Name: Osama Jaradeh
CIS534 Midterm
1. What is “brute-force attack”? How the “brute-force attack” is related to
Keyspace (the range of possible value of the Key)? Why the issue of number of bit
required in a key to ensure secure encryption is controversial?
A brute -force attack is applying all possible value of a key to the algorithm until you
succeed in deciphering the message. The longer the key space the more difficult is to
learn the key in brute force attack. The issue of the number of bits required in a key to
ensure secure encryption is controversial because the longer the number of bits the more
computationally expensive the encryption and the decryption process can be. The goal is
to make breaking a key cost more than the value of the information the key is protecting.
2. Very briefly describe the three types of cryptographic functions (Symmetric,
Asymmetric and Hash) that enable authentication, integrity, and confidentiality.
Symmetric encryption or secret key encryption uses a common key and the same
cryptographic algorithm to scramble and unscramble a message. For example, Caesar
Cipher. Some secret key algorithms operate on fixed length message blocks. Therefore, it
is necessary to break larger message into n-bit blocks and somehow chain them together.
Example of secret key algorithm:
Data Encryption Standard (DES)
3DES
Rivest Cipher (RC4)
International Data Encryption Algorithm (IDEA)
Advanced encryption standard (AES)
Asymmetric encryption or public key encryption uses a pair of keys, a public key and a
private key. It can use either the same algorithm, or different but complementary
algorithms to scramble or unscramble data. Public key encryption algorithms are rarely
used for data confidentiality because of their performance constraints. Public key
encryption algorithms are typically used in applications involving authentication using
digital signatures and key management.
Some of the common public key algorithms are RonRivest, Adi Shamir, Adi Shamir, and
Leonard Adleman (RSA) algorithm and El Gamal algorithm.
Public key encryption is slow compared to symmetric encryption and vulnerable to manin-the-middle attack.
Hash Function:
A hash function takes an input message of arbitrary length and outputs fixed-length code.
The fixed-length output is called the hash, or the message digest, of the original input
message. One way hash functions are typically used to provide the finger print of a
message. A hash finger print is unique and thereby proves the integrity and authenticity
of the message. Common hash functions are:
Message Digest 4 (MD4) algorithm
Message Digest 5 (MD5) algorithm
Secure Hash Algorithm (SHA)
3. What are three challenges with secret key encryption?
Three challenges with secret key encryption:
Changing the secret keys frequently to avoid the risk of compromising the keys
Securely generating the secret keys
Securely distributing the secret keys
4. What are the improvements of 3DES (Data Encryption Standard) over DES?
Why the 3DES with one key is used at all?
3DES has longer key length makes brute force attack more difficult, 3 DES can use one,
two or three keys.
3DES with one key is used for backward compatibility with DES.
5. A centralized key distribution model relies on what entity to issue keys?
A centralized key distribution model relies on a trusted third party, Key distribution
center (KDC) to issue the keys.
6. Which algorithm is commonly used to create secret session keys in a distributed
manner?
Diffie-Hellman algorithm is commonly used to create secret session keys in a distributed
manner.
7. What transport protocol is commonly used for SSL? Why?
SSL assume that the underlying packets delivery is reliable. SSL uses TCP as its
transport.
8. List three things that are part of an IPSec security association (SA)?
The ESP encryption algorithm and key(s)
The AH authentication algorithm and key
A shared session key
9.What is the primary reason for classifying VPNs into access VPNs, Intranet VPNs,
and extranet VPNs?
The primary reason is the security policy variations. A good security policy details
corporate infrastructure, information authentication mechanism and access privileges.
This will vary depending on how the corporate resources are accessed.
10. What is NAT, why it is used, and what is its security issue?
NAT stands for Network Address Translation which is often used in environments that
have private IP address space as opposed to ownership of globally unique IP address.
NAT will translate the unregistered IP address into legal IP addresses that are routable in
the outside public network. When IPSec session runs through NAT, security is often
compromised.
The IPSec Authentication header (AH) protects entire IP packets, including header
against modification in transit. NAT modifies the IP header, so is inherently incompatible
with AH.
11. Security Technology protocols are grouped according to their shared attributes
of:
a. Identity Technologies
b. Security in TCP/IP structured layers
c. Virtual Private Dial-up security Technologies
d. Public Key Infrastructure and distribution models
Name and briefly describe one example for each of the above four Security
Technology group.
A-Identity Technology:
Token Password Authentication
Token authentication systems generally require the use of a special smart card or token
card. Although some implementations are dome using software to alleviate the problem
of loosing the smart card or token this types of authentication mechanisms are based on
one or two alternatives schemes:
Challenge-Response
Time-Synchronous Authentication
Steps for authentication:
Step1: The user dials into an authentication server, which then issues a prompt for a user
id.
