CS 645 MIDTERM REVIEW QUESTIONS WITH ACCURATE
ANSWERS
A bank wants to store the account number of its customers (an 8-digit number) in
encrypted form on magnetic stripe ATM cards. Discuss the security of the
following methods for storing the account number against an attacker who can
read the magnetic stripe (In each of these cases, the account number is assumed
to be a secret):
a) store a cryptographic hash of the account number;
b) store the ciphertext of the account number encrypted with the bank's public
key using a public-key cryptosystem (a deterministic public key encryption
scheme is used);
c) store the ciphertext of the account number encrypted with the bank's secret
key using a symmetric cryptosystem. correct answer a) This solution is not very
secure, even though it is considered computationally difficult to determine the
input to cryptographic hash function given only its output. The problem is that
there aren't that many plaintexts and the attacker can hash every possible 8-digit
account number and check the stored hash on the card against this list.
b) This solution is also not very secure if the public-key encryption algorithm it
uses is deterministic, like RSA. The problem is that everyone knows the bank's
public key and there aren't that many plaintexts; hence, the attacker can encrypt
every possible 8-digit account number and check the encryption on the card
against this list.
c) This solution is quite secure, since only the bank's secret key can encrypt and
decrypt this ciphertext, and once it is decrypted, then the bank also gets the
account number, so no additional linkage between the card and the account
number is needed.
A thief walks up to an electronic lock with a 10-digit keypad and he notices that all
but three of the keys are covered in dust while the 2, 4, 6, and 8 keys show
considerable wear. He thus can safely assume that the 4-digit code that opens the
, door must be made up of these numbers in some order. What is the worst-case
number of combinations he must now test to try to open this lock using a brute-
force attack? correct answer There are 4! = 24 different orderings (that is,
permutations) of four different numbers. So, in the worst case, the thief would
only have to test 24 codes.
Assume a password p exists in a Rainbow table with hash chains of length k. Given
a target hash c, how many times do we need to apply the H and R functions to
find p in the worst case? Explain your answer correct answer A Rainbow table
stores on each row the first and the last element of a hash chain that is obtained
by applying k-1 times the H and R functions. To find the password behind a target
hash, the attacker keeps applying the H and R functions and after each
application, checks if the resulting value is one of the values in the second column
of the table.
If the password p exists in one of the hash chains of the Rainbow table, then it
must match one of the values in the second column of the table after at most k-1
applications of the H and R functions, because the length of the hash chains is k-1.
CIA, Explain what each of them means and their differences.
Is it possible to achieve one and not the others? Explain. correct answer
Confidentiality - is the avoidance of the unauthorized disclosure of information.
Integrity - the property that information has not be altered in an unauthorized
way
Availability - the property that information is accessible and modifiable in a timely
fashion by those authorized to do so.
Example: Querying a Public database, because it is public, there is no need for
secrecy (confidentiality) but we want to ensure the response from the database is
from the server (integrity).
ANSWERS
A bank wants to store the account number of its customers (an 8-digit number) in
encrypted form on magnetic stripe ATM cards. Discuss the security of the
following methods for storing the account number against an attacker who can
read the magnetic stripe (In each of these cases, the account number is assumed
to be a secret):
a) store a cryptographic hash of the account number;
b) store the ciphertext of the account number encrypted with the bank's public
key using a public-key cryptosystem (a deterministic public key encryption
scheme is used);
c) store the ciphertext of the account number encrypted with the bank's secret
key using a symmetric cryptosystem. correct answer a) This solution is not very
secure, even though it is considered computationally difficult to determine the
input to cryptographic hash function given only its output. The problem is that
there aren't that many plaintexts and the attacker can hash every possible 8-digit
account number and check the stored hash on the card against this list.
b) This solution is also not very secure if the public-key encryption algorithm it
uses is deterministic, like RSA. The problem is that everyone knows the bank's
public key and there aren't that many plaintexts; hence, the attacker can encrypt
every possible 8-digit account number and check the encryption on the card
against this list.
c) This solution is quite secure, since only the bank's secret key can encrypt and
decrypt this ciphertext, and once it is decrypted, then the bank also gets the
account number, so no additional linkage between the card and the account
number is needed.
A thief walks up to an electronic lock with a 10-digit keypad and he notices that all
but three of the keys are covered in dust while the 2, 4, 6, and 8 keys show
considerable wear. He thus can safely assume that the 4-digit code that opens the
, door must be made up of these numbers in some order. What is the worst-case
number of combinations he must now test to try to open this lock using a brute-
force attack? correct answer There are 4! = 24 different orderings (that is,
permutations) of four different numbers. So, in the worst case, the thief would
only have to test 24 codes.
Assume a password p exists in a Rainbow table with hash chains of length k. Given
a target hash c, how many times do we need to apply the H and R functions to
find p in the worst case? Explain your answer correct answer A Rainbow table
stores on each row the first and the last element of a hash chain that is obtained
by applying k-1 times the H and R functions. To find the password behind a target
hash, the attacker keeps applying the H and R functions and after each
application, checks if the resulting value is one of the values in the second column
of the table.
If the password p exists in one of the hash chains of the Rainbow table, then it
must match one of the values in the second column of the table after at most k-1
applications of the H and R functions, because the length of the hash chains is k-1.
CIA, Explain what each of them means and their differences.
Is it possible to achieve one and not the others? Explain. correct answer
Confidentiality - is the avoidance of the unauthorized disclosure of information.
Integrity - the property that information has not be altered in an unauthorized
way
Availability - the property that information is accessible and modifiable in a timely
fashion by those authorized to do so.
Example: Querying a Public database, because it is public, there is no need for
secrecy (confidentiality) but we want to ensure the response from the database is
from the server (integrity).
