网络安全重点技术英文习题集网络安全重点技术

《网络安全重点技术英文习题集网络安全重点技术》由会员分享，可在线阅读，更多相关《网络安全重点技术英文习题集网络安全重点技术（47页珍藏版）》请在装配图网上搜索。

1、网络安全技术英文习题集Chapter 1 IntroductionANSWERS NSWERS TO QUESTIONS1.1 What is the OSI security architecture?The OSI Security Architecture is a framework that provides a systematic way of defining the requirements for security and characterizing the approaches to satisfying those requirements. The document

2、 defines security attacks, mechanisms, and services, and the relationships among these categories.1.2 What is the difference between passive and active security threats?Passive attacks have to do with eavesdropping on, or monitoring, transmissions. Electronic mail, , and client/server exchanges are

3、examples of transmissions that can be monitored. Active attacks include the modification of transmitted data and attempts to gain unauthorized access to computer systems.1.3 Lists and briefly define categories of passive and active security attacks?Passive attacks: release of message contents and tr

4、affic analysis. Active attacks: masquerade, replay, modification of messages, and denial of service.1.4 Lists and briefly define categories of security service?Authentication: The assurance that the communicating entity is the one that it claims to be. Access control: The prevention of unauthorized

5、use of a resource (i.e., this service controls who can have access to a resource, under what conditions access can occur, and what those accessing the resource are allowed to do).Data confidentiality: The protection of data from unauthorized disclosure.Data integrity: The assurance that data receive

6、d are exactly as sent by an authorized entity (i.e., contain no modification, insertion, deletion, or replay).Nonrepudiation: Provides protection against denial by one of the entities involved in a communication of having participated in all or part of the communication.Availability service: The pro

7、perty of a system or a system resource being accessible and usable upon demand by an authorized system entity, according to performance specifications for the system (i.e., a system is available if it provides services according to the system design whenever users request them).Chapter2 Symmetric En

8、cryptionand Message ConfidentialityANSWERS NSWERS TO QUESTIONS2.1 What are the essential ingredients of a symmetric cipher?Plaintext, encryption algorithm, secret key, ciphertext, decryption algorithm.2.2 What are the two basic functions used in encryption algorithms?Permutation and substitution.2.3

9、 How many keys are required for two people to communicate via a symmetric cipher?One secret key.2.4 What is the difference between a block cipher and a stream cipher?A stream cipher is one that encrypts a digital data stream one bit or one byte at a time. A block cipher is one in which a block of pl

10、aintext is treated as a whole and used to produce a ciphertext block of equal length.2.5 What are the two general approaches to attacking a cipher?Cryptanalysis and brute force.2.6 Why do some block cipher modes of operation only use encryption while others use both encryption and decryption?In some

11、 modes, the plaintext does not pass through the encryption function, but is XORed with the output of the encryption function. The math works out that for decryption in these cases, the encryption function must also be used.2.7 What is triple encryption?With triple encryption, a plaintext block is en

12、crypted by passing it through an encryption algorithm; the result is then passed through the same encryption algorithm again; the result of the second encryption is passed through the same encryption algorithm a third time. Typically, the second stage uses the decryption algorithm rather than the en

13、cryption algorithm.2.8 Why is the middle portion of 3DES a decryption rather than an encryption?There is no cryptographic significance to the use of decryption for the secondstage. Its only advantage is that it allows users of 3DES to decrypt data encrypted by users of the older single DES by repeat

14、ing the key.2.9 What is the difference between link and end-to-end encryption?With link encryption, each vulnerable communications link is equipped on both ends with an encryption device. With end-to-end encryption, the encryption process is carried out at the two end systems. The source host or ter

15、minal encrypts the data; the data in encrypted form are then transmitted unaltered across the network to the destination terminal or host.2.10 List ways in which secret keys can be distributed to two communicating parties.For two parties A and B, key distribution can be achieved in a number of ways,

16、 as follows:(1)A can select a key and physically deliver it to B.(2)A third party can select the key and physically deliver it to A and B.(3)If A and B have previously and recently used a key, one party can transmit the new key to the other, encrypted using the old key.(4)If A and B each has an encr

