Security exam question

What re the percent to known the next binary digit

50/50% as it may be 1 or 0 so called perfect secrecy

what are the length of message of SHA 512

512 BITS

speaking people who have the proper authority should be able to do whatever it is (and only whatever it is) they are authorised to do. Nobody else should be able to do anything on the system.

A multi-user distributed computer system offers access to objects such as resources (memory, printers), data (files) and applications (software).

what are approach take to minimise the chance of present a false key in the ring

1- alice can get the public key directly from bob (physically) but the problem are physical limitation 2-alice can verify the key via telephone 3-alice got the key from other one in which bob trusted in it 4- use trusted certificate agency to obtain the key

how alice and bob communicate through the server?

1- alice communicate with the server and send the names of alice and bob and request that session key to be generated 2-

how are 3 DES work?

1- alice encrypt M by key1 to form c 2- then alice decrypt c to form m' 3- then alice encrypt m' by key 3 to produce c' for decryption it will reverse the sequence 1- alice decrypt c' by using k3 to prosuce m' 2- alice encrypt m' by using k2 to produce c 3- alice decrypt the c by using k1 to produce m

give a list of alternative way of the authentication

1- answer a secret question 2- finger print or scan retina 3- present of something you have such as passport or credit card

what are the step of key escrow?

1- assume that the key have the binary b k=k1k2k3...kb 2-the first key is n of bits that chosen in random 3- the second part of key X2 are calcualted by XORING K and K1 4-THE ORIGINAL KEY ARE RECOVERED BY XORING K1 AND K2

steps to make certificate

1- bob generate a document which include his relevant information and present him self with a document to at CA 2-CA confirm bob identitity 3-CA hash the document using hashing secure hash algorithm function and encrypt the resulting message digest using their own private key 4-the encrypted message digest are the certificate and published together with the unencrypted message include the public key

what are five services does PGP offer?

1- confidentiality 2- segmentation 3- authentication 4-compression 5- compatibility

which method can be used to [rotect the password file?

1- cryptographic method 2- access control over the password file

what are the four properties should be in hash function to be strong?

1- easy to compute 2- no collisions 3- no preimages 4-input can be or arbitrary length

what are five properties should block cipher satisfy

1- large block size 2- large key space 3- diffusion property 4- confusion property 5-completeness

why use hashing in digital signature?

1- speed 2- confidentiality

why use digital signature?

1- to prove from who the message are 2- that message have not been corrupted or altered in any way

what are the two component of password system ?

1- user name to establish identity 2- password to confirm the authentication of identity

how PGP associate a level of trust with each public key as follow

1- when alice insert a new public key onto her public key ring ,she can specify unknown , trusted ,marginally trusted ,completely trusted 2- ligitimicy value in which give indication of what are signed it

223 mod 660 find the inverse

1-660=223*2+214 223=214*1+9 214=9*23+7 9=7*1+2 7=2*3+1 rearrange the last equation to make 1 are the subject 1=7-3(2) from equation 9-7*1+2 2=9-(7*1) substitute 1=7-3(9-7) 1=4(7)-3*(9)

Nine of the twelve mode bits are used to encode access rights.4 These access bits can be thought of as the access control matrix entry. They are divided into three groups of three bits which represent the owner, group and other users respectively. For each of these three groups, the three bits are r w x representing read access, write access

For example, the 9 bits r w - r - - r - - indicates that the owner has read and write access but not permission to execute the file, whereas the group members and all other users have read access only. The 9 bits r w x r - - - - - indicates that the owner has read, write and execute access, whereas the group members have read access only and other users have no access to the file.

example to the term of size form

For example: b(5) = b(1012) = 3 b(20) = b(101002) = 5 b(212) = b(4096) = b(10000000000002) = 13

One time pad

Is a security method that provide perfect secrecy

Random substitution cipher

Is more secure than Ceaser cipher

Cryptoanalyst

Is person who try to decrypt the ciphertext for malicious use

What are limitation. Of DAC

Is that if the file are control by the owner it have a risky that it may be unexpected propagation of acres rights suspected to malicious action. On it

What are the main aim of blocking

Is that the same letter take more than one value when using the ciphertext

One method for improving security

Is using blocking

What are one time key pad and what advantages and disadvantages of it

It amthod of summetric key cryptosystem

What does the authentication

It answer claim which who are you that you are you

Why it is called. One time pad

It called because each digit in stream are only used one time and never repeated

What are relation between one. Pad time and the key generation iteratively using XOR operation

It can generate the key stream by xor function. By generate the. Next bit by Xoring the fist bit with the last bit of the previous n bits to produce a key length of 2^n-1

What does non repudiation concern with

It concern with known the sender and receiver and can be used in digital signature

What are issue with access control. Security

It concerned with Acess control. Rights when design the security system

What does PGP confidenatilty contain

It contain combination of both public key and symmetric key cryptosystem to provide confidential to the message

What does computer security deal with

It deal with detection and reaction of unauthorized user dealing with information in computer system

What does PGP authentication depend on

It depend on that Alice only known his private key and no one other known that key

What does stream cipher security depend on

It depend on the keystream generator

What the meaning of ownership. Policy

It determine which subject have which permission on an object

What are disadvantage of the LFSR

It easy to predict so should not used alone for keystream generation

Non-repudiation

It ensure that either the sender or receiver can not denied the message

Shortly what are access control. Are

Access control are the limitation to access of authorized users by identification and authorizationn

access controls provide the limitation and control of access to authorised users through identification and authentication

Access control is crucial in computer security. All of the features that we would like a security system to provide (confidentiality, availability, integrity, non-repudiation, authentication and accountability) depend upon the proper implementation of access controls.

Authentication Authentication is proving a claim - usually that you are who you say you are, where you say you are, at the time that you say it is. Authentication may be obtained by the provision of a password or by a scan of your retina for example. See Chapter 2 for further methods of authentication.

Access controls Access controls provide the limitation and control of access to authorised users through identification and authentication. A system needs to be able to identify and authenticate users for access to data, applications and hardware. In a large system there may be a complex structure determining which users and applications have access to which objects. See Chapter 3 for further details on access control models

With this model, a process can be granted just the permissions it needs to be functional. This follows the principle of least privilege. Under MAC, for example, users who have exposed their data using chmod are protected by the fact that their data is a kind only associated with user home directories, and confined processes cannot touch files without permissions and purpose written into the policy

All interactions between subjects and objects are disallowed by default on a SELinux system. The policy specifically allows certain operations. To know what to allow, an access control matrix is used. The matrix is derived from the policy rules. The matrix clearly defines all the interactions of processes and the targets of their operations.

To implement a OTP, users generally have a token (similar to a small electrical keyring, for example) which generates the passwords either based on a

Answering a question that only you are likely to know the answer to such as your mother's maiden name or date of birth. This information is not that hard for a hacker to acquire so provides only a low level of security. Presentation of something that you have, such as a credit card or passport. These can be forged or stolen but in general are a good means of identification and authentication. Use of finger prints, retina patterns or palm prints. This is a high cost solution, but fingerprints, etc. are fairly hard to replicate and are not something that the genuine user can lose or forget! However, a determined attacker with adequate financial resources can replicate these physical attributes leading to a catastrophic failure of a supposedly high security identity system

RSA Key Generation

Bob used a strong pseudo random to generate two random primes which are p and q Then calculate n =p*q Then calculate r=(p-1)(q-1) Then choose a number e which between 1 and r and no have common factor with r Compute d which is private key by solve e*d mod(p-1)=1 Then use (e, n) as public keys and d as private key

What are aim of blocking

By blocking we decrease the statistical analysis problem

What mean by group in Acess control

It mean a group of subject which have the same access permission

What are security attacks mean

It mean intercept the transmission f message between the sender and receiver

What are integrity mean

It mean prevention of alter or. Modify information It mean that data stored in computer as it is. Intended

What are aim of availability

It mean that information should be available. And accessible when needed from authorized user

What are the confidentiality mean

It mean that prevention of unauthorized disclosure of information

What mean of statistical analysid

It mean that redundancy of English letter can be used to known the plain message from ciphertext

What is discretionary owner policy are

It mean that the owner of resource decide who have access to which object and resources

What does access control. Mean

It mean the limitation to reach to some information through identification and authentication

How man in the middle attack in diffe hellman exchange protocol occur

It occur by change the values that send from. Alice to Bob and vice versa to be 1

What advantage of MAC

It provide a frame work allow you to define all access permission. Over the objects and resource by all subjects

How the key used in substitution cipher

It shared between the sender and receiver

Whar are the key in random substitution cipher

It table of letter substitutions

What are objects in control system

It the shared resources such as printers data files or software

How we can obtain authentication.