Step2: The user provides the ID to the server, which then issues a challenge a random
number that appears on the user’s screen.
Step3: The user enters that challenge number into the token or smart card, a credit-cardlike device, which then encrypts the challenge with the user’s encryption key and
displays a response.
Step4: The user types this response and sends it to the Authentication server. While the
user is obtaining a response from the token, the Authentication server calculates what the
appropriate response should be based on its database of user keys.
Step5: When the server receives the user’s response, it compares that response with the
one it has calculated
If the two responses match, the user is granted access to the network. If they do not match
access is denied..
B-Security in TCP/IP structured layers
Secure Shell Protocol:
The Secure Shell (SSH) is a protocol for secure remote login and other secure network
services over an insecure network. It provides support for secure remote login, secure file
transfer, and the secure forwarding of TCP/IP and X Windows system traffic.
The SSH protocol consists of three major components:
The Transport layer protocol, which provides server authentication, confidentiality,
and integrity with perfect forward secrecy. Optionally, it may also provide compression
The user authentication protocol, which authenticates the client to the server.
The connection protocol, which multiplexes the encrypted tunnel into several logical
channels.
C-Virtual Private Dial-up security Technologies
Enable large enterprises to extend their private networks across dial-up lines. Instead of
incurring large costs to ensure security by dialing into a campus site from any where in
the world or lessening security by dialing in locally and using the Internet as the transport
to get to the main enterprise campus. Example:
Point to point Tunneling Protocol:
Was initiated by Microsoft. It is a client/server architecture that allows the Point-to-Point
Protocols (PPP) to be tunneled through an IP network and decouples functions that exist
in current NASs.
D-Public Key Infrastructure and distribution models
The purpose of a Public Key Infrastructure (PKI) is to provide trusted and efficient key
and certificate management to support these protocols. A PKI is defined by the Internet
X.509 Public Key Infrastructure PKIX Roadmap “work in progress” document as follow:
The set of hardware, software, people, policies, and procedures needed to create,
manage, store, distribute, and revoke certificates based on public-key cryptography
A PKI consists of the following five types of components:
1. Certification Authorities (CAs) that issue and revoke certificates.
2. Organizational Registration Authorities (ORAs) that vouch for the binding
between public keys, certificate holder identities, and other attributes.
3. Certificate holders that are issued certificates and that can sign digital documents.
4. Clients that validated digital signatures and their certification paths from a known
public key of a trusted CA.
5. Repositories that store and make available certificates and Certificate Revocation
Lists (CRLs)
The function of the PKI can be as following:
Registration: The process where a subject first makes itself known to Certificate
Authorities (CA)
Initialization: the user or client system gets value it needs to begin communication with
PKI.
Certification: The process in which CA issues a certificate for a subject public key and
return the certificate to the subject.
Key Pair Recovery: The CA must provide a system for key recovery without
compromising the private key.
Key Generation: Depending on the CA Policy, the private/public key pair can either be
generated by the user in the local environment or generated by the CA
Key update: All key pairs are updated regularly.
Cross Certification: A certificate is issued by one CA to another CA
Revocation: Some circumstances may cause a certificate to become invalid for example
change of name and compromise or suspected compromise of the private key. The CA
revoke the certificate under this conditions.
12. What is Denial of Service attack? Briefly describe 3 types of common DoS
attacks.
Denial of service attack is any action that prevents any part of a network or a host system
from functioning in accordance with is intended purpose.
TCP SYN attack:
TCP SYN attack exploits the three way handshake design for TCP connection
establishment by having an attacking source host generate TCP SYN packets with
random source toward a victim host. The victim destination host sends a SYN/ACK to
the random source address and adds an entry to the connections queue. Because the
SYN/ACK is destined for an incorrect or nonexistent host, the last part of the three ways
handshake is never completed, and the entry remain in the connection queue until a timer
expire. By generating phony TCP SYN packets from random IP address at a rapid, an
intruder can fill up the connection queue until a timer and deny TCP services to
legitimate users.
Land.c attack
The Land.c attack sends TCP SYN packet giving the target host’s address as both the
source and destinations and using the same port on the target host as both the source and
destinations. This can cause may operating system to hang.
The smurf attack and Fraggle Attack
The smurf attack is performed by sending an ICMP echo request ping packet with the
victim’s address as the source address to a network’s broadcast address. The fraggle
attack is similar except it uses UDP packets. If the network router and network servers
are configured to respond to a network address ping packet, all the servers on that subnet
will respond to the forge source IP address, flooding the victim’s site