2 Security Some students are starting a newspaper called 352times, they have the fol- lowing security goals: a Anyone should be able to read the paper with minimal effort, without doing anything more than sending a request to the newspaper's server and reading the request in plaintext, ignoring any part of it that is not plaintext b Those who care should be able to put in a bit more effort to verify that the newspaper was written by the true authors, without any additional communication with the newspaper c Any unauthorized changes in the newspaper should be detected by the group of people who care 17. Write the protocol that the people who want to verify the authorship and detect any unauthorized changes would use.

2 Security Some students are starting a newspaper called 352times, they have the fol- lowing security goals: a Anyone should be able to read the paper with minimal effort, without doing anything more than sending a request to the newspaper's server and reading the request in plaintext, ignoring any part of it that is not plaintext b Those who care should be able to put in a bit more effort to verify that the newspaper was written by the true authors, without any additional communication with the newspaper c Any unauthorized changes in the newspaper should be detected by the group of people who care 17. Write the protocol that the people who want to verify the authorship and detect any unauthorized changes would use.

Database System Concepts

7th Edition

ISBN:9780078022159

Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Publisher:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Chapter1: Introduction

Section: Chapter Questions

Problem 1PE

See similar textbooks

Similar questions

create the confused deputy attack using an example program or using the cross-site request forgery on the web. You can use any language / environment / platform to create / reproduce the confused deputy problem. most preferrably python , it is a question from information security course.
File hashing and password encryption are different. Difference?
Suppose Alice and Bob have RSA public keys in a file on a server. They communicate regularly using authenticated, confidential messages. Eve wants to read the messages but is unable to crack the RSA private keys of Alice and Bob. However, she is able to break into the server and alter the file containing Alice's and Bob's public keys. How should Eve alter that file so that she can read confidential messages sent between Alice and Bob, and forge messages from either? How might Alice and/or Bob detect Eve's subversion of the public keys?
Authorization lists need to be encrypted and secured since they are so vulnerable to manipulation. Suppose these files were accidently changed; what would happen?
We saw in class that password management is a complex problem with mulJple dimensions to it.Within the realm of password set-up rules, many factors including human memory limitations with longand complex passwords, overhead in frequently asking users to change passwords, attacker capabilitiesand more must be balanced against providing robust and secure authentication.For this assignment, imagine that you are taking over as the Authentication Manager of an IT firm, andyou identify that things were done ad-hoc in the past. For the particular case of password set-up, theusers could choose from a set of 62 characters (lower/ upper case alphabets and ten digits), and apassword length of ten characters was fixed. You consider a powerful attacker that can guess 10,000passwords in one second. d. If instead of 62 characters, you allow 94 characters to choose from. For passwordlengths of 12, 14 and 16, compute the probability that a password in your organization iscorrectly guessed by the…
We saw in class that password management is a complex problem with mulJple dimensions to it.Within the realm of password set-up rules, many factors including human memory limitations with longand complex passwords, overhead in frequently asking users to change passwords, attacker capabilitiesand more must be balanced against providing robust and secure authentication.For this assignment, imagine that you are taking over as the Authentication Manager of an IT firm, andyou identify that things were done ad-hoc in the past. For the particular case of password set-up, theusers could choose from a set of 62 characters (lower/ upper case alphabets and ten digits), and apassword length of ten characters was fixed. You consider a powerful attacker that can guess 10,000passwords in one second. a. In order to evaluate the strength of these rules from the perspective of an attackercorrectly guessing a user’s password, what formal method/principle, you will use for yoursolution? You must state…
Authorization lists should be encrypted and secured since they are so vulnerable to manipulation. Imagine if someone messed with these files without meaning to.
1. Describe the steps of the Existential Forgery Attack against RSA Digital Signature as discussed in the class. Then answer whether it is possible for the attacker, Oscar, to create a message as he wishes with the correct signature signed by Bob. Why?
We saw in class that password management is a complex problem with mