr is IPv6, map the Class to TOS.
6. If Inner Hdr is IPv6, copy the Class. If Inner Hdr IPv4, map the TOS to Class.
6.3 We show the results for IPv4; IPv6 is similar.
6.4 This order of processing facilitates rapid detection and rejection of replayed or
bogus packets by the receiver, prior to decrypting the packet, hence potentially
reducing the impact of denial of service attacks. It also allows for the possibility
of parallel processing of packets at the receiver, i.e., decryption can take place in
parallel with authentication.
6.5 a. The Aggressive Exchange type.
b. (CKYI, CKYR) HDR
(OK_KEYX) HDR
(GRP) P
gx, gy) KE
(EHAO, EHAS) T
(NIDP) HDR
(IDI, IDR) ID
(NI, NR) NONCE
(SKI[X], SKR[X]) SIG
-28-
ANSWERS TO QUESTIONS
7.1 The advantage of using IPSec (Figure 7.1a) is that it is transparent to end users
and applications and provides a general-purpose solution. Further, IPSec includes
a filtering capability so that only selected traffic need incur the overhead of IPSec
processing. The advantage of using SSL is that it makes use of the reliability and
flow control mechanisms of TCP. The advantage application-specific security
services (Figure 7.1c) is that the service can be tailored to the specific needs of a
given application.
7.2 SSL handshake protocol; SSL change cipher spec protocol; SSL alert protocol; SSL
record protocol.
7.3 Connection: A connection is a transport (in the OSI layering model definition)
that provides a suitable type of service. For SSL, such connections are peer-to-peer
relationships. The connections are transient. Every connection is associated with
one session. Session: An SSL session is an association between a client and a
server. Sessions are created by the Handshake Protocol. Sessions define a set of
cryptographic security parameters, which can be shared among multiple
connections. Sessions are used to avoid the expensive negotiation of new security
parameters for each connection.
7.4 Session identifier: An arbitrary byte sequence chosen by the server to identify an
active or resumable session state. Peer certificate: An X509.v3 certificate of the
peer. Compression method: The algorithm used to compress data prior to
encryption. Cipher spec: Specifies the bulk data encryption algorithm (such as
null, DES, etc.) and a hash algorithm (such as MD5 or SHA-1) used for MAC
calculation. It also defines cryptographic attributes such as the hash_size. Master
secret: 48-byte secret shared between the client and server. Is resumable: A flag
indicating whether the session can be used to initiate new connections.
7.5 Server and client random: Byte sequences that are chosen by the server and client
for each connection. Server write MAC secret: The secret key used in MAC
operations on data sent by the server. Client write MAC secret: The secret key
used in MAC operations on data sent by the client. Server write key: The
conventional encryption key for data encrypted by the server and decrypted by
the client. Client write key: The conventional encryption key for data encrypted
by the client and decrypted by the server. Initialization vectors: When a block
cipher in CBC mode is used, an initialization vector (IV) is maintained for each
key. This field is first initialized by the SSL Handshake Protocol. Thereafter the
final ciphertext block from each record is preserved for use as the IV with the
following record. Sequence numbers: Each party maintains separate sequence
numbers for transmitted and received messages for each connection. When a
party sends or receives a change cipher spec message, the appropriate sequence
number is set to zero. Sequence numbers may not exceed 264 – 1.
CHAPTER 7
WEB SECURITY
-29-
7.6 Confidentiality: The Handshake Protocol defines a shared secret key that is used
for conventional encryption of SSL payloads. Message Integrity: The Handshake
Protocol also defines a shared secret key that is used to form a message
authentication code (MAC).
7.7 Fragmentation; compression; add MAC; encrypt; append SSL record header.
7.8 Cardholder: In the electronic environment, consumers and corporate purchasers
interact with merchants from personal computers over the Internet. A cardholder
is an authorized holder of a payment card (e.g., MasterCard, Visa) that has been
issued by an issuer. Merchant: A merchant is a person or organization that has
goods or services to sell to the cardholder. Typically, these goods and services are
offered via a Web site or by electronic mail. A merchant that accepts payment
cards must have a relationship with an acquirer. Issuer: This is a financial
institution, such as a bank, that provides the cardholder with the payment card.
