cmpsc 443 psu final exam study guide
Exam Questions with Answers
What is CIA? - -Confidentiality: assets (or data or information) are accessed
only by authorized parties (or prevent unauthorized data access).
Integrity: Assets can be modified by authorized parties or only in authorized
ways.
Availability: Assets are accessable to authorized parties at appropriate times
- Give a concrete example where confidentiality is more important than
integrity. - -Confidentiality without integrity is of little use, since you would
not be able to trust the data.
- Give a concrete example where integrity is more important than
confidentiality. - -Any transaction that is not secret, for example, the
transfer of funds between federal reserve banks in the U.S.
- Give a concrete example where availability is the overriding concern. - -
Availability is critical for any online business, such as amazon.com.
- What is a security model? Threat model? Trust model? - -A security model
is the combination of a threat and a trust model.
A threat model is a collection of threats that are deemed important for a
particular environment and a trust model describes, for a particular
environment, who is trusted to do what.
- Suppose you are developing an anti-virus software. What is your security
model? - -Trust Model: Trust the OS
Threat Model: Third party software
- Define Kerckhoffs' Principle in the context of cryptography - -Kerckhoff's
principle is that you should always assume that a system is completely
known to an attacker, except for the key. You should design the system to be
secure even when an attacker might know everything about that system
(again, except for the key).
- Give an example where Kerckhoff's Principle was violated. - -The crypto
used in GSM was designed in violation of Kerckhoffs' Principle - The crypto
algorithms are weak.
, - Give a more general definition for Kerckhoffs' Principle - -The design of
any security features should be open and available for scrutiny
- Find the plaintext and the key, given the cipher-text: CSYEVIXIVqMREXIH.
Hint: The key is a shift of the alphabet. - -This is encoded using Cesar
Cypher. To decipher this, just shift the alphabet 4 to the left to get "YOU ARE
TERMINATED"
- Encrypt the message "we are all together" using a double transposition
cipher with 4 rows and 4 columns, using the row permutation (1,2,3,4)-
>(2,4,1,3) and the column permutation (1,2,3,4)->(3,1,2,4). - -Place the
string in a 4x4 matrix, then permute the row first then the column. The
encrypted message is the output when read top to bottom.
- Decrypt the ciphertext IAUTMDCSMNIMREBOTNELSTRHEREOAEVMWIH
TSEEATMAEOHWHSYCEELTTEOHMUOUFEHTRFT. This message was
encrypted with a double transposition using a matrix of 7 rows and 10
columns. Hint: The first word is "there." - -To decrypt a double transposition
cypher, first permute the columns to get the given first word, then use trial
and error to figure out the next word. After that, permute the rows so that
the message makes sense
- Using the letter encodings in Table 2.1, the following ciphertext message
was encrypted with a one-time pad: KITLKE
a. If the plaintext is "thrill," what is the key?
b. If the plaintext is "tiller," what is the key? - -To do this, take the bit that
correspond to each letter and find an value that when XORed yields the
cipher-text KITLKE.
Alternatively, you can just XOR the plain text and cipher-text to yield the key
because XOR is a symmetric operation.
Regardless, the value you compute is the key.
- Suppose that you have a message consisting of 1024 bits.
A) Design a method that will extend a key that is 64 bits long into a string of
1024 bits, so that the resulting 1024 bits can be XORed with the message,
just like a one-time pad.
B) Is the resulting cipher as secure as a one-time pad?
, C) Is it possible for any such cipher to be as secure as a one-time pad? - -A)
Design a function f that produces a 64-bit output and use x[f(x)][f(f(x))]... as
the one-time pad.
B) The security would depend on the choice of the function f.
C) It is not possible to achieve the same security strength as in one-time pad
where each bit of key is randomly generated
- To design strong ciphers, what are the two security requirements and two
design principles? - -Two security requirements:
1) Large key space (exhaustive key search takes too long)
2) No shortcut attacks (no better than exhaustive key search).
Two design principles:
1) Confusion: Refers to making the relationship between the cipher-text and
the symmetric key as complex and involved as possible
2) Diffusion: Refers to making the relationship between the plaintext and the
cipher-text as complex and involved as possible (so that the plaintext
statistics are spread over the cipher-text so the attacker ant do frequency
analysis).
- What is the principle of the weakest link? - -The security of a system is
only as good as the security at its weakest link
- Define cryptology, cryptography, and cryptanalysis - -Cryptology: The art
and science of making and breaking "secret codes"
Cryptography: making "secret codes"
Cryptanalysis: breaking "secret code"
- What is a symmetric key cryptosystem? - -A symmetric key cryptosystem
uses the same key to encrypt and decrypt
- What is a public key cryptosystem? - -A public key cryptosystem uses a
public key to encrypt and a private key to decrypt
- What is one-time pad encryption? - -Essentially the XOR operation, key is
same size as plaintext
One-time pad encryption where (plaintext XOR key = ciphertext)
One-time pad decryption where
Exam Questions with Answers
What is CIA? - -Confidentiality: assets (or data or information) are accessed
only by authorized parties (or prevent unauthorized data access).