Can obtain by password or scan of your retina or finger print

What are chosen message

Charles generate message and oeesude Alice to encrypt. It and then try to known the encryption key

Known message what is it

Charles known part of message and corresponding ciphertext and try to find the decryption key or encryption. Key

What are ciphertext only attack

Charles only known the ciphertext and have no idea what the message are

Probable chosen message idea

Charles predict the message may contain some word which are related to the message sender or receiver such as company name and so on

What are chosen ciphertext

Charles take apart of the chosen ciphertex abd persuade Bob to decrypt then and from that can generate the decryption key

Example of Ceaser cipher

If k is 5 then letter A become F Letter B become G

What are disadvantage of one time pad

Costly and difficult to organize

which type used by the DES

DES use festiel structure for encryption

What are method to attack

Differential analysis Try all keys

How compression works

It works by replacing the repitited in the text by a short code

What are properties of good cryptosystem

Large block Large key space High speed of execution The same algorithm for encryption and decryption to reduce the development cost and prevent the bottlenecks

It is important that no-one else gets a copy of this digit stream so to achieve perfect secrecy Alice should personally give it to Bob. When Alice wants to send her message to Bob (this may be some time later when Alice cannot physically meet Bob) she codes it into a stream of binary digits. Then for each binary digit in the message she XORs 2 it to the binary digit in the random digit stream at the corresponding position

Message 0 1 1 1 0 0 1 0 1 0 0 1 1... Random Stream 1 0 0 1 1 0 0 0 1 1 0 1 0... Ciphertext 1 1 1 0 1 0 1 0 0 1 0 0 1... Alice sends Bob the ciphertext. Bob uses his copy of the random stream to retrieve the original message. The inverse of XOR is also XOR, so all Bob has to do is XOR the ciphertext with the random stream and he will recover the message.

Communication is intercepted if the attacker interrupts the communication and receives the source information

Modification occurs when the attacker intercepts the communication, alters it in some way, and then sends it on to the destination. The attacker intends to deceive the destination into thinking that the modified communication has come directly from the source. This is also known as a Man-in-the-middle attack

Example of math problem to be solved with fermatts little theorem

Prime number p Number m between 2 and p-1 Number e between 2 and p-1 Compute c=m^e mod p The problem is to find m and you known e and c and p To solve it We calculate d by solve the equation e*d mod(p-1)=1 We can find value of d using Euclid method Then compute m =c^d mod p

What are other name of confidenality

Privacy or secrecy

what types of scheme to provide authentication for e mail

PGP and S/MIME

Examples on subjects

Persons such as Alice Bob or may be a another program or computer

This type of attack can be thwarted by using a relatively inefficient function to encrypt the passwords. Consider that the hacker may have to encrypt millions of possible passwords before a match is found. If each encryption takes one or two seconds then this will take many days. However, for a genuine individual user a time lapse of a few seconds each time they enter their user-name and password is negligible.

Rainbow tables If a well known function, such as a secure hashing function, is used to encrypt passwords then pre-computed rainbow tables can be used to find passwords very quickly

There are 5 types of operation in access control list them

Read Write Append Delete Execute

What does types of permissions on fikes

Read Write Delete Apoend Execute Change permission Change ownership

Give example of protection ring model

Ring with five with 0 in the outer level and 4 in the inner level

Whar is SSH

SH (secure shell) is a protocol which allows data to be securely exchanged between two computers. SSH uses encryption to provide condentiality and integrity of data being passed over an insecure network such as the Internet. Like TLS, SSH uses public key cryptography to authenticate the remote computer. Unlike TLS, SSH also allows the remote computer to authenticate the user if necessary.

what are types of hash function

SHA and MD5 MD5 not used recently

there are five types of secure hash function which are

SHA,SHA1,SHA 384,SHA256,SHA512

WHAT THE HSAH 512 DO IN COMPUTATION STAGE

SHA-512 uses six logical functions which involve shifts, bitstring operations (and,or) and modular arithmetic mod264.

What are the main component of LA padullaa model

Set of subjects s Set of objects o Set of permissions access A Set of security level L

This is hard to achieve although not impossible. The one-time pad is a method of encryption that offers perfect secrecy.

Suppose Alice wants to send Bob a message using the one-time pad. Alice generates a stream of random binary digits (a list of 0s and 1s occurring at random) which is as long as the message. She makes a copy of this stream of digits and gives it to Bob

Number of passwords An intelligent attacker will carry out dictionary and intelligent or modified dictionary attacks before attempting an exhaustive search. This is because, although an exhaustive search is bound to succeed eventually and a dictionary search may fail, if it succeeds, the dictionary search is much faster.

Suppose that passwords are six characters long. If the password is made up only of lower case letters, then there are 26 choices for each character in the password. Hence there are 266 = 308, 915, 776 ≈ 3 8 possible passwords of six lower case letters. If we include lower and capital letters, there are 526 ≈ 2 10 possible passwords. Adding in digits as well, gives a choice out of 62 for each character in the password and there are now 626 ≈ 5.7 10 possible passwords. Finally if we allow any keyboard character including ¡ ¿ * & etc. there are approximately 100 different choices for each character in the password and hence there are 1006 = 1012 possible passwords.

What are types of encryption algorithm

Symmetric and asymmetric types

Aim. Of access control

System. Should be able to identify and authenticate the user to. Identify it

What are TLS and ssl

TLS (Transport Layer Security) is the successor of SSL (Secure Sockets Layer) and is the security protocol used by web browsers to connect securely to web browsers. SSL was implemented by Netscape and became the de facto standard until TLS, which varies only slightly from SSL, came into use in 1999. TLS is now the ofcial version. TLS uses public key infrastructure and certicates issued by a trusted third party, the certication agency or CA. When a TLS client wants to make contact with a server, a handshake is performed which consists of several steps. If any of these steps fail,

which other we use to internet

TLS transport layer security SSH secure shell to provide authentication for internet client

how to recover the original key ?

The key K is recovered by XORing all of the key pieces together: K = X1 ⊕ X2 ⊕ X3 ⊕ . . . ⊕ Xn−1 ⊕ Xn

What types of key used in symmetric key cryptosystem

The key are shared between two parties which used in both encryption and decryption

what key do in key?

The key that is provided as input is expanded into an array of 44 32-bit words wi

Explain the difference between master key and session key

The master key is the key that are used and are stable in it generation as it not changes But session key is the key which generated every time we call. Some thing and this occur in trusted third party exchange Protocols

Which Acess permission type used in LA padullaa security model

The model access control matrix are used

What are relation between security features and access control

The relation are all features depend proper implementation of access control

How do I know that you are who you say you are? The computer must now establish that the person logging into the system as John Smith actually is John Smith. Since the user-name is not a secret, anyone could try to log into the system using the identity of John. The person logging in must somehow prove that they are the genuine John Smith. This is usually done by using a password. The password is a secret and is only known to the genuine user John Smith. By entering this secret password, in conjunction with his user-name, John proves to the computer that he is an authorised user and is allowed access to the system

Thus there are typically two stages in the process of identification. 1. A user-name is used to establish identity. 2. A password is used to establish authentication of identity

What are the benefit of added authentication to siffie hellman. Exchange to protocol

To prevent. Man in.the Middle attack

The password file can be protected by using a one-way function f(x) to encrypt the stored passwords as follows: To create a new user-name/password pair: The user inputs their user-name and password x. The system computes f(x). The password file does not store x but instead stores f(x) indexed by user-name.

To verify a user: The system asks for the user-name and password. The system computes f(x ′ ) where x ′ is the password entered by the user. The system checks to see if there is a match between the f(x) stored for the given user-name and f(x ′ ) just computed. If f(x) = f(x ′ ) then x = x ′ and the user is verified. If f(x) 6= f(x ′ ) then the password entered by the user is incorrect and access to the system is denied.

what are the differecne when use hashing in digital signature

bob create amessage then bob hashing the message with hashing function then encrypte it and then send them to alice alice decrypt the signature and then hashing the message with the same hashing function if the same then it will be good

the last step

bob decrypt the alice message with bob KBS to obtain KAB now both alice and bob known KAB

does n of n escrow protocol practicle

bot practice and not used except in emergency case

how we can encrypt password file

by do the following create user name password pair (x) the system are not tored the password as x it stored as f(x) which is indexed by user name

how we can known if the numer is prime or composite?

by using fermatts little theory

how to improve the security of message in digital signature?

by using hash function

how to inititlse initital values

by using the hash words H0 to h7 WITH HEXADECIMAL

what are ways used to determine the initialisation vector IV

fixed iv counter iv random iv nonce generated iv

how fesistel structure work?

for each round the data block are divided into two halves right and left each half are prcoessd and used as input into other half in the next round

what are one way function ?

function say to be one way if it is easy to compute in one way but hard to compute in reverse

what hash computation stage contain

generate a message schedule and use that schedule along with the functions , constants and word operations

what are methods used in password guessing?

guessing password using the user personal knowledge dictionary searching intelligent searching exhaustive searching

what are factorisation problem are?

it depend on that it is easy to multiply two numbers to produce integer but hard to find the two numbers

what are needham schroner key depend on?

it depended on trusted third party method and have use symmetric key cryptography

how encryption method are done in block cipher

it done block by block act on block to produce a cipher text with the same size

what role of certification agency are?

it gurantee the link beween the key holder and the public key by signing a document which contain user name,public key , name of agency, expire date of dicument

what are question who are you refer to?

it identification part of password method as the user put its name to get the user identification

what mechanism of rainbow tables

it is a tables of password which are fast search for the password in the table to find it

what are intelligent searching are?

many passwords are combinations of letters and numbers in which intelligent search that we try many combination of the letters and numbers apple0, apple1, apple2,....,apple9, apply0, apply1,

what are the idea of hack password guessing personal information?

many people use password that relate to their personal information such as parent name , dog name or other related information

what type of function hash function used?

many to one function are used this mean that there exist different value for for the same h(x) collisions

what are ways that the one time password can be applied?

mathematical algorithm which generate password based on previous password time synchronisation protocol mathematical equation that create password based on challenge such as random number

what type of certification agency may be?

may be governement or finaincial

what are SHA 512 PREPROCESSING CONTAIN(1)

message are padded as use equation of L + 1 + k ≡ 896 mod 1024 l length of message k=smallest non negative soln to equation l=128 bit alway append to the end of the message

ht are output feed back mode depend on ?

message not used and the block cipher are used to generate random streaam of bytes called the keystream the keystream is then cored with the stream to produce the ciphertext

How to generate keystream simply

We can create by using initial key of n bits and generate the next bit by Xoring the first bit and with the last bit of previous n bits

What are practice to generate stream cipher

We create stream cipher from small key

O1 O2 O3 O4 G1 √ √ √ G2 √ √ Table 3.3: Access control matrix with groups

We have not yet considered who has the authority to decide which subjects have which permissions over which objects. The ownership policy may either be discretionary or mandatory.

