CS395: Computer Security (Prof. Szajda) Exam 1 September 28, 2006

Name:______

Note: This exam is closed book, closed note. You are to complete without the aid of your colleagues. The Honor Code applies. Your completed test is to be returned to my office by no later than 5:00pm on Thursday, October 5, 2006.

Please keep your answers concise and to the point.

  1. (9 points) Describe in some detail the RSA public-key encryption algorithm. Among the topics that should be discussed are:
  2. The way in which a person chooses a public-private key pair.
  3. The way in which a message is encrypted and decrypted.
  4. The reason why the scheme is secure.
  1. (7 points) Describe in detail the Diffie-Helmann key exchange algorithm.
  1. (8 points) In the paper “Why Cryptosystems Fail”, Ross Anderson presents a number of problems with the way security systems are typically designed, developed, deployed, and tested. In particular, discuss
  2. His assertion that “information security is at heart an engineering problem. The hardware and software products which are designed to solve it should in principle be judged in the same way as any other products: by their cost and effectiveness”.
  3. The problems that arise due to integration of multiple security software packages
  4. The inclusion of the “people” factor in the security equation
  5. The reasons why the security community lacks the type of useful feedback system found in the airline industry.
  1. (8 points) In the paper “Cryptographic Design Vulnerabilities”, Bruce Schneier discusses (among other topics) attacks against trust models. In particular, he states that many of the more interesting attacks that he has launched are “against the underlying trust model of the system; who or what in the system is trusted, in what way, and to what extent.” List and discuss at least three examples of how trust issues can cause the failure of a security system.
  1. (6 points) Explain what is meant by the terms integrity, confidentiality, authentication, availability
  1. (4 points) What exactly is a person-in-the-middle attack?
  1. (6 points) What is meant by the term “security through obscurity”?
    Is this considered to be a good security technique? Be sure to explain your answer.
  1. (6 points) Explain the primary differences between public key and symmetric key cryptography. Does public key cryptography effectively eliminate the key management problem? Explain.
  1. (4 points) Explain the difference between unconditional security and computational security.
  1. (6 points) Consider the following classical substitution cipher to be used to encrypt English language ASCII text. The cipher chooses 26 distinct integers at random, and assigns one to each letter of the alphabet. The message is then encrypted by mapping individual letters to their associated integer. Is this cipher secure? Explain why or why not. If not, explain how an adversary might attempt to break the cipher.
  1. (6 points) Consider the following scenario. An adversary is attempting to decrypt a message encrypted with AES. The adversary has the computational power to perform (and complete) an exhaustive search. Is the adversary guaranteed to determine the key used to decrypt the message? Be sure to explain your answer (and be careful here).
  1. (6 points) What exactly is steganography? What are its advantages and disadvantages?
  1. (6 points) Why specifically do we require a structure (such as a Fiestel cipher) for our ciphers? Be sure to specifically address the question of why we can’t use arbitrary mappings of, say, n bit strings to n bit strings.
  1. (6 points) What was the main point of Ken Thompson’s paper “Reflections on Trusting Trust”?
  1. (12 points) This question concerns hash functions and MACS (as defined in the context of computer security).
  2. What are hash functions and MACs, and (specifically) why are they necessary?
  3. What is the difference between a hash function and a MAC?
  4. Define the following terms, as applied to hash functions:
  5. One-way property
  6. Weak collision resistance
  7. Strong collision resistance