Typically, accounts are applied for and opened by mail or in person. Ultimately, it
is the issuer that is responsible for the payment of the debt of the cardholder.
Acquirer: This is a financial institution that establishes an account with a
merchant and processes payment card authorizations and payments. Merchants
will usually accept more than one credit card brand but do not want to deal with
multiple bankcard associations or with multiple individual issuers. The acquirer
provides authorization to the merchant that a given card account is active and
that the proposed purchase does not exceed the credit limit. The acquirer also
provides electronic transfer of payments to the merchant's account. Subsequently,
the acquirer is reimbursed by the issuer over some sort of payment network for
electronic funds transfer. Payment gateway: This is a function operated by the
acquirer or a designated third party that processes merchant payment messages.
The payment gateway interfaces between SET and the existing bankcard payment
networks for authorization and payment functions. The merchant exchanges SET
messages with the payment gateway over the Internet, while the payment
gateway has some direct or network connection to the acquirer's financial
processing system. Certification authority (CA): This is an entity that is trusted to
issue X.509v3 public-key certificates for cardholders, merchants, and payment
gateways. The success of SET will depend on the existence of a CA infrastructure
available for this purpose. As was discussed in previous chapters, a hierarchy of
CAs is used, so that participants need not be directly certified by a root authority.
7.9 A dual signature is used to sign two concatenated documents each with its own
hash code. The purpose of the dual signature is to link two messages that are
intended for two different recipients. In this case, the customer want to send the
order information (OI) to the merchant and the payment information (PI) to the
bank. The merchant does not need to know the customer's credit card number,
and the bank does not need to know the details of the customer's order.
ANSWERS TO PROBLEMS
7.1 The change cipher spec protocol exists to signal transitions in ciphering strategies,
and can be sent independent of the complete handshake protocol exchange.
-30-
7.2 a. Brute Force Cryptanalytic Attack: The conventional encryption algorithms
use key lengths ranging from 40 to 168 bits.
b. Known Plaintext Dictionary Attack: SSL protects against this attack by not
really using a 40-bit key, but an effective key of 128 bits. The rest of the key is
constructed from data that is disclosed in the Hello messages. As a result the
dictionary must be long enough to accommodate 2128 entries.
c. Replay Attack: This is prevented by the use of nonces.
d. Man-in-the-Middle Attack: This is prevented by the use of pubic-key
certificates to authenticate the correspondents.
e. Password Sniffing: User data is encrypted.
f. IP Spoofing: The spoofer must be in possession of the secret key as well as the
forged IP address.
g. IP Hijacking: Again, encryption protects against this attack.
h. SYN Flooding: SSL provides no protection against this attack.
7.3 SSL relies on an underlying reliable protocol to assure that bytes are not lost or
inserted. There was some discussion of reengineering the future TLS protocol to
work over datagram protocols such as UDP, however, most people at a recent
TLS meeting felt that this was inappropriate layering (from the SSL FAQ).
-31-
ANSWERS TO QUESTIONS
8.1 1. A single operator interface with a powerful but user-friendly set of commands
for performing most or all network management tasks. 2. A minimal amount of
separate equipment. That is, most of the hardware and software required for
network management is incorporated into the existing user equipment.
8.2 Management station, management agent, management information base, network
management protocol.
8.3 To manage resources in the network, each resource is represented as an object. An
object is, essentially, a data variable that represents one aspect of the managed
agent. The collection of objects is referred to as a management information base
(MIB).
8.4 Get: enables the management station to retrieve the value of objects at the agent.
Set: enables the management station to set the value of objects at the agent.
Notify: enables an agent to notify the management station of significant events.
8.5 To accommodate devices that do not implement SNMP, the concept of proxy was
developed. In this scheme an SNMP agent acts as a proxy for one or more other
devices; that is, the SNMP agent acts on behalf of the proxied devices.
8.6 An SNMP community is a relationship between an SNMP agent and a set of SNMP
managers that defines authentication, access control, and proxy characteristics. The
community concept is a local one, defined at the agent. The agent establishes one
community for each desired combination of authentication, access control, and
proxy characteristics. Each community is given a unique (within this agent)
community name, and the managers within that community are provided with and
must employ the community name in all get and set operations. The agent may
establish a number of communities, with overlapping manager membership.