What are PGP segmentation

We segment the message before encryption. Also. In PGP segmentation

Which things used to represent access control when the system are not hierarchial

We use lists and matrix

How to prevent the high level object to be copied into lower level

We use no write down policy

Is method of certificate

X 509

what the name of standard protocol for certificate issue?

X.509 standard

2 of 2 key escrow what function used?

XOR function are used to hide the original key

what idea of n of n escrow protocol?

Xn = K ⊕ X1 ⊕ X2 ⊕ X3 ⊕ . . . ⊕ Xn−1

How authentication and confidentiality doing with each other

Yes

Can Mac provide an authentication

Yes as it provide define permissions for all processes called subjects which interact with all other objects in the system

Could we break the no read up poocy without known of the high level

Yes by Trojan horse program

Can we make flexibility without breaking the rules

Yes by downgrading all subject and objects to the lower level and then all. Can access to other objects easily

Can hash function used in output feedback mode

Yes it can be used and this give speed and confidentiality perferances than normal

Can security level. Include operations

Yes it can include operations as well

Does LA padula security model are used

Yes it on eof th famous security model used It aim to provide multi user secure operating system

what are good example of one way function?

a good example are multiplying and factorising

A rainbow table is a table that stores the encryption of all possible passwords of a given format. For example, all passwords that are eight characters long and contain lower case letters and digits. These rainbow tables are huge and require a large amount of storage space and initially a lot of time to compile.

are built they can be searched very quickly to find password matches. These tables are used to retrieve lost user passwords and they are very useful for this purpose. However, in the wrong hands they can obviously be used to find passwords for malicious purposes.

what are mechanism of modification?

attacker intercept the information and make changes and send them back to the destination

how does fabrication occur?

attacker set up a communication and send to destination pretending that it come from the source

what happened for after 16 round?

after 16 round the two halves are concatenated with each other

what are aim of CBC

aim that if two identical plaintext will produce non identical ciphertext

what happen when alice receieve all what server send in the second step?

alice decrypt all what send and now he known KAB

how use a symmetric exchange into symmetric key?

alice generate KAB symmetric key alice look for bob public key and encrypt KAB c=encrypt bob public(KAB0 alice send the ciphertext c to bob which decrypt it by it private key to known AB now both alice and bob known the key and begin to exchange them

how alice send message to bob in public key crtptosystem?

alice look for bob public key and encrypt the message using public key and send the encrypted message to bob who can decrypt it using his private keys

how bob receive from alice?

alice send to bob the name of alice and a session key encrypted with KBS

what happen if alice want to communicate with bob?

alice use the public key of the CA to decrypt the certificate she use the same hash function to CA to hash the document she checks to see whether the hash of the document is exactly equal to the decrypted certificate

what rc6 features?

allow direct analysis suitable for use by hardware or software used in number of products of RSA

what mean of key escrow?

allow two or more people to hold part of the key ans each piece of the key reveal no information and can not be used alone and when enough key pieces are available the key reassembled

how we used fixed iv as intitalisation vector

use the same iv every time with not recommended because if the first block of the message are the same it will give the same ciphertext every time give the same problem with ecb

what the action that PGP are used?

use web of trust for key management

what are IDEA FEATURES?

used in PGP in number of commerical uses not use substitution s box used three math functions xor binary addition and multiplication of 16 bit integers has 8 rounds , 6 subkeys for each round subkey used circular shifts

where use the x.509 used?

used in most network security application include ip security

what are advantage of rainbow tables?

used to restore the lost password

what are dictionary searching in it simple way?

user name may choose word to remember word may be in a natural language we can use a dictionary by run a program that try all words in that dictionary until find the password

how to claculate the value of k

value of k k=896-l-1 if l =24 bits then k =896-24-1=871 then the message become message(l) ++1+871 zeros+128 bits in binary then the message parsed in bloks of 1024 length

to prevent attack from charles in nodeham protocol?

we added another step which are signifying that alice or bob receieve the message

how we can prevent the attacker from taking the password ?

we can prevent attacker from the password by education that not give any one your password

hw we can used the hash function?

we can use the hash function to shorten and store data

what are needed in needham method for keys ?

we need trusted third party or server to exchange keys

what should do to ensure the security of public key ?

we should use a large parameter of 200 t0 600 decimal point to defend against exhaustive searching

diffie helam example

we will use equation to form x =g^a mod p y = g^b mod p then exchange x and y then use the equation k=y^a mod p k=x^b mod p generator used only in the first part and the x,y used in the second pary

what are types of trusting public key?

web of trust certificate

to solve the problem of certificate what we use?

web of trust are used to be trust the keys PGP

does rijndael use fesitel algorithm?

no it not use feistel algorithm

what are session key idea?

no need to store many keys you only need a key which are share between the Alice and server and each time invoke the protocol new session key will be form

what are relatd in public ring key

signature trust and key legitimacy

what are the add round key operation?

simple bit wise XOR of the current block with a portion of the expanded key

what shift row ?

simple permutation performed row by row

what are computational complexity in term of size ?

size of the problem are determine it

ranking of password

small letters so n of passwords 26^6 which 6 is pssword length small and capital so n is 52^6 added digits 0-9 then 62^6 allow any keyboard character so it be 100^6

how to prevent fake login

some screen have a unique patterns that cannot be repeated and will be shown to it and impossible to replicate

what are the hash vlue

the hash value the det by the hash computation represent the hash

idea of digital signtaure

the idea is that the holder only have its private key and can be decrypt the signature by it public key and this expalin why it is perfect

what are the input to rijndael

the input is block in encryption and decryption of 128 bits this blcok will copied instate array which is squre matrix of bytes and which modified at each stage in encryption and decryption

what are isea of 2 of 2 key escrow

the key are split into two pieces both of them needed to restore the key

what happen for keys k

the key is split to 16 keys each of 48 bits length

what are the main disadvantages of symmetric key cryptosystem

the number of keys grow as the users numbers grow n=n(n-1)/n

what are the simplest form of spoofing?

the simplest form of the spoofing are simply asking the user to get his password

to decry-pt the password file and verify the user?

the system ask the user for user name and password user enter the password x the system compute x' where f(x') the system check if there is a match between f(x) and f(x') if there are matched between them then the match is completed and log in completed

what are the recommended to password?

the user to change the password every three or four months

in symmetric cryptosystem the value of security are

the value in the key

What are subject and object reprsen

they represent the active and passive part if the process

what are idea of 2 of 3 key escrow

three key pieces are generated any two of three pieces are used to recover the original key we think of original key as decimal value we require a prime parameter p with graeater than k

what are the problem in x 509 certificate?

to certify the key it should have third party involved trusted third party may be corrupted and so there are problem in which all kkeys will be available to any one nnot secure

how we can fast calculate exponentiation

to compute X^n do the following y=1 and x=u repeat if n%2=1 then y=u*y n=n/2 if n not equal to 1 u=u*u until n=1 output y

how fast algorithm for modular exponentiation

to compute x^n mod m initialize y=1 and x=u mod m repeat if n%2=1 then y=y*u mod m n=ndiv 2 if n not equal 1 then u=u*umod m until n=0 output =y

what are the problem we face when use cbc

to decide the value of c0 which will be used to xored with the first plain text

why need hash function easy to compute?

to make computations fast and efficient as cryptographic protocols may need many hash to compute so it should be easy to compute

large key space why

to prevent exhaustive searching

why no collision needed?

to prevent non repudiation

why large block size needed?

to prevent statistical analysis

how to ensure that public key used are specific to certain one which needed?

to prevent the incorrect use of another public key rather than needed

why no pre image needed

to prvent that no two x have the same hash value

what required to implement one time password

token are used in generate the password

example modular inverse of 2 mod 17

.5 mod 17=

Give an example of access control matrix

--------------------------------- Prolg. Database 1. Database 2 --------------------------------- Alice {e}. {r,w} Bon ---------------------------—----

what are the basic protocol to generate three pieces protocol?