17、ypted connection to a third party C, C can deliver a key on the encrypted links to A and B.2.11 What is the difference between a session key and a master key?A session key is a temporary encryption key used between two principals. A master key is a long-lasting key that is used between a key distrib

18、ution center and a principal for the purpose of encoding the transmission of session keys. Typically, the master keys are distributed by noncryptographic means.2.12 What is a key distribution center?A key distribution center is a system that is authorized to transmit temporary session keys to princi

19、pals. Each session key is transmitted in encrypted form, using a master key that the key distribution center shares with the target principal.ANSWERS NSWERS TO PROBLEMS2.1 What RC4 key value will leave S unchanged during initialization? That is, after the initial permutation of S, the entries of S w

20、ill be equal to the values from 0 through 255 in ascending order.Use a key of length 255 bytes. The first two bytes are zero; that is K0 = K1 = 0. Thereafter, we have: K2 = 255; K3 = 254; K255= 2.2.2 If a bit error occurs in the transmission of a ciphertext character in 8-bit CFB mode, how far does

21、the error propagate? Nine plaintext characters are affected. The plaintext character corresponding to the ciphertext character is obviously altered. In addition, the altered ciphertext character enters the shift register and is not removed until the next eight characters are processed.2.3 Key distri

22、bution schemes using an access control center and/or a key distribution center have central points vulnerable to attack. Discuss the security implications of such centralization.The central points should be highly fault-tolerant, should be physically secured, and should use trusted hardware/software

23、.Chapter 3 Public-Key Cryptography and Message AuthenticationANSWERS NSWERS TO QUESTIONS3.1 List three approaches to message authentication.Message encryption, message authentication code, hash function.3.2 What is message authentication code?An authenticator that is a cryptographic function of both

24、 the data to be authenticated and a secret key.3.3 Briefly describe the three schemes illustrated in Figture3.2.(a) A hash code is computed from the source message, encrypted using symmetric encryption and a secret key, and appended to the message. At the receiver, the same hash code is computed. Th

25、e incoming code is decrypted using the same key and compared with the computed hash code. (b) This is the same procedure as in (a) except that public-key encryption is used; the sender encrypts the hash code with the senders private key, and the receiver decrypts the hash code with the senders publi

26、c key. (c) A secret value is appended to a message and then a hash code is calculated using the message plus secret value as input. Then the message (without the secret value) and the hash code are transmitted. The receiver appends the same secret value to the message and computes the hash value ove

27、r the message plus secret value. This is then compared to the received hash code.3.4 What properties must a hash function have to be useful for message authentication?(1)H can be applied to a block of data of any size.(2)H produces a fixed-length output.(3)H(x) is relatively easy to compute for any

28、given x, making both hardware and software implementations practical.(4)For any given value h, it is computationally infeasible to find x such that H(x) = h. This is sometimes referred to in the literature as the one-way property.(5)For any given block x, it is computationally infeasible to find y x

29、 with H(y) =H(x).(6)It is computationally infeasible to find any pair (x, y) such that H(x) = H(y).3.5 In the context of a hash function, what is a compression function?The compression function is the fundamental module, or basic building block, of a hash function. The hash function consists of iter

30、ated application of the compression function.3.6 What are the principal ingredients of a public-key cryptosystem?Plaintext: This is the readable message or data that is fed into the algorithm as input. Encryption algorithm: The encryption algorithm performs various transformations on the plaintext.

31、Public and private keys: This is a pair of keys that have been selected so that if one is used for encryption, the other is used for decryption. The exact transformations performed by the encryption algorithm depend on the public or private key that is provided as input. Ciphertext: This is the scra

32、mbled message produced as output. It depends on the plaintext and the key. For a given message, two different keys will produce two different ciphertexts. Decryption algorithm: This algorithm accepts the ciphertext and the matching key and produces the original plaintext.3.7 List and briefly define

33、three uses of a public-key cryptosystem.Encryption/decryption: The sender encrypts a message with the recipients public key. Digital signature: The sender signs a message with its private key. Signing is achieved by a cryptographic algorithm applied to the message or to a small block of data that is