8.7 SNMPv1 is the original standard version of SNMP. SNMPv2 added functional
capabilities to those of SNMPv1 and changed some formats. SNMPv3 is a security
facility that can work with either SNMPv1 or SNMPv2.
8.8 Modification of information: An entity could alter an in-transit message generated
by an authorized entity in such a way as to cause unauthorized management
operations, including the setting of object values. The essence of this threat is that
an unauthorized entity could change any management parameter, including those
related to configuration, operations, and accounting. Masquerade: Management
operations that are not authorized for some entity may be attempted by that entity
by assuming the identity of an authorized entity. Message stream modification:
SNMP is designed to operate over a connectionless transport protocol. There is a
threat that SNMP messages could be reordered, delayed, or replayed (duplicated)
CHAPTER 8
NETWORK MANAGEMENT SECURITY
-32-
to cause unauthorized management operations. Disclosure: An entity could
observe exchanges between a manager and an agent and thereby learn the values of
managed objects and learn of notifiable events.
8.9 In any message transmission, one of the two entities, transmitter or receiver, is
designated as the authoritative SNMP engine, according to the following rules:
1. When an SNMP message contains a payload that expects a response (for
example, a Get, GetNext, GetBulk, Set, or Inform PDU), then the receiver of such
messages is authoritative. 2. When an SNMP message contains a payload that does
not expect a response (for example, an SNMPv2-Trap, Response, or Report PDU),
then the sender of such a message is authoritative.
8.10 A localized key is defined in RFC 2574 as a secret key shared between a user and
one authoritative SNMP engine. The objective is that the user need only maintain a
single key (or two keys if both authentication and privacy are required) and
therefore need only remember one password (or two). The actual secrets shared
between a particular user and each authoritative SNMP engine are different. The
process by which a single user key is converted into multiple unique keys, one for
each remote SNMP engine, is referred to as key localization.
8.11 Group: a set of zero or more tuples on whose
behalf SNMP management objects can be accessed. Security level: Determines
access rights for a group. For example, an agent may allow read-only access for a
request communicated in an unauthenticated message but may require
authentication for write access. Context: a named subset of the object instances in
the local MIB. Contexts provide a useful way of aggregating objects into collections
with different access policies. MIB view: a specific set of managed objects (and
optionally specific object instances). Access policy: a particular set of access rights.
ANSWERS TO PROBLEMS
8.1 a. The value of a Gauge has its maximum value whenever the information being
modeled is greater than or equal to that maximum value; if the information
being modeled subsequently decreases below the maximum value, the Gauge
remains at the maximum value. The gauge can only be released from this
maximum value by subsequent management action.
b. The SNMPv2 interpretation provides a realistic representation of the underlying
value at all times, subject to the limitation of the gauge. However, a manager
may want to know that some maximum value has been reached or exceeded. By
"sticking" the gauge at its maximum value until it is noticed and released by a
manager, this information is preserved.
-33-
8.2
MIB Access SNMP Access Mode
Category READ-ONLY READ-WRITE
read-only Available for Get and Trap
operations —
read-write Available for Get and Trap
operations
Available for Get, Set, and
Trap operations
write-only
Available for Get and Trap
Operations, but the value is
implementation-specific.
Available for Get, Set, and Trap
Operations, but the value is
implementation-specific for
Get and Set.
not-accessible Unavailable
8.3 a. This restriction makes sense because the authoritative receiver will only check
those fields if the message is to be authenticated.
b. Keep in mind that in the case of the authoritative sender, these values represent
the "official" local values of snmpEngineBoots and snmpEngineTime. When the
Response message is received by the non-authorititave engine, it may only use
these values for synchronization if the message is authenticated. However, an
implementation might perhaps use these values for a "reality check" even on
non-authenticated Response messages.
8.4 If we had done the time window check first, we would have declared the message
untimely because MAET < (SET – 150). That doesn't seem good, but that is what the
RFC says.
8.5 In the example just given, the authoritative SNMP engine is more than 150 seconds
behind the non-authoritative engine (because msgAuthoritativeEngineTime <
(snmpEngineTime – 150)) but time synchronization occurs (because
latestReceivedEngineTime < msgAuthoritativeEngineTime).