1- alice ,the holder of key k , generate a random number a ,and three random number x1,x2,x3 must be different and between in 1 and p 2-alice compute ki=((a*xi)+k)mod p for i=1,2,3 3-alice keep the value of a secret and give the each of three key holders(xi,ki)

We have the following sets: a set of subjects S a set of objects O a set of access operations A = {execute, read, append, write} a set of security levels L with a partial ordering ≤. 1 Every subject is allocated a maximum security level fs and a current security level fc. Every object has a security classification

1. A subject can read an object only if the subject's security level is greater than or equal to the objects classification. This is a no-read up policy

give ashort expression to protocol used third party

1. A −→ S : A, B 2. S −→ A : eKAS(B, KAB, eKBS(A, KAB)) 3. Alice decrypts to get B, KAB, eKBS(A, KAB) 4. A −→ B : eKBS(A, KAB) 5. Bob decrypts to get A, KAB

How we make encryption sequence

1. Alice signs the original message m as before: sig = pk:encryptApriv(h(m)) 2. Alice compresses the original message using the ZIP algorithm M = ZIP(m). 3. Alice generates a session key, K, and uses it to encrypt the compressed message and the signature. c =sk:encryptK(M;sig) 4. Alice encrypts the session key using Bob's public key to obtain K′. 5. Alice sends Bob the pair (K′;c). 6. On receiving (K′;c) from Alice, Bob decrypts K′ using his own private key to obtain K. K =pk:decryptBpriv(K′) 7. Bob decrypts the ciphertext c using the session key K to obtain M and sig. (M;sig) = sk:decryptK(c) 8. Bob decompresses M to obtain the original message m. m=UNZIP(M) 9. Bob now has the message m. In order to authenticate it he uses Alice's public key Apub to decrypt the signature and hashes the message m. If the two results match then the message is authenticated. h(m) ?= pk:decryptApub(sig)

How radix 64 system work

1. The binary input is split into blocks of 24 bits (3 bytes). 2. Each 24-bit block is then split into four smaller blocks each of 6-bits. 3. Each 6-bit block will then have a (decimal) value between 0 and 26 −1 = 63. This value is encoded into a printable character using Table 11.1.

what are towfish?

128 block length with key length of 256 bits 16 fesistel round similar to DES sbox are key dependent unlike the des

what are the second step in hash computation

2. Initialise the eight working variables a, b, c, d, e, f, g and h with the (i − 1)st hash value: a = H (i−1) 0 , b = H (i−1) 1 , . . . , h = H (i−1)

example of modularity

25 mod 7 = 4 18 mod 12 = 6 573 mod 2 = 1

What are the commercial message alphabet length

2^128 bit is the avarage message alphabet length

How much bits can be generate by simple method

2^n - 1 bits can be generated

how many many three keys

3 keys

how we can improve DES ?

3DES triple DES increase the keysize

what operation added to ensure that no interception in the message from alice to bob?

6. B −→ A : eKAB(NB) 7. A −→ B : eKAB(NB − 1)

Under DAC, there are really only two major categories of users, administrators and non-administrators. In order for services and programs to run with any level of elevated privilege, the choices are few and course grained, and typically resolve to just giving full administrator access. Solutions such as access control lists can provide some additional security for allowing non-administrators expanded privileges but for the most part a root account has complete discretion over the file system

A MAC or non-discretionary access control framework allows you to define permissions for how all processes (called subjects) interact with other parts of the system such as files, devices, sockets, ports, and other processes (called objects). This is done through an administratively-defined security policy over all processes and objects. These processes and objects are controlled through the kernel and security decisions are made on all available information rather than just user identity.

In cryptography, the one-way problems used are mathematical functions. A good example of a mathematical one way function is multiplying/factorising. A one-way function is a function f : X → Y which satisfies the following two properties: Given x in X it is easy to compute y = f(x) in Y . Given y in Y it is very difficult to find an x in X such that f(x) = y.

A good example of a mathematical one-way function is multiplying/factorising. It is very easy (especially given a computer or calculator) to multiply together two integers, even if those integers are very large. However, given the resulting number, it is very hard (even with access to a computer) to find the two numbers that were originally multiplied together. In this example, both X and Y are the set of positive integers.

what are SHA 512

ALGORITHM used message schedule of 80(64 bits)words w0 to w79 eight working variables (64 bits) a,b,c,d,e,f,g,h hash value 8 (64 bits) words H0,h7 result is message digest of 512 bits

What are steps to rsa decryption

Bob take the value of c and and decrypt it using the private key d which by the following M=c^d mod n

What are type of users under DAC

Administrators and non administrators

what are the main idea of needham shroder key exchange?

Alice and server have a shared key KAS BOB and server have shared key KBS alice and bob want to establish a shared key KAB

Steps to PGP confidentiality

Alice generate a random session key for a symmetric cryptosystem Alice encrypt k using Bob public key K′ =pk:encryptBpub(K) Alice encrypt the message using the session k to obtain c = sk:encryptK(m) Alice send the values of k- and c to Bob Bob decrypt the k by its own private key Obtain k Then decrypt the message using the session key m=sk:decryptK(c)

How steps to combine authentication and confidentiality

Alice generate a signature for his message as authentication protocol Alice generates a signature for her message as in the authentication protocol: sig = pk:encryptApriv(h(m)) 2. Alice generates a random session key K and encrypts the message m and the signature sig using a symmetric cryptosystem to obtain ciphertext c. c =sk:encryptK(m;sig) 3. Alice encrypts the session key using Bob's public key. K′ =pk:encryptBpub(K) 4. Alice sends Bob the values of K′ and c.

What are rsa encryption steps

Alice look at Bob public key in the directory which are e, n It convert the message into numbers of different length Alice Comoute the ciphertext by C=m^e mod n

Steps of PGP authentication

Alice send a message m to Bob Alice hash the message to obtain h(m) Alice encrypt the hashed message using her private key to obtain the signature Alice send to Bob m and signature When Bob receive the message he decrypt the message using public key of alice Bob compute the hash of message as same hash of alice used and obtain the message If h m is equal to message so the message are authenticated and Bob have verify that message are from bob

Access control is often not as hierarchical or clear cut as in the example above and so a protection ring may not be a suitable model. Instead we might write an access control list which gives details of a subject's particular access writes to an object, or an access control matrix which combines details of different subjects and objects and defines the rights of the subjects over the objects. We can also illustrate these access control policies by drawing an access control graph.

Alice: prog1{execute}; database1{write, read}; database2{read} Bob: prog1{write, read, execute}; database1{read}

Example of access control lists

Alice: prog1{execute}; database1{write, read}; database2{read} Bob: prog1{write, read, execute}; database1{read}

decryption in rijndael

All of the operations are easily reversible. The decryption algorithm makes use of the expanded key in the reverse order to recover the plaintext

What are the main modes in access control

Alter read and write delete Append Observe read only and execute

Describe the anarchy model

Anarchy key distribution model. Is the model on which trusted keys is used

The base of using large block size

As block size increase thus lead to more difficult to decrypt the ciphertext without using a key

Password spoofing A spoofing attack is when the user is fooled into giving the hacker their password. Spoofing attacks may be very simple or very sophisticated

Asking the user This may sound unlikely, but it is a fact that a lot of people will tell you a password if you can convince them that you need to know it.1 For example, the hacker may phone the user, and tell them that he is from their office computer staff and that there is a problem with the files. All backed-up information is going to be lost so he needs the user password in order to recover the data. Sometimes an approach as simple as this will work and the user is fooled into giving the hacker their password. This attack will fail if the user has been educated in computer security and refuses to reveal their password.

Why PGP allow user to have more than one or more public key or private key

Because it is not a cryptosystem but it is a combination of best practices of the cryptography Also public key rings are used PGP to construct public key hierarchies

Why Ceaser cipher may be easy to intercept

Because only 25 keys are avaliable and then it easy to cryptanalyst to known that plaintext by try every key until. Find the menangiful meaning

How block cipher and stream cipher encrypt data

Block cipher encrypt data block by block and stream cipher encrypt data in a key stream continously stream cipher

Symmetric key cryptosystem can be

Block cipher or stream cipher

How to improve performance of linear feed back shift register

By using combining data with each other using the output and combing function to produce the output

How we can increase security

By using single normal alphabet we have 27 letter block when make the block 2 it will have 27^2 of alphabets And so on

What are types of substitution cipher

Ceaser cipher Random substitution cipher

equation used in cbc

Ci = Encrypt(K, Pi ⊕ Ci−1)

What are relation between key stream and plain text and ciphertext are

Ci = Pi ⊕K Pi = Ci ⊕K Ki =Ci ⊕Pi

What are different types to attack cryptosystem

Cipher text only Known message Probable known message Chosen ciphertext Chosen message Chosen ciphertext and message

Accountability Accountability means that the system is able to provide audit trails of all transactions. The system managers are accountable to scrutiny from outside the system and must be able to provide details of all transactions that have occurred. Audit trails must be selectively kept (and protected to maintain their integrity) so that actions affecting security can be traced back to the responsible party

Communication is interrupted if the attacker does not allow the information to reach the destination

List the feature of security system

Confidenality Non reoudation Integrity Avaliablity Acess control Accounatbility Authentication

Information can be stolen - but you still have it. If a physical item such as a car is stolen then the thief has possession of the car and you no longer have it. If a thief steals a file from your computer, he will probably make a copy of the file for himself and leave the original on your computer. Hence you still have the file but it has also been stolen.

