Information Assurance: Exam 2 – Answer KeyMultiple Choice – 2 points eachShort AnswerInformation Assurance: Exam 2 – Answer Key 89 points total Multiple Choice – 2 points each 1. Double encrypting with DES has an effective key length of 57 bits instead of the effective key length of 112 bits due to which reason? a. Pigeon hole principle b. Complementation property c. Birthday paradox d. [ Meet in the middle attack ] 2. The correct definition for HMAC is: a. An algorithm to make stream ciphers self healing b. [An algorithm that combines a keyless hash function and a cryptographic key to make a keyed hash function] c. A key management algorithm that leverages the discrete logarithm problem to derive a shared secret without hiding intermediate messages d. A high integrity medium access control 3. The correct definition for totient )(nΦ is: a. [The number of numbers less than n with no factors in common with n] b. The number of primes less than n c. The number of factors of n d. The number of numbers of less than n with a factor in common with n 4. If you analyze a block of cipher text and the character frequency matches that of English text, this is a clue for the following: a. A substitution cipher is being used. b. [A transposition cipher is being used.] c. A proposition cipher is being used. d. A stream cipher is being used. Information Assurance Exam 1 Page 1 11/4/20055. In an authentication system the complementation information C is: a. A complement of the authentication information b. Additional information that can be used to authenticate the individual c. Information that is added to the authentication information that makes brute force searches more difficult d. [Information the system stores and uses to validate the authentication information] 6. If you wanted to configure IPSec to provide traffic confidentiality, you would use which protocol: a. [ESP – Encapsulating Security Protocol] b. SPI – Security Parameter Index c. AH – Authentication Header d. SA – Security Association 7. Which most accurately describes the system design problems associated with address hiding or NATP a. Only one connection from inside network can access machines beyond the address translation point at a time. b. The target of the communication does not know how to send the traffic back. c. The change of address confuses tunneling protocols like IPSec. d. [The address translation point must understand and fixup communication streams for protocols that negotiate ports and addresses.] 8. A message encrypted by a shared secret it not a sufficient for a digital signature. Why not? a. [A third party judge does not have proof to differentiate between parties that know the secret.] b. The third party judge cannot be sure that another party has not stolen the shared secret. c. Symmetric encryption is not sufficiently strong to guarantee that long term signatures are not broken. d. The secret must be revealed to the judge to verify the signature. Information Assurance Exam 1 Page 2 11/4/2005Short Answer 9. (8 points total) Consider the following list of encryption modes that can be used with symmetric algorithms like DES and AES • CBC – Cipher Block Chaining • ECB – Electronic Code Book • OFB – Output Feedback • Counter • CFB - Cipher Feedback a. Which modes are appropriate for operating in as a block cipher? (2 points) CBC, ECB b. Which modes are appropriate for operating in as a stream cipher? (2 points) OFB, Counter, CFB c. If you had to select a mode for AES to operate in block mode, which would you choose and why? (2 points) CBC. By chaining recurring blocks in the stream, repeating blocks of plaintext in the stream will not result in repeating blocks if ciphertext. In addition, CBC has a self healing mode where a dropped packet will only result in errors in the following packet. d. If you had to select a mode for AES to implement a stream cipher, which would you select and why? (2 points) Counter mode. The key stream can be precomputed reducing the time to actually perform the encryption/decryption. Also one can calculate the key stream starting at an arbitrary offset. Would take other answers that justify the other modes well. Information Assurance Exam 1 Page 3 11/4/200510. (8 points total) Alice needs to pick a public and private RSA key to communicate with Bob. They will be encrypting and signing messages that are only a character long (values from 0 to 25), so the values selected do not need to be nearly as large as you would expect in a real system. a. Alice selects p=7 and q=13. What is n? (2 points) n = p * q = 91 b. Alice select e=29 and d=5. Show that these are valid RSA encrypting and decrypting values. (2 points) e * d mod = 1 )(nΦ29 * 5 mod (6 – 1)(12 – 1) = 145 mod 72 = 1 And 29 is relatively prime to 91 c. What would Alice publish as the public key? (2 points) e = 29 and n = 91 d. Now Bob wants to send the message “test” so it only can be read by Alice. Compute the cipher text he should send to Alice. Assume a = 0. (2 points) T=19, e = 4, s = 18 c = me mod n ct = 1929 mod 91 = 80 ce = 429 mod 91 = 23 cs = 1829 mod 91 = 44 So the messages would be 80, 23, 44, 80. Information Assurance Exam 1 Page 4 11/4/200511. (10 points total) Consider the encrypted key exchange proposed by Bellovin-Merritt that aims to protect against type 1 dictionary attacks (which uses the complementation information and functions to determine authentication information). Here is the protocol for your review. The protocol assumes Alice and Bob share a secret Kab. a. Alice->Bob: {eAlice,nAlice}Kab, where eAlice,nAlice is a randomly selected public key for a public key system. b. Bob->Alice: {{k}eAlice}Kab, where k is a randomly selected secret key. c. Alice->Bob: {rand1}k, where rand1 is a random nonce selected by Alice. d. Bob->Alice: {rand1, rand2}k, where rand2 is a random nonce selected by Bob. e. Alice->Bob: {rand2}k Answer the questions below about this protocol. a. Why does Alice's key (eAlice, nAlice) have to be picked randomly, instead of using the same key each time? (2 points) If an attacker somehow found out what Alice’s key was, he could use a known-plaintext attack to discover Kab. It could also be used to track the uniqueness of the request rather than using a random nonce. Therefore, the unique public key enables the detection
View Full Document
Unlocking...