8.6 The first method is straightforward but has the drawback that it requires the use of
encryption even in systems that support only message authentication. A related
drawback is that export restrictions from the United States and possibly other
countries could complicate the use of an encryption-based approach.
8.7 Note that the value protocolKeyChange is just the concatenation of random and
delta. So the receiver can compute:
digest = Hash(keyOld || random)
keyNew = digest delta
8.8 (1) The one-way function puts an impenetrable barrier between the old and new
keys, so that if the new key is discovered, it is still infeasible to recover the older
key. (2) Deducing relationship between the bits of the old and new keys is
intractable in both directions (forward and backward), so that the cryptanalyst
only has the traffic protected by a given key to use in attempting to determine that
key.
-34-
ANSWERS TO QUESTIONS
9.1 Masquerader: An individual who is not authorized to use the computer and who
penetrates a system's access controls to exploit a legitimate user's account.
Misfeasor: A legitimate user who accesses data, programs, or resources for which
such access is not authorized, or who is authorized for such access but misuses his
or her privileges. Clandestine user: An individual who seizes supervisory control
of the system and uses this control to evade auditing and access controls or to
suppress audit collection.
9.2 One-way encryption: The system stores only an encrypted form of the user's
password. When the user presents a password, the system encrypts that
password and compares it with the stored value. In practice, the system usually
performs a one-way transformation (not reversible) in which the password is
used to generate a key for the encryption function and in which a fixed-length
output is produced. Access control: Access to the password file is limited to one
or a very few accounts.
9.3 1. If an intrusion is detected quickly enough, the intruder can be identified and
ejected from the system before any damage is done or any data are compromised.
Even if the detection is not sufficiently timely to preempt the intruder, the sooner
that the intrusion is detected, the less the amount of damage and the more quickly
that recovery can be achieved. 2. An effective intrusion detection system can serve
as a deterrent, so acting to prevent intrusions. 3. Intrusion detection enables the
collection of information about intrusion techniques that can be used to
strengthen the intrusion prevention facility.
9.4 Statistical anomaly detection involves the collection of data relating to the
behavior of legitimate users over a period of time. Then statistical tests are
applied to observed behavior to determine with a high level of confidence
whether that behavior is not legitimate user behavior. Rule-Based Detection
involves an attempt to define a set of rules that can be used to decide that a given
behavior is that of an intruder.
9.5 Counter: A nonnegative integer that may be incremented but not decremented
until it is reset by management action. Typically, a count of certain event types is
kept over a particular period of time. Gauge: A nonnegative integer that may be
incremented or decremented. Typically, a gauge is used to measure the current
value of some entity. Interval timer: The length of time between two related
events. Resource utilization: Quantity of resources consumed during a specified
period.
9.6 With rule-based anomaly detection, historical audit records are analyzed to
identify usage patterns and to generate automatically rules that describe those
patterns. Rules may represent past behavior patterns of users, programs,
CHAPTER 9
INTRUDERS
-35-
privileges, time slots, terminals, and so on. Current behavior is then observed,
and each transaction is matched against the set of rules to determine if it conforms
to any historically observed pattern of behavior. Rule-based penetration
identification uses rules for identifying known penetrations or penetrations that
would exploit known weaknesses. Rules can also be defined that identify
suspicious behavior, even when the behavior is within the bounds of established
patterns of usage. Typically, the rules used in these systems are specific to the
machine and operating system. Also, such rules are generated by "experts" rather
than by means of an automated analysis of audit records.
9.7 Honeypots are decoy systems that are designed to lure a potential attacker away
from critical systems.
9.8 The salt is combined with the password at the input to the one-way encryption
routine.
9.9 User education: Users can be told the importance of using hard-to-guess
passwords and can be provided with guidelines for selecting strong passwords.
Computer-generated passwords: Users are provided passwords generated by a
computer algorithm. Reactive password checking: the system periodically runs
its own password cracker to find guessable passwords. The system cancels any
passwords that are guessed and notifies the user. Proactive password checking: a
user is allowed to select his or her own password. However, at the time of
selection, the system checks to see if the password is allowable and, if not, rejects
it.