Integrity: Assets can be modified by authorized parties or only in authorized
ways.
Availability: Assets are accessable to authorized parties at appropriate times
- Give a concrete example where confidentiality is more important than
integrity. - -Confidentiality without integrity is of little use, since you would
not be able to trust the data.
- Give a concrete example where integrity is more important than
confidentiality. - -Any transaction that is not secret, for example, the
transfer of funds between federal reserve banks in the U.S.
- Give a concrete example where availability is the overriding concern. - -
Availability is critical for any online business, such as amazon.com.
- What is a security model? Threat model? Trust model? - -A security model
is the combination of a threat and a trust model.
A threat model is a collection of threats that are deemed important for a
particular environment and a trust model describes, for a particular
environment, who is trusted to do what.
- Suppose you are developing an anti-virus software. What is your security
model? - -Trust Model: Trust the OS
Threat Model: Third party software
- Define Kerckhoffs' Principle in the context of cryptography - -Kerckhoff's
principle is that you should always assume that a system is completely
known to an attacker, except for the key. You should design the system to be
secure even when an attacker might know everything about that system
(again, except for the key).
- Give an example where Kerckhoff's Principle was violated. - -The crypto
used in GSM was designed in violation of Kerckhoffs' Principle - The crypto
algorithms are weak.
, - Give a more general definition for Kerckhoffs' Principle - -The design of
any security features should be open and available for scrutiny
- Find the plaintext and the key, given the cipher-text: CSYEVIXIVqMREXIH.
Hint: The key is a shift of the alphabet. - -This is encoded using Cesar
Cypher. To decipher this, just shift the alphabet 4 to the left to get "YOU ARE
TERMINATED"
- Encrypt the message "we are all together" using a double transposition
cipher with 4 rows and 4 columns, using the row permutation (1,2,3,4)-
>(2,4,1,3) and the column permutation (1,2,3,4)->(3,1,2,4). - -Place the
string in a 4x4 matrix, then permute the row first then the column. The
encrypted message is the output when read top to bottom.
- Decrypt the ciphertext IAUTMDCSMNIMREBOTNELSTRHEREOAEVMWIH
TSEEATMAEOHWHSYCEELTTEOHMUOUFEHTRFT. This message was
encrypted with a double transposition using a matrix of 7 rows and 10
columns. Hint: The first word is "there." - -To decrypt a double transposition
cypher, first permute the columns to get the given first word, then use trial
and error to figure out the next word. After that, permute the rows so that
the message makes sense
- Using the letter encodings in Table 2.1, the following ciphertext message
was encrypted with a one-time pad: KITLKE
a. If the plaintext is "thrill," what is the key?
b. If the plaintext is "tiller," what is the key? - -To do this, take the bit that
correspond to each letter and find an value that when XORed yields the
cipher-text KITLKE.
Alternatively, you can just XOR the plain text and cipher-text to yield the key
because XOR is a symmetric operation.
Regardless, the value you compute is the key.
- Suppose that you have a message consisting of 1024 bits.
A) Design a method that will extend a key that is 64 bits long into a string of
1024 bits, so that the resulting 1024 bits can be XORed with the message,
just like a one-time pad.
B) Is the resulting cipher as secure as a one-time pad?
, C) Is it possible for any such cipher to be as secure as a one-time pad? - -A)
Design a function f that produces a 64-bit output and use x[f(x)][f(f(x))]... as
the one-time pad.
B) The security would depend on the choice of the function f.
C) It is not possible to achieve the same security strength as in one-time pad
where each bit of key is randomly generated
- To design strong ciphers, what are the two security requirements and two
design principles? - -Two security requirements:
1) Large key space (exhaustive key search takes too long)
2) No shortcut attacks (no better than exhaustive key search).
Two design principles:
1) Confusion: Refers to making the relationship between the cipher-text and
the symmetric key as complex and involved as possible
2) Diffusion: Refers to making the relationship between the plaintext and the
cipher-text as complex and involved as possible (so that the plaintext
statistics are spread over the cipher-text so the attacker ant do frequency
analysis).
- What is the principle of the weakest link? - -The security of a system is
only as good as the security at its weakest link
- Define cryptology, cryptography, and cryptanalysis - -Cryptology: The art
and science of making and breaking "secret codes"
Cryptography: making "secret codes"
Cryptanalysis: breaking "secret code"
- What is a symmetric key cryptosystem? - -A symmetric key cryptosystem
uses the same key to encrypt and decrypt
- What is a public key cryptosystem? - -A public key cryptosystem uses a
public key to encrypt and a private key to decrypt
- What is one-time pad encryption? - -Essentially the XOR operation, key is
same size as plaintext
One-time pad encryption where (plaintext XOR key = ciphertext)
One-time pad decryption where