Confidential information may be copied and sold - but the theft might not be detected. If your car has been stolen it is not hard to detect the fact - the car is missing! However as mentioned above, a thief who steals computer files may leave the files on your computer and only copy them for himself. Nothing appears to have changed on your computer so you may not be aware that anything untoward has happened

The criminal may be on the other side of the world. If a thief steals your car you at least know where he was when he stole the car. However, it is possible to hack into computer systems remotely from anywhere in the world. This makes it very hard to know who is responsible for catching a computer criminal. Is it the police in the country where the computer is, or the police in the country where the criminal is?

Computer security deals with the prevention and detection of unauthorised actions by users of a computer system.

List five types of security model.

He bell LA padula Chinese wall Clark Wilson Harisson Biba model

Which attack are common against availability

Denial of service attack are the most one against it availability of information

Eat are the symmetric system used today

Des AES rijandael Rc6 Blowfish Idea

What are other properties should block cipher and what they mean and why they are needed

Diffusion Confusion Completeness

What are types of ownership policy

Discretionary or mandatory

These permissions are from the set {read, write, execute}. Three different sets of access rights are defined for the file: one is for the file's owner (usually the user who created the file), one is for the file's group (usually the principal group of the file's owner but sometimes the directory group if this has been set using Set GroupID3 ), and the last is for all other users (i.e., those users who are neither the owner nor in the file's group).

Each file in Unix is really a pair consisting of the filename and the i-node number of the file. The i-node number contains a lot of information about the file including: where the file is stored the length of the file the last time the file was read the last time the file was written the last time the i-node was read the last time the i-node was written the owner - generally the UID of the user who created the file a group - the GID of the group that the file belongs to 12 mode bits which encode a set of access rights

What are substitution cipher re

Each letter in the plain text are substituted for another letter to make the ciphertext

The model should have some flexibility

Enable some subject to break the rule. Of both no read up or no write down by temporiately upgrading the security level trust subjects

What are the main idea in protection ring model

Every subject and object have a security level

The rule that are used in protection ring model

Every subject can access any object with the same level or less than it's level

Password guessing Suppose that a hacker wants to access a system which is protected by a user-name/password identification system. We will assume that the hacker knows the user-name of an authorised user since this information is not generally secret. Therefore if the hacker can guess the user's password he will gain access to the system

Guessing using personal knowledge of the user Many people use passwords which relate to them personally. For example, they may use the name of their spouse or child or pet. They may use their football team or street name or birth date. If the hacker can find out personal information about the user, then they may be able to guess a personal password without too much difficulty. This attack will fail if the user is careful not to use a password which is personally related to them in any way.

What if the ownership policy are mandatory

If the ownership is mandatory so the Acess permission are determine by the company security policy under regulations

If the ownership policy is discretionary the owner of the resource decides who has access permission. For example, I could write a web page and post it openly on the Internet so that everyone has access. Alternatively, I could post the web page with a password access control system and then decide to whom I give the password.

If the ownership policy is mandatory then the security system manager allocates permissions according to the security policy of the organisation.

Temporarily downgrade a subject's level from fs to fc where fc < fs. Identify a set of subjects which are allowed to violate the no-write down policy. These are called trusted subjects.

If the three rules are satisfied then the state of the model is called secure. Furthermore the basic security theorem states that if you start with a secure state and all transitions are secure then every subsequent state will also be secure.

Should the security system be simple or sophisticated? As discussed above, there are disadvantages to having a security system, not least in terms of time and cost. The more sophisticated a system the costlier it is likely to be. On the other hand, a system which is too simple may not provide the necessary level of security

In a distributed system should the security be centralised or spread? Should a security manager have ultimate control, for example over access control issues (this will make it easier to achieve a consistent and rigorous approach, but may cause time delays if the security manager has to be applied to for every change of access rights)? Alternatively, should individual users be allowed to choose who has access to their files? See section 3.3.3 for a description of how SELinux implements mandatory access control.

prog1 database1 database2 Alice {e} {w,r} {r} Bob {w,r,e} {r} { } Table 3.1: Access control matrix

In a large organisation, it is likely that several subjects will all have the same access control permissions. These subjects can be grouped together and the group access permissions listed.

When can we use the one time pad method

In critical situations

What are aim of PGP aurhentication

In e mail if Alice send e mail to Bob then Bob should ensure that e mail are from Lice and not third party

Risk analysis When designing or implementing a computer security system it is very important to bear in mind the level of risk involved and the value of the information that is to be protected. As an illustration, consider that you may be willing to leave £50 in a changing room locker, but you would not be likely to leave £5,000 unattended. You would assess the risk involved before deciding whether to leave the money or not. On the other hand, it would be foolish to pay someone, say £20, to look after your £50, but this might be a good investment in the case of the £5,000 (assuming that you totally trust the person charged with keeping your money safe of course!).

In terms of computer security, the disadvantages of security systems are that they are time consuming, costly, often clumsy, and impede management and the smooth running of the system. Risk analysis is the study of the cost of a particular system (in terms of effort and time as well as cost) against the benefits of the system (the level of security offered).

In order to prevent and detect unauthorised actions by its users a good security system should provide (some of) the following features: confidentiality integrity availability non-repudiation authentication access controls accountability

In this context, the term unauthorised implies not only malicious or criminal, but could also be accidental. For example, a breach of confidentiality arises maliciously if a spy deliberately hacks into a computer and looks at confidential material stored there. It happens accidentally if the material is left out on a desk and is seen by the office cleaner.

Protection ring model If access control is strictly hierarchical, this can be illustrated by a simple protection ring model.

In this model, every subject and object is given a security level. Subjects can access all objects at their own level or lower. A security level may involve operations as well. For example, read and write permission may be at a higher level than read only

What we mean by term of collision in hashing function

In which hashing function have the hashing many to one function i . Which many value can hashing to the same value

Information security different from the traditional security discuss these statement

Information are stolen but still present Confidential information can be copied and sold The criminal may be on the other side of the world

What type. Of stream generated in one time pad

It is random stream which are binary

Confidentiality Confidentiality is the prevention of unauthorised disclosure of information. In other words, confidentiality means keeping information private or safe. Confidentiality may be important for military, business or personal reasons. Confidentiality may also be known as privacy or secrecy

Integrity Integrity is the prevention of unauthorised writing or modification of information. Integrity in a computer system means that there is an external consistency in the system - everything is as it is expected to be. Data integrity means that the data stored on the computer is the same as what is intended.

Dictionary searching Another favourite method of generating easy to remember passwords is for the user to choose a word, usually in their own language. If the hacker cannot directly guess the user's password then he may set up a dictionary attack. This means that he will run a computer programme which tries every word in a dictionary as the password of the user until he finds a match. This attack will fail if the user does not use a word which appears in a dictionary as their password.

Intelligent searching Some user-name/password systems insist that the user's password contains a mix of letters and numbers. The most common thing for a user (who has not been educated in password security) to do is add a number onto the end of a word. For example, using a password such as banana1. An intelligent dictionary search might try all words with numbers added. Thus if the hacker knows that a particular password system insists that passwords are a minimum of six characters long and must contain at least one number, then the hacker may try all five letter words with each of the digits 0,..,9 attached. Thus apple0, apple1, apple2,....,apple9, apply0, apply1,... and so on would form part of this search.

What are types of attacks

Intercepted Interrepted Modification fabrication

What are the component of PGP authentication protocol

It is a digital signature with hashing

What does unauthorized action refer to

It is not refer to only a malicious but also can be accidental

What are jet in Ceaser cipher

It is number called k and it is between 1 and 25

iv not resused

K0 = IV Ki = Encrypt(K, Ki−1) Ci = Pi ⊕ Ki

What are PGP key issues

Key generation Key identifiers

What are the problem with one time pad method

Key stream are random it is good But it can not be generate simultaneously

What are idea of Ceaser cipher

Letter of alphabet are moved by certain number to another letter to form ciphertext

What are kind of method that can generate the keystream

Linear feedback shift register

what are the example of communication modification

Man in the middle attack

Why need email. Compatability

Many electronic mail systems can only transmit blocks of ASCII text

Accountability meaning in security

Mean that should known the accountable party for security in transaction and determine which party responsible on it

give an example of prototcol which make key exchange using trusted third party?

Needham-Schroeder protocol

Password shadowing means that the encrypted password field of /etc/password is replaced with a special token and the encrypted password is stored in a separate file (or files) which is not readable by normal system users

Networked systems may also use NIS (Network Information System) which allows many machines on a network to share configuration information, including password data. On a machine with NIS there will be a very short /etc/password entry and the real password file is elsewhere. Note that NIS is not designed to promote system security.

Does access control always hierarchial

No it not often hierarchial

After encryption what happen to the message if it obtain by interceptro

No thing interceptor not known the meaning of ciphertext and so the original message winot known

Availability Availability is the prevention of unauthorised with-holding of information. Information should be accessible and usable upon appropriate demand by an authorised user. Denial of service attacks are a common form of attack against computer systems whereby authorised users are denied access to the computer system. Such an attack may be orchestrated by the attacker flooding the system with requests until it cannot keep up and crashes. Authorised users are unable to access the system. Consider the damage that such an attack may cause to an electronic commerce site such as an internet shop

Non-repudiation Non-repudiation is the prevention of either the sender or the receiver denying a transmitted message. Non-repudiation is often implemented by using digital signatures

In general, if a password is n characters long and is made up from an alphabet of A different characters, then there are An possible different passwords.