ANSWERS TO PROBLEMS
9.1 Let WB equal the event {witness reports Blue cab}. Then:
Pr[Blue WB] = Pr[WB Blue]Pr[Blue]
Pr[WB Blue]Pr[Blue] + Pr[WB Green]Pr[Green]
= (0.8)(0.15)
(0.8)(0.15) +(0.2)(0.85)
= 0. 41
This example, or something similar, is referred to as "the juror's fallacy."
9.2 a. T =
264
2
seconds = 63.5 hours
b. Expect 13 tries for each digit. T = 13 × 4 = 52 seconds.
9.3 a. p =rk
b. p =
rk rp
rk +p
c. p =rp
9.4 a. T = (21 × 5 × 21)2 = 4,862,025
-36-
b. p = 1/T 2 × 10–7
9.5 There are 9510 6 × 1019 possible passwords. The time required is:
6 × 1019passwords
6.4 ×106 passwords/second
= 9.4 × 1012seconds
= 300, 000 years
9.6 a. Since PUa and PRa are inverses, the value PRa can be checked to validate that Pa
was correctly supplied: Simply take some arbitrary block X and verify that X =
D(PRa, E[PUa, X]).
b. Since the file /etc/publickey is publicly readable, an attacker can guess P (say
P') and compute PRa' = D(P', E[P, PRa]). now he can choose an arbitrary block Y
and check to see if Y = D(PRa, E[PUa, Y]). If so, it is highly probable that P' = P.
Additional blocks can be used to verify the equality.
9.7 Yes.
9.8 Without the salt, the attacker can guess a password and encrypt it. If ANY of the
users on a system use that password, then there will be a match. With the salt, the
attacker must guess a password and then encrypt it once for each user, using the
particular salt for each user.
9.9 It depends on the size of the user population, not the size of the salt, since the
attacker presumably has access to the salt for each user. The benefit of larger salts
is that the larger the salt, the less likely it is that two users will have the same salt.
If multiple users have the same salt, then the attacker can do one encryption per
password guess to test all of those users.
9.10 a. If there is only one hash function (k = 1), which produces one of N possible
hash values, and there is only one word in the dictionary, then the probability
that an arbitrary bit bi is set to 1 is just 1/N. If there are k hash functions, let
us assume for simplicity that they produce k distinct hash functions for a
given word. This assumption only introduces a small margin of error. Then,
the probability that an arbitrary bit bi is set to 1 is k/N. Therefore, the
probability that bi is equal to 0 is 1 – k/N. The probability that a bit is left
unset after D dictionary words are processed is just the probability that each
of the D transformations set other bits:
Pr[bi = 0] = 1k
N
D
This can also be interpreted as the expected fraction of bits that are equal to 0.
b. A word not in the dictionary will be falsely accepted if all k bits tested are
equal to 1. Now, from part (a), we can say that the expected fraction of bits in
the hash table that are equal to one is 1 – ö. The probability that a random
word will be mapped by a single hash function onto a bit that is already set is
the probability that the bit generated by the hash function is in the set of bits
-37-
equal to one, which is just 1 – ö. Therefore, the probability that the k hash
functions applied to the word will produce k bits all of which are in the set of
bits equal to one is (1 – ö)k.
c. We use the approximation (1 – x) e-x.
9.11 The system enciphers files with a master system key KM, which is stored in some
secure fashion. When User i attempts to read file F, the header of F is decrypted
using KM and User i's read privilege is checked. If the user has read access, the
file is decrypted using KM and the reencrypted using User i's key for
transmission to User i. Write is handled in a similar fashion.
-38-
ANSWERS TO QUESTIONS
10.1 A virus may use compression so that the infected program is exactly the same
length as an uninfected version.
10.2 A portion of the virus, generally called a mutation engine, creates a random
encryption key to encrypt the remainder of the virus. The key is stored with the
virus, and the mutation engine itself is altered. When an infected program is
invoked, the virus uses the stored random key to decrypt the virus. When the
virus replicates, a different random key is selected.