34、 a function of the message. Key exchange: Two sides cooperate to exchange a session key. Several different approaches are possible, involving the private key(s) of one or both parties.3.8 What is the difference between a private key and a secret key?The key used in conventional encryption is typical

35、ly referred to as a secret key. The two keys used for public-key encryption are referred to as the public key and the private key.3.9 What is digital signature?A digital signature is an authentication mechanism that enables the creator of a message to attach a code that acts as a signature. The sign

36、ature is formed by taking the hash of the message and encrypting the message with the creators private key. The signature guarantees the source and integrity of the message.3.10 What is a public-key certificate?A pubic-key certificate consists of a public key plus a User ID of the key owner, with th

37、e whole block signed by a trusted third party. Typically, the third party is a certificate authority (CA) that is trusted by the user community, such as a government agency or a financial institution.3.11 How can public-key encryption be used to distribute a secret key?Several different approaches a

38、re possible, involving the private key(s) of one or both parties. One approach is Diffie-Hellman key exchange. Another approach is for the sender to encrypt a secret key with the recipients public key.ANSWERS NSWERS TO PROBLEMS3.1 Consider a 32-bit hash function defined as the concatenation of two 1

39、6-bit functions: XOR and RXOR, defined in Section 3.2 as “two simple hash function.”a. Will this checksum detect all errors caused by an odd number of error bits? Explain.b. Will this checksum detect all errors caused by an even number of error bits? If not, characterize the error patterns that will

40、 cause the checksum to fail.c. Comments on the effectiveness of this function for use a hash functions for authentication.a. Yes. The XOR function is simply a vertical parity check. If there is an odd number of errors, then there must be at least one column that contains an odd number of errors, and

41、 the parity bit for that column will detect the error. Note that the RXOR function also catches all errors caused by an odd number of error bits. Each RXOR bit is a function of a unique spiral of bits in the block of data. If there is an odd number of errors, then there must be at least one spiral t

42、hat contains an odd number of errors, and the parity bit for that spiral will detect the error.b. No. The checksum will fail to detect an even number of errors when both the XOR and RXOR functions fail. In order for both to fail, the pattern of error bits must be at intersection points between parit

43、y spirals and parity columns such that there is an even number of error bits in each parity column and an even number of error bits in each spiral.c. It is too simple to be used as a secure hash function; finding multiple messages with the same hash function would be too easy.3.2 Suppose H (m) is a

44、collision resistant hash function that maps a message of arbitrary bit length into an n-bit hash value. Is it true that, for all messages x, x with xx,we have H(x)H(x)?Explain your answer.The statement is false. Such a function cannot be one-to-one because the number of inputs to the function is of

45、arbitrary, but the number of unique outputs is 2n. Thus, there are multiple inputs that map into the same output.3.3 Perform encryption and decryption using the RSA algorithm, as in Figture3.9, for the following:a. p=3;q=11;e=7;M=5b. p=5;q=11;e=3;M=9c. p=7;q=11;e=17;M=8d. p=11;q=13;e=11;M=7e. p=17;q

46、=31;e=7;M=2.Hint: Decryption is not as hard as you think; use some finesse.a. n = 33; (n) = 20; d = 3; C = 26.b. n = 55; (n) = 40; d = 27; C = 14.c. n = 77; (n) = 60; d = 53; C = 57.d. n = 143; (n) = 120; d = 11; C = 106.e. n = 527; (n) = 480; d = 343; C = 128. For decryption, we have128343 mod 527

47、= 128256 12864 12816 1284 1282 1281 mod 527= 35 256 35 101 47 128 = 2 mod 527= 2 mod 2573.4 In a public-key system using RSA, you intercept the cipher text C=10 sent to a user whose public key is e=5, n=35.What is the plaintext M?M = 53.5 In an RSA system, the public key of a given user is e=31, n=3

48、599.What is the private key of this user?d = 30313.6 Suppose we have a set of blocks encoded with the RSA algorithm and we dont have the private key, Assume n=pq, e is the public key. Suppose also someone tells us they know one of the plaintext blocks has a common factor with n. Does this help us in

49、 any way?Yes. If a plaintext block has a common factor with n modulo n then the encoded block will also have a common factor with n modulo n. Because we encode blocks that are smaller than pq, the factor must be p or q and the plaintext block must be a multiple of p or q. We can test each block for