Note that the average time for a hacker to find a particular kind of password is only half the time taken to do a complete search (i.e. if a user has chosen a dictionary word as their password, then the hacker will, on average, only have to search through half of the dictionary in order to find the password). Likewise, on average, a hacker using an exhaustive search will only have to search through half of the possible passwords before finding a match.

Unix access control Subjects in Unix are users. Each user belongs to at least one group, their principal group. They may also belong to other groups. If a user belongs to more than one group then they will have a designated principal group. For example, a user may belong to the groups Staff and Project1 where Staff is their principal group.

Objects in Unix are files. Unix thinks of all resources as files. Each file belongs to a user and a group, and has a set of permissions associated with it.

examples of objects in access control

Objects such as data files. Or any other shared resources

One-time passwords Given enough time and attempts, a static password (i.e. a password which remains the same) may be accessed by an unauthorised attacker. To counter this, some systems are now making use of one-time passwords or OTP. By constantly changing the password, the risk of the password being discovered is greatly reduced. Furthermore, an attacker who does find a password, will only be able to use it to gain access to the system once. The next time the attacker tries to use the password it will be rejected.

One-time passwords typically work in one of three ways. A mathematical algorithm is used to generate a new password based on the previous password. A time synchronisation protocol is used between the authentication server and the client providing the password. A mathematical algorithm is used to create each new password based on a challenge such as a random number chosen by the authentication server and a counter.

cryptographic protection A password file can be encrypted by using a one-way function. After encryption, the password file is just a list of garbled characters. Even if a hacker manages to view the file, it will not help him to gain access to the system.

One-way functions A problem is said to be one-way if it is easy to do one way but hard to do in reverse. A non-mathematical example is making a cup of instant coffee. It is easy to put coffee granules, boiling water and milk into a mug and stir them together to make a cup of coffee. However, given a cup of coffee, it is difficult to reverse the operation and retrieve the separate components of milk, coffee granules and water.

What are the type. Of one. Pad time

One. Pad time. Is a kind of stream cipher

For example, suppose that Alice, Bob and Charles are subjects and a database is an object. We could either say that Alice has write and read access, Bob has read only access and Charles does not have any access to the database

Operations and modes Operations that the system may offer include: read write (which may or may not automatically include read access) append execute delete

Modes that the system may offer include: observe (look at the contents) alter (change the contents)

Operations are defined by the security model. Modes are basic notions of what can be done to an object. The relationship between operations and access modes can be summarised as follows:

What are padding

Padding is complete the plaintext block before encryption to complete the block size according to the normal division of it

To avoid pre-compiled rainbow tables being used on a security system, the function used to encrypt the passwords should be somehow unique to the system. Pre-compiled tables will therefore not be available. If a user loses or forgets their password it will be irretrievable. An alternative secure method for resetting the lost password to a new value will have to be devised.

Password salting Password salting is a process used to ensure that all passwords in a system are unique. Most systems insist that all user-names are unique. If a new user tries to create an account with a user-name that is already in use, they will be informed that the user-name is already used and that they should choose another. However, the system cannot inform a new user that the password they have chosen is already in use - that would be a gift for a hacker! Instead, the system adds some salt which is another piece of information such as the user-name to all the passwords before encryption. This ensures that every password is unique.

Other name for one pad time

Perfect secrecy

each message process to general rule ?

Prepare the message schedule (W0, W1, . . . , W79) by expanding the 1024-bit message block M(i) into 80 64-bit words using the following algorithm. Wt = Mi t 0 ≤ t ≤ 15 σ 512 1 (Wt−2) + Wt−7 + σ 512 0 (Wt−15) + Wt−16 16 ≤ t ≤ 79

What are the main cornerstone of security

Prevention Detection Reaction

What are the main goal. Of security

Prevention of attacks from cryptanalyst

What is availability

Prevention of unauthorized with holding. Of information

What are encryption are

Process of ransformation of plaintext which are readable to ciphertext which are not readable text

HOW THE Decryption of fesistel are processed

Ri=LI+1 LI=Ri+1 xored (ki,Ri)

3. An access control matrix M is defined and subject s can only perform operation a on object o if (s, o, a) is (ticked) in the access control matrix. This is called a secure transition.

Rules 1 and 2 mean that subjects could in theory write a document which they cannot read. Also a subject at a high security level cannot send messages to a subject at a lower level. Obviously this is not very practical so the model allows the ability to: Temporarily downgrade a subject's level from fs to fc where fc < fs. Identify a set of subjects which are allowed to violate the no-write down policy. These are called trusted subjects.

How do you secure the levels below the level of the security system? An attacker may manage to gain access to the operating system and from there make alterations to access control limitations giving themselves access to other parts of the system. The logical access controls of the system may be by-passed by gaining direct access to the physical memory. It is therefore important to ensure that physical security measures are in place as well as the logical computer security mechanisms.

Security models Computer security protects the computer system and the data it processes. Success depends on the implementation of security controls designed for the system. A security model is a means of formally expressing the rules of the security policy. The model should: be easy to comprehend be without ambiguity be possible to implement reflect the policies of the organisation

What re condition required in any stream key

Should be unpredictable stream

What re the rule which related to access matrix

Subject can only perform operation a on object I if s, o, a are in the access matrix

What are non read up policy are

Subject can read the object only if the subject have a security level. More than the object

What are subjects in Acess contril

Subject is what the person do or who do the action. On the object

Example of access in protection ring model

Subject with level 4 can access any object with level of 4 or less than

How to get around the non read up policy

Subject with low securitylevel persuade the subject of high security model to copy the content and take it a copy with new document with low security model

The system offers this access of subjects such as users, processes and other applications.

Subjects and objects represent respectively the active and passive parties in a request for access. In defining access controls, we can either specify: what a subject is allowed to do; or what may be done with an object.

What are the main component of the access control security

Subjects, objects, modes, permissions, operations

What are PGP compression are

The PGP compress the message using zip and decompress using unzip

Encryption is the process of transforming a plaintext message (a message that can be read) into an unreadable encrypted form called a ciphertext message.1 The intention of encryption, is that if the encrypted message is intercepted, then the interceptor will not be able to interpret the ciphertext.

The aim of anyone encrypting a message is to ensure that no-one viewing the resulting ciphertext will be able to decrypt or make any sense of the ciphertext,

What are the basic idea of Le padullaa model

The basic idea is that information can not flow from high security to low security level

What is block cipher idea

The data are divided

what are block size and key size in DES?

block size are 64 key size are 56

ttacking an encrypted password file If a hacker manages to access a password file which has been encrypted using a one-way function, all he will see is the encrypted passwords, indexed by user-names. These encrypted passwords will not enable the hacker to access the system, and the actual passwords are not stored anywhere.

The function used to encrypt the passwords is not usually a secret, so the hacker may try to find an actual password by running a computer program that encrypts a dictionary list or an exhaustive list of passwords and then check to see if the result matches any of the stored encrypted passwords. If a match is found then the hacker has a password and can now gain access to the system

How stream cipher work

The plain text are encrypted bit by bit by adding a keystream

What are the main component of one time pad method

The plain text in binary format Stream of keys which generate by Alice and send it to Bob Xor the plain text with the stream key and the result will be ciphertex To decrypt with Bob Bob xoring the ciphertext with stream key to obtain the original. Message

what are new in AES?

block size of 128 key size of 192,128,256

the final step in hash 512

The values of H (N) 0 , H (N) 1 , . . . , H(N) 7 are concatenated to produce the 512-bit message digest

what third step in hash computation

The values of a, b, c, d, e, f, g and h are operated on using the six logical functions and with input of the eighty W values and temporary variables T1 and T2

Permissions for files may include: read write execute append delete change permission change ownership.

There are different ways of expressing access control permissions including lists, matrices and graphs.

The password file, where the system stores the data for verifying passwords, is very sensitive to attack. In an insecure system, the password file will be a list of passwords indexed by user-name. A hacker with access to this file has potential knowledge of every password. It is therefore essential that the password file is protected.

There are essentially two ways in which the password file can be protected: using cryptographic protection implementing access control over the password file. Ideally, the password file should be both encrypted and protected from unauthorised access by the implementation of access controls.

A basic identification system consists of a database of passwords indexed by user-names. This is called the password file. When a user logs into the system, the computer checks that the user-name and password input match an entry in the password file. If a match is found, the process is complete and the user is allowed access to the system. If not, access is denied although the user may be given another chance to enter their user-name and password.

There are various ways in which a user-name/password identification system can be abused. The simplest attacks include the hacker looking over the user's shoulder when they are typing in their password, or finding a written note that the user has 12 Threats made of their password. I

Exhaustive searching If the user has been clever enough to use a random, meaningless string of characters as their password, then the hacker may have to resort to trying an exhaustive search attack. An exhaustive search is similar to a dictionary search, but in the exhaustive case, the computer programme used by the hacker will try every possible combination of permissible characters as the password in order to find a match. Thus if searching for a six character password, the hacker might try aaaaaa, aaaaab, aaaaac, ....., aaaaaz, aaaaa0,...., aaaaa9, aaaaa*, etc. and move systematically through all possible permutations.

This attack will always succeed eventually. Since every possible password is tried in turn sooner or later a match will be found. However, there are ways of making an exhaustive search so time consuming for the hacker that it is not successful during the life of the password (i.e. before the exhaustive search is successful the password has been changed). Some password systems insist that the users change their passwords every three months, for example.