10.3 A dormant phase, a propagation phase, a triggering phase, and an execution
phase
10.4 1. Search for other systems to infect by examining host tables or similar
repositories of remote system addresses. 2.Establish a connection with a remote
system. 3. Copy itself to the remote system and cause the copy to be run.
10.5 This system provides a general-purpose emulation and virus-detection system.
The objective is to provide rapid response time so that viruses can be stamped out
almost as soon as they are introduced. When a new virus enters an organization,
the immune system automatically captures it, analyzes it, adds detection and
shielding for it, removes it, and passes information about that virus to systems
running a general antivirus program so that it can be detected before it is allowed
to run elsewhere.
10.6 Behavior-blocking software integrates with the operating system of a host
computer and monitors program behavior in real-time for malicious actions. The
behavior blocking software then blocks potentially malicious actions before they
have a chance to affect the system.
10.7 A denial of service (DoS) attack is an attempt to prevent legitimate users of a
service from using that service. When this attack comes from a single host or
network node, then it is simply referred to as a DoS attack. A more serious threat
is posed by a DDoS attack. In a DDoS attack, an attacker is able to recruit a
number of hosts throughout the Internet to simultaneously or in a coordinated
fashion launch an attack upon the target.
ANSWERS TO PROBLEMS
10.1 The program will loop indefinitely once all of the executable files in the system
are infected.
CHAPTER 10
MALICIOUS SOFTWARE
-39-
10.2 D is supposed to examine a program P and return TRUE if P is a computer virus
and FALSE if it is not. But CV calls D. If D says that CV is a virus, then CV will
not infect an executable. But if D says that CV is not a virus, it infects an
executable. D always returns the wrong answer.
-40-
ANSWERS TO QUESTIONS
11.1 1. All traffic from inside to outside, and vice versa, must pass through the
firewall. This is achieved by physically blocking all access to the local network
except via the firewall. Various configurations are possible, as explained later in
this section. 2. Only authorized traffic, as defined by the local security policy, will
be allowed to pass. Various types of firewalls are used, which implement various
types of security policies, as explained later in this section. 3. The firewall itself is
immune to penetration. This implies that use of a trusted system with a secure
operating system.
11.2 Service control: Determines the types of Internet services that can be accessed,
inbound or outbound. The firewall may filter traffic on the basis of IP address and
TCP port number; may provide proxy software that receives and interprets each
service request before passing it on; or may host the server software itself, such as
a Web or mail service. Direction control: Determines the direction in which
particular service requests may be initiated and allowed to flow through the
firewall. User control: Controls access to a service according to which user is
attempting to access it. This feature is typically applied to users inside the firewall
perimeter (local users). It may also be applied to incoming traffic from external
users; the latter requires some form of secure authentication technology, such as is
provided in IPSec. Behavior control: Controls how particular services are used.
For example, the firewall may filter e-mail to eliminate spam, or it may enable
external access to only a portion of the information on a local Web server.
11.3 Source IP address: The IP address of the system that originated the IP packet.
Destination IP address: The IP address of the system the IP packet is trying to
reach. Source and destination transport-level address: The transport level (e.g.,
TCP or UDP) port number, which defines applications such as SNMP or TELNET.
IP protocol field: Defines the transport protocol. Interface: For a router with three
or more ports, which interface of the router the packet came from or which
interface of the router the packet is destined for.
11.4 1. Because packet filter firewalls do not examine upper-layer data, they cannot
prevent attacks that employ application-specific vulnerabilities or functions. For
example, a packet filter firewall cannot block specific application commands; if a
packet filter firewall allows a given application, all functions available within that
application will be permitted. 2. Because of the limited information available to
the firewall, the logging functionality present in packet filter firewalls is limited.
Packet filter logs normally contain the same information used to make access
control decisions (source address, destination address, and traffic type). 3. Most
packet filter firewalls do not support advanced user authentication schemes. Once
again, this limitation is mostly due to the lack of upper-layer functionality by the
firewall. 4. They are generally vulnerable to attacks and exploits that take
advantage of problems within the TCP/IP specification and protocol stack, such
CHAPTER 11
FIREWALLS
-41-
as network layer address spoofing. Many packet filter firewalls cannot detect a
network packet in which the OSI Layer 3 addressing information has been
altered. Spoofing attacks are generally employed by intruders to bypass the
security controls implemented in a firewall platform. 5. Finally, due to the small
number of variables used in access control decisions, packet filter firewalls are
susceptible to security breaches caused by improper configurations. In other
words, it is easy to accidentally configure a packet filter firewall to allow traffic
types, sources, and destinations that should be denied based on an organization's
information security policy.