50、primality. If prime, it is p or q. In this case we divide into n to find the other factor. If not prime, we factor it and try the factors as divisors of n.3.7 Consider a Diffie-Hellman scheme with a common prime q=11 and a primitive root a=2.a. If user A has public key YA=9, what is As private key X

51、A?b. If user B has public key YB=3, what is the shared secret key K?a. XA = 6b. K = 3Chapter 4 Authentication ApplicationsANSWERS NSWERS TO QUESTIONS4.1 What problem was Kerberos designed to address?The problem that Kerberos addresses is this: Assume an open distributed environment in which users at

52、 workstations wish to access services on servers distributed throughout the network. We would like for servers to be able to restrict access to authorized users and to be able to authenticate requests for service. In this environment, a workstation cannot be trusted to identify its users correctly t

53、o network services.4.2 What are three threats associated with user authentication over a network or Internet?A user may gain access to a particular workstation and pretend to be another user operating from that workstation. 2. A user may alter the network address of a workstation so that the request

54、s sent from the altered workstation appear to come from the impersonated workstation. 3. A user may eavesdrop on exchanges and use a replay attack to gain entrance to a server or to disrupt operations.4.3 List three approaches to secure user authentication in a distributed environment.Rely on each i

55、ndividual client workstation to assure the identity of its user or users and rely on each server to enforce a security policy based on user identification (ID). 2. Require that client systems authenticate themselves to servers, but trust the client system concerning the identity of its user. 3. Requ

56、ire the user to prove identity for each service invoked. Also require that servers prove their identity to clients.4.4 What four requirements are defined for Kerberos?Secure: A network eavesdropper should not be able to obtain the necessary information to impersonate a user. More generally, Kerberos

57、 should be strong enough that a potential opponent does not find it to be the weak link. Reliable: For all services that rely on Kerberos for access control, lack of availability of the Kerberos service means lack of availability of the supported services. Hence, Kerberos should be highly reliable a

58、nd should employ a distributed server architecture, with one system able to back up another. Transparent: Ideally, the user should not be aware that authentication is taking place, beyond the requirement to enter a password. Scalable: The system should be capable of supporting large numbers of clien

59、ts and servers. This suggests a modular, distributed architecture.4.5 What entities constitute a full-service Kerberos environment?A full-service Kerberos environment consists of a Kerberos server, a number of clients, and a number of application servers.4.6 In the context of Kerberos, what is a rea

60、lm?A realm is an environment in which: 1. The Kerberos server must have the user ID (UID) and hashed password of all participating users in its database. All users are registered with the Kerberos server. 2. The Kerberos server must share a secret key with each server. All servers are registered wit

61、h the Kerberos server.4.7 What are the principal difference between version 4 and version 5 of Kerberos?Version 5 overcomes some environmental shortcomings and some technical deficiencies in Version 4.4.8 What is the purpose of the X.509 standard?X.509 defines a framework for the provision of authen

62、tication services by the X.500 directory to its users. The directory may serve as a repository of public-key certificates. Each certificate contains the public key of a user and is signed with the private key of a trusted certification authority. In addition, X.509 defines alternative authentication

63、 protocols based on the use of public-key certificates.4.9 What is a chain of certificates?A chain of certificates consists of a sequence of certificates created by different certification authorities (CAs) in which each successive certificate is a certificate by one CA that certifies the public key

64、 of the next CA in the chain.4.10 How is an X.509 certificate revoked?The owner of a public-key can issue a certificate revocation list that revokes one or more certificates.ANSWERS NSWERS TO PROBLEMS4.1 Show that a random error in block of cipher text is propagated to all subsequent blocks of plain

65、text in PCBC mode (Figure 4.9).An error in C1 affects P1 because the encryption of C1 is XORed with IV to produce P1. Both C1 and P1 affect P2, which is the XOR of the encryption of C2 with the XOR of C1 and P1. Beyond that, PN1 is one of the XORed inputs to forming PN.4.2 The 1988 version of X.509 lists properties that PSA keys must satisfy to be secure, given current knowledge about the difficulty of factoring large numbers. The discussion conc