Final Exam Web Security Solved Correctly To Score A+
1. Idea of
The idea is that if there is to be a newly created block and the same time by
reaching
two ditterent parties then the chain is forked and which ever party
consensus
has the longest chain is the one that wins. Hence, the newly created block
using the
longest chain is added to the longest chain and the shorter chain's blocks are
orphaned (not used).
2. idea of using A misbehaving node in theory could fork and build a chain longer than
proof-of-work the longest chain and then tamper with the chain. So, in order to prevent
to limit the this from happening proof of work is in place, each time a new block
impact of created there must be a computationally diflcult problem solved.
misbehaving
nodes -Each block has a nonce value--chosen by the block creator
-SHA-256 Hash value of each block to start with a certain number of
zeroes.
-Creating a block means trying a lot of ditterent nonce values => mining
Therefore, an attacker requires more computational power than all of the
nodes that follow the longest chain.
3. Anonymity, -Conceal the identities of communication parties
mo- tivation, -Anonymous communication over a computer network
princi- ples, -Packets are encapsulated in multiple layers of encryption
and practi- cal -Developed in the 1990's by Naval Research and DARPA
challenges of
onion routing
-Select a set of ' ' routers and from a virtual circuit (path to the
4. Onion Routing responder)
in practice
-Each router sees only the preceding and following nodes
-May be malicious trying to infer identities
=> colluding with malicious routers may use traflc analysis to infer identit
, Final Exam Web Security Solved Correctly To Score A+
5. Router directory - Public list of available onion routers and their public keys
- Initiator needs to select a large and diverse set of routers to prevent
analysis
, Final Exam Web Security Solved Correctly To Score A+
6. blacklists -input validation
-do not allow inputs on this list
-list of known bad inputs
-low impact on usability
7. Virtual circuit - Initiator establishes a connection and a symmetric session key with the
set- up first onion router => two-way tunnel
- tunnel is used to establish a connection and session key with the second
router, and so on, until the responder is reached.
8. TOR the onion -Free software implementation of the idea
router -directs traflc through a worldwide free, volunteer network of onion
routers
-maintained by the TOR project
-Trusted Directory Servers
-Public keys and addresses of these servers are hardcoded into the
software
-maintains a list of active onion routers (with addresses and public keys)
-Every OR is connected to every other OR through SSL/TLS
-Anyone may install and choose not to be an exit router.
9. Information -Assigns a security level to each source
Flow analysis -Each object inherits the security levels of the sources and other objects
from which it is derived.
-Used to detect the leakage of confidential information
10. Responder - Hidden services are identified by public keys
Anonymity: => pseudo-DNS name => publickey.onion
Location
Hidden - Responder (server) selects some ORs to be introduction points
Services => first, builds circuits to these ORs
=> second publishes the public key and the list of Introduction Points
, Final Exam Web Security Solved Correctly To Score A+
(signed
1. Idea of
The idea is that if there is to be a newly created block and the same time by
reaching
two ditterent parties then the chain is forked and which ever party
consensus
has the longest chain is the one that wins. Hence, the newly created block
using the
longest chain is added to the longest chain and the shorter chain's blocks are
orphaned (not used).
2. idea of using A misbehaving node in theory could fork and build a chain longer than
proof-of-work the longest chain and then tamper with the chain. So, in order to prevent
to limit the this from happening proof of work is in place, each time a new block
impact of created there must be a computationally diflcult problem solved.
misbehaving
nodes -Each block has a nonce value--chosen by the block creator
-SHA-256 Hash value of each block to start with a certain number of
zeroes.
-Creating a block means trying a lot of ditterent nonce values => mining
Therefore, an attacker requires more computational power than all of the
nodes that follow the longest chain.
3. Anonymity, -Conceal the identities of communication parties
mo- tivation, -Anonymous communication over a computer network
princi- ples, -Packets are encapsulated in multiple layers of encryption
and practi- cal -Developed in the 1990's by Naval Research and DARPA
challenges of
onion routing
-Select a set of ' ' routers and from a virtual circuit (path to the
4. Onion Routing responder)
in practice
-Each router sees only the preceding and following nodes
-May be malicious trying to infer identities
=> colluding with malicious routers may use traflc analysis to infer identit
, Final Exam Web Security Solved Correctly To Score A+
5. Router directory - Public list of available onion routers and their public keys
- Initiator needs to select a large and diverse set of routers to prevent
analysis
, Final Exam Web Security Solved Correctly To Score A+
6. blacklists -input validation
-do not allow inputs on this list
-list of known bad inputs
-low impact on usability
7. Virtual circuit - Initiator establishes a connection and a symmetric session key with the
set- up first onion router => two-way tunnel
- tunnel is used to establish a connection and session key with the second
router, and so on, until the responder is reached.
8. TOR the onion -Free software implementation of the idea
router -directs traflc through a worldwide free, volunteer network of onion
routers
-maintained by the TOR project
-Trusted Directory Servers
-Public keys and addresses of these servers are hardcoded into the
software
-maintains a list of active onion routers (with addresses and public keys)
-Every OR is connected to every other OR through SSL/TLS
-Anyone may install and choose not to be an exit router.
9. Information -Assigns a security level to each source
Flow analysis -Each object inherits the security levels of the sources and other objects
from which it is derived.
-Used to detect the leakage of confidential information
10. Responder - Hidden services are identified by public keys
Anonymity: => pseudo-DNS name => publickey.onion
Location
Hidden - Responder (server) selects some ORs to be introduction points
Services => first, builds circuits to these ORs
=> second publishes the public key and the list of Introduction Points
, Final Exam Web Security Solved Correctly To Score A+
(signed