11.5 A traditional packet filter makes filtering decisions on an individual packet basis
and does not take into consideration any higher layer context. A stateful
inspection packet filter tightens up the rules for TCP traffic by creating a
directory of outbound TCP connections, as shown in Table 11.2. There is an entry
for each currently established connection. The packet filter will now allow
incoming traffic to high-numbered ports only for those packets that fit the profile
of one of the entries in this directory
11.6 An application-level gateway, also called a proxy server, acts as a relay of
application-level traffic.
11.7 A circuit-level gateway does not permit an end-to-end TCP connection; rather, the
gateway sets up two TCP connections, one between itself and a TCP user on an
inner host and one between itself and a TCP user on an outside host. Once the
two connections are established, the gateway typically relays TCP segments from
one connection to the other without examining the contents. The security function
consists of determining which connections will be allowed.
11.8 The screened host firewall, single-homed bastion configuration (Figure 11.2a),
the firewall consists of two systems: a packet-filtering router and a bastion host;
the latter performs authentication and proxy functions. In the single-homed
configuration just described, if the packet-filtering router is completely
compromised, traffic could flow directly through the router between the Internet
and other hosts on the private network. The screened host firewall, dual-homed
bastion configuration physically prevents such a security breach. In the screened
subnet firewall configuration, two packet-filtering routers are used, one between
the bastion host and the Internet and one between the bastion host and the
internal network. This configuration creates an isolated subnetwork, which may
consist of simply the bastion host but may also include one or more information
servers and modems for dial-in capability.
11.9 A subject is an entity capable of accessing objects. Generally, the concept of
subject equates with that of process. Any user or application actually gains access
to an object by means of a process that represents that user or application. An
object is anything to which access is controlled. Examples include files, portions
of files, programs, and segments of memory.
11.10 For each object, an access control list lists users and their permitted access rights.
A capability ticket specifies authorized objects and operations for a user.
-42-
11.11 No read up: A subject can only read an object of less or equal security level. No
write down: A subject can only write into an object of greater or equal security
level.
11.12 Complete mediation: The security rules are enforced on every access, not just,
for example, when a file is opened. Isolation: The reference monitor and
database are protected from unauthorized modification. Verifiability: The
reference monitor's correctness must be provable. That is, it must be possible to
demonstrate mathematically that the reference monitor enforces the security
rules and provides complete mediation and isolation.
11.13 The Common Criteria (CC) for Information Technology and Security Evaluation
is an international initiative by standards bodies in a number of countries to
develop international standards for specifying security requirements and
defining evaluation criteria.
ANSWERS TO PROBLEMS
11.1 It will be impossible for the destination host to complete reassembly of the packet
if the first fragment is missing, and therefore the entire packet will be discarded
by the destination after a time-out.
11.2 When a TCP packet is fragmented so as to force interesting header fields out of
the zero-offset fragment, there must exist a fragment with FO equal to 1. If a
packet with FO = 1 is seen, conversely, it could indicate the presence, in the
fragment set, of a zero-offset fragment with a transport header length of eight
octets Discarding this one-offset fragment will block reassembly at the receiving
host and be as effective as the direct method described above.
11.3 If the router's filtering module enforces a minimum fragment offset for fragments
that have non-zero offsets, it can prevent overlaps in filter parameter regions of
the transport headers.
11.4 The purpose of the "no write down" rule, or *-property is to address the problem
of Trojan horse software. With the *-property, information cannot be
compromised through the use of a Trojan horse. Under this property, a program
operating on behalf of one user cannot be used to pass information to any user
having a lower or disjoint access class.
11.5 Drake is not authorized to read the string directly, so the no-read-up rule will
prevent this. Similarly, Drake is not authorized to assign a security level of
sensitive to the back-pocket file, so that is prevented as well.

blogger templates | Make Money Online