Fake log-in screens A more sophisticated spoofing attack is when the hacker sets up a fake log-in screen which exactly resembles the genuine log-in screen for the system. The user is presented with this log-in screen and unsuspectingly enters their user-name and password. The hacker captures this information and then typically gives the user an error message saying that they have incorrectly typed in their password. The genuine log-in screen is then displayed. The user cannot be sure that they did not make a typing mistake, so they type in their user-name and password again and gain access to the system. The user may have no idea that they have been the victim of a spoofing attack

This attack will fail if the user notices that there is something wrong with the log-in screen and so does not enter their user-name and password. Some log-in interfaces contain patterns or pictures which are impossible to replicate accurately. The attack can be detected (although not prevented) if the user is informed, at every log-in, of the time of the last failed log-in attempt. After a spoof attack, the user thinks that they had a failed log-in. If when the user successfully logs in, the system does not inform them of this failed log-in then the user is alerted to the fact that they may have been the victim of a spoof attack.

Every subject which have the same operation permission will grouped

This lead to decrease the database size and easy to control.

What are idea of random substitution cipher

This time we replace the letter with random letter

How many steps RSA required

Three step Key generation Encryption Decryption

WHT are aim. Of confidentiality

To make information private and safe

What are type of ownership inSlinux

Type are mandatory

A real life example of access control is SELinux (Security-enhanced Linux). SELinux is an implementation of a mandatory access control mechanism. This mechanism is in the Linux kernel and checks for allowed operations after standard Linux discretionary access controls are checked.

Under DAC, ownership of a file object provides potentially crippling or risky control over the object. A user can expose a file or directory to a security or confidentiality breach with a misconfigured chmod command and an unexpected propagation of access rights. A process started by that user, such as a CGI script, can do anything it wants to the files owned by the user

However, it is possible, without breaking any of the rules, to: downgrade all subjects to the lowest level downgrade all objects to the lowest level give all subjects permission to perform any operation on any object by completely filling in the access control matrix.

Unix - access control in practice Finally we will look at an actual control access model and see what happens in real life rather than in theory. We will be looking at how Unix deals with access control.

Which system. Is example to deal. With access control

Unix is deal with access control

what are the key exchange type in el ammal ?

diffie hellman key exchange

Unix users and superusers In Unix every user has an identifier, their user name, and each user belongs to one or more groups. Every Unix system has one user with special privileges. This superuser has user ID 0 and usually the user name root. The root account is used by the operating system for essential tasks like login, recording the audit log, or accessing I/O devices. Almost all security checks are turned off for the superuser. The root account is required to perform certain tasks such as installing certain software. The system manager who holds the root password should never use the root account as their personal account but should change to user root as and when necessary to perform a superuser task

Unix security measures Users are authenticated by user name and password. Passwords are encrypted using a one-way function which is based on the DES algorithm and run 25 times. The encrypted passwords were traditionally stored in the /etc/password file. However, most modern Unix systems use either password shadowing or NIS and much of the Unix password data is stored elsewhere.

How to overcome email compatability problem

Use radix 64 system conversion

PGP use what

Web of trust model. For key management so. It. Lead to have more than one or private public keys

Why linear feedback are widely used in keystream generator

Well use in implementation in hardware produce a sequence of a large period with no Repetition up to 2n _1

To send confidential email between two parties

What are PGP confidenatilty

Does the system focus on the data, operations or users of the system? For example, is it more important to have a data focused rule such as: Only data of type A can be inserted in data box A or a user focused rule such as: Only section managers are able to access the information in data box A?

What level should the security system operate from? The security system may consist of a software package that runs on top of the operating system, such as Norton Internet Security which runs on top of Windows. Alternatively, it may be part of the hardware and have physical control over the data such as where it is stored and how it is manipulated, for example Security Enhanced Linux (SELinux).

Entries in the password file have the following form: accountname : encryptedpassword : U ID : groupID : IDstring : homedirectory : loginshell and so may look something like this: RS : ru78Pjey : 92 : 4 : Shipsey,R : /usr/RS : /bin/sh

When changing their password, users must supply the old password first to guard against another person changing the password. The new password must be entered twice in order to confirm that it has been typed correctly. The actual characters of the password are never shown on the screen but appear as * or • characters instead. Passwords may be salted if required. Controls can be set so that weak passwords are rejected. Password expiry dates can also be set, together with enforced rules on the re-use of old passwords. Root login can be restricted to specially nominated terminals only.

When use the protection ring model

When the security system are strictly hierarchy

User-names and Passwords When a computer system has to verify a user's identity, there are two basic questions that have to be asked and answered appropriately

Who are you? The computer system has to establish somehow who is trying to gain access to its files. This is usually done by use of a user-name which, although probably unique to the user, is not a secret. The user-name is often simply produced using all or part of the user's actual name. For example, the user-name of John Smith might be JSmith or johnsmith. When John Smith correctly enters his user-name, the computer can establish, by looking in a database of authorised user-names, that John Smith is an authorised user of the system.

what does AES mean

advanced encryption standard

which operations are performed at the begin and end of the process

add round key

what are sequence of fesistel structure

block are divides into two parts the half left of the output at next round is the right haldf of the previous round li+1=R the new right half is the xored of the left half with f(RI,KI)

why should compute any length?

because hash function should able to process data of any length

why key chaining is not very efficient ?

because if cryptoanalyst known one key so he can known the key changing after that key

why should public keys authorised to be related to person

because if with mistake use anther public key or person it will lead to malicious action by that person which the message are understandable to him

why hash function are strong

because it is one way function which compute in one way and difficult to solve in reverse

why computational complexity?

because there are several algorithms to perform certain task so we need to judge the efficiency of ecah algorithm comparing to another one

which property hash function contain

diffusion property small change in message will produce a large change in the hash function value

computer security model should be?

can be comprehend be without ambiguity be possible to implement

Equations for rsa

cd = (me)d modp = m(ed) mod p = m(k(p−1)+1) mod p = mk(p−1) ×m1 mod p = (mp−1)k ×mmodp = 1k×mmodp = m

what are mode to resolve the problem of electronic codebook

cipher block chaining mode (cbc)

what are phishing ?

communication such as instant messages and email are pretained to that the same as fake login sites such as e pay and paypal which ask to give their names and passwords and other details

what does PGP provide?

confidentiality authentication compression segmentation

what are component of certificate??

consist of public key together with an identification of key holder

What are one-time passwords?

constantly changed password will lead to decrease the problem of making the password changed

what are DES ?

data encryption standard in which used to encrypte data

what are password file composition

database of passwords indexed by users name

numbers of passwords?

depend on the combination of the password that doing by the user

how A legitimacy value is given to the key

depend on who signed it

are there a question should be asked ?

does the systems focus on data , operations or users of system?

what hash function intital features ?

easy to compute easy to find collisions easy to fine pre image should be crypt graphically strong

what features of RSA

easy to implement and hard to break

what are strengths in rijnadeal

eay to implement and flexible , very efficient and require less memory can be implemeted in hardwre

what are method used to calcuate modular inverse

eculid algorithm

what are the key chaining?

encrypt the new key according to the previous key

what are idea of exhaustive searching ?

exhaustive searching are similar to the dictionary searching it try all possible permutations combination of numbers and letters in the dictionary

what are other method in spoofing?

fake log in screen

what happedned to the block at the final stage

it copied in the output matrix

There are many security models which can be used to describe how access control is to be managed. These include: the Bell-LaPadula Model the Harrison-Ruzzo-Ullman Model the Chinese Wall Model the Biba Model the Clark-Wilson Model.

he Bell-LaPadula model The Bell-LaPadula security model (BLP) is one of the most famous security models. It was developed by Bell and LaPadula and aims to provide a secure multi-user operating system. Access permissions are defined by an access control matrix and security levels. The basic idea is that information cannot flow from a high security level to a lower security level.

how to attack password file system encrypted?

if attacker can known the function in which used to store thepassword file

why it is not recommended to use electronic codebook mode

if blocks are repeated and block use the same key so it will produce the same hypertext which it is easy to cryptoanalyst

when we say that number is prime ?

if it has only two factor it self and number 1

when say that hash function are collision resistance ?

if it is impossible to find two value which give the same hash function

what are the main equation to fermats little theorem

if p is integer and a is integer between 1 and p-1 then the following should be right a^p-1 mod p =1

the general method of computing password?

if password n of n length and of alphabet A characters so the number of passwords possible are A^n

what are congruent number ?

if r mod s = m mod s then r and m are congruent

What are rainbow tables?

if secure hashing function used pre computed tables can be used to find the password easily

what are the number make the problem of factorisation impossible to solve?

it decimal number which are about 200 decimal value

why we need block cipher modes

if the plain text is greater than length of on block cipher so it should be in specific mode in order to encrypt the whole message

what happen if need to create a user name repeated?

if try to make this this will lead to error that it is it already present

what are mean of interrupted attack?

in which attacker does not allow information to reach destination

what benefits of using euclid algorithm

include only multiplications and division computational complexity of ob^2

Password Salting

insist that used names are also unique

how to use trusted third parties?

instead of alice generating its key it rely on third party to do this and to delivery to bob and herself

what are the benefit of modular arithmetic

instead of use the whole number we use only the modulus of this number by using mod

what is substitution bytes operation in rijndael?

is look up table in s box is used to perform a byte to byte substitutions of the block

what does the computational complexity of calculating mod?

is ob^2 because taking mod isdivision and subtraction so tke 2 sp to reach the result

what are difference between DES and AES?

is possible to think of the data in Rijndael as being polynomials with co-efficients of either 0 or 1. This means that, unlike DES, it is possible to write a Rijndael encryption as an algebraic formula

what are the mean of exponentiation

is raising to the power important part in RSA and ELgamal

what mean to find collisions?

is that hard to find x1 and x2 as h(x1)=h(x2) in which these collision in feasible amount of time

what does rijndael formed of ?

it be 128 bit block size and 128,192,256 bits length

how to make identification more secure??

it become more secure as put password to it as it is easy to login with the user name only

how the digital signature work?

it calculated using the private key of the signer and decrypted using the public key of the signer

hat are the first value to be xored called

it called italicisation vector

what happen if the block size greater than normal

it compromise the speed

given y in Y

it is hard to find x where y=f(x)

what are the idea of electronic codebook mode

it is simplest method and include divide the plaintext into blocks and then encrypt each one individually Ci = Encrypt(K, Pi)

how use nonce generated key

it is solution to iv problem nonce is number used once and each message assigned a number with a counter this is nonce instead of using nonce as iv the nonce are encrypted by the block cipher in ECB mode to generate the IV nonce generated iv

what are the risk analysis ?

it is the study of the cost of implement a security system versus the benefit of that system

what are disadvantages of computer security?

it is time consuming costly money

what are new in output feedback mode

it is used block cipher as stream cipher

what should consider when implement computer security system?

it is very important to bear in mind the level of security needed and the value of information to be secure

WHAT HAPPEN TO MESSAGE with hash function

it iterative and message are processed and condensed to produce message digest

what are disdavtage of rainbow tables?

it may be used by malicious used to known the password

what are diffusion property

it mean that any small change in plain text will produce large change in the cipher text this prevent chosen message and chosen cipher text attack through differential analysis

what mean that attacker intercept communication?

it mean that attacker intercept the communication to receive information

what are completeness property and why it is needed?

it mean that every bit in cipher text should depend on every bit of the key this prevent divide and conquer attack

the computer security is computerised-social?

it need to persons conscious about computer security and how to set up passwords

does PGP is cryptosystem

it not cryptosystem but conatin the best avaliable cryptgraphic algorithms

what does digital signtaure provide?

it provide a mean of identification and authentication

what password resemble ?

it resemble your identity as passport which give you identification for travelling to another r country

how to use random iv

it s more secure than others in which use random number but have a problem in how to generate random number and how we can exchange that with the others

what we should do with password file?

it should be encrypted and implementing access control to prevent any unauthorised access to password file

what are the pseudo number generator ?

it take a seed and then begin to generate the key generation

how to use counter iv

it the same fixed but we use cunter iv=0 iv=1 and so on and this will lead to problem that it can be expected

what are computational complexity mean ?

it used to determine the efficiency of algorithm

how cbc are worked

it worked by xored the plain text with the previous block of the ciphertext

what are t in n key escreow

key are split into pieces any t of n (1<t<n) can be used to recover key

what are the key management issues?

key generation(how and by whom the key generated) key storage(how are the key stored) key distribution(how are the keys distributed to appropriate users) key replacement (how often the key often be replaced)

what are the modular inverse of a mod p

modular inverse of a mod p is b in which b<p-1 also a*b mod p=1 denoated by a^-1 modp

what are other method to transfer the keys?

more time consuming and costly use convert channels in place in a regular basis

whic protocol used trusted third party?

needham shroedor protocol

what are the computational complexity of modular multiplication?

o b^3

how we can encrypt password file?

one way function can be used to encrypt the password file

what are the heart of rsa ?

one way function in which depend on factorization

what happen if the attacker find the password?

only one time the password are used by the user if try to use it again it will be not use it and rejected

which operation only use the key?

only operation of add round key use the key

given two integers

p*q=n

what does pre processing involve ?

padding the message parsing the padded message into m bits setting initialisation values

what are the most method used in break password?

password guessing

what are the two stage of hash

pre processing hash computation

what are the mean of PGP?

pretty good privacy

what are password salting?

process that ensure that are password used are unique

what are asymmetric cryptosystem are?

public key cryptosystem

what are the practice pf web of trust

public key ring are used as web of trust model

how many keys in public key cryptosystems?

public key that known and present in dictionary private key which are specific to the user and it owner

what are the idea of cipherblock chaning mode

randomised the plain text using the previous cipher text

why complexity is important when study cryptography?

rsa and elgammal need modular calcuation so it is important to use an efficient method for calculation

what are the definition of S/MIME

secure multipurpose internet mail extension use public key certificate x.509

what does server send to alice in the step 2?

server send to alice the following all encrypted by the KAS 1- name of bob 2-a session key for alice and bob to be shared 3-the name of alice and a session key both encrypted using KBS

alwhat alice do if want to use PGP TO USE IN EMAIL?

she will have to build up the public key ring containing the public key of other users

what are other

should system be implemented simple or sophisticated

what are password spoofing?

spoofing attack when the user are fooled to give the attacker their password

what are the first operation used in encryption and decryption?

start with add round key operation which followed by nine round include four operations followed by tenth round of three operation

how to find inverse of b mod a

static long find inverse(long a , long b){ long store =a long temp long q int sign =1 long r=1 long s=0 while b(!=0){ q=a/b temp=r r=temp*q+r s=temp temp=b b=a-q*temp a=temp sign=-sign} long answer = (r − (sign ∗ s))%store; return answer } }

what are feature of public keys?

stored openly should be genuine related to person with declared person

what are mix columns ?

substitution algorithm in which that alter each byte in a column using a function which take all inouts in the column

what are the different operations are used

substitution bytes shift rows mix columns add round key

what are operation used

substitutions and permutations

examples on digital signature

suppose alice want to send to bob the digital signature dig=encryptbobpriv(message) bob send to alice the message and signature alice use bob public key to decrypt the signature and then check if the message after decrtption are the same message unencrypted so he message orginiate from bob

who is faster public key or symmetric key

symmetric key more faster than public key

Phishing Phishing is similar to the above. Communications such as emails or instant messages purporting to be from reliable sites such as eBay, PayPal or online banks direct users to a fake website which looks very like the genuine one. Here the user is asked to input their username, password and perhaps their bank details. Phishing is a growing problem and attempts to deal with it include legislation, user training, public awareness and technical security measures.

t is important that the users are informed of the following measures: The user should always set up a password and not leave the password option as blank. The user should change the default password. The user should change their password frequently. The user should not use the same password for all systems. When changing a password, the user should not just add a digit onto the end of the old password. The user should not choose a password that relates to them personally such as their date of birth or the name of their child. The user should not choose a dictionary word as their password. The user should not choose a password that is too short. The user should choose a password that contains a mix of letters and numbers. The user should not write their password down or reveal it to anyon

what does hash function work?

take data of arbitrary size and return a value in a fixed range , if you hash the same data at different time it will produce the same hash

example of hash function ?

take the full name of person and return two letters which represent the first name and last name , if we hash the same name in different date it will produce the same two character

what are confusion property and why needed

that mean if the key is nearly correct should not given any indication about this make exhaustive searching more harder

what are construction of 3 DES

that mean that key size are tripled and the 2^168 this will defeat the exhaustive search but the block size remain the same unchanged 64 bits block size

what mean that it hard to find pre images

that mean there hard to find x in which y = f(x) by exhaustive search in definite time

what are the advantage of public key over symmetric key

that private key are required to be stored

Cryptography

the art of protecting information by transforming it into an unreadable format, called cipher text

what are the average time for searching in ?

the average time for a hacker to find a particular kind of password is only half the time taken to do a complete search

what are the currently used block size

the currently are 256 and it related directly to alphabet size

how to avoid the pre compiled rainbow table

the function should be unique to the system

what are the base to security

the greater the block size the greater the security

what are the idea of fake log in screen

the hacker set up a fake log in screen which are resemble the genius log in system screen the users presented with this fake login and gve user name and password then give message that you put the password wrong then the original fake login displayed

who issue the certificate ?

trusted third party which called certification agency

what are the type of RSA?

type of RA arepublic key cryptosystem

An attacker may also make up a communication and send it to the destination pretending that it has come from the source. This is called fabrication.

types of attack

from where does block cipher use key?

use a key from key space with a particular size

what are the realtion of symmetric and a symmetric key ?

use asymmetric key method to exchange key and then use

png is cryptographcally strong?

when cryptoanalyst can not

what happen when the user login the system ?

when the person log into the system then it show if the system are gin the system and match the password in the password file with that used name if matched the the user name will be login

what are the two question asked ?

who are you? how to known that you what you say ?

what intelligent attacker do before do exhaustive searching?

will carry dictionary attack and modified dictionary attack before attempting exhaustive searching

which commerical cmapy use SHA

windows use hash function to hash the [assword of users

given x in X it easy to find

y=f(x)

does keysize is important?

yes if key size is small so the key space will also small and this may lead to easy exhaustive searching

is there way to break and hack the password system ?

yes there are many ways

example of getting password by asking the user?

you may receive a call from the attacker that tell you that system company will be fail so we need your password to retrieve information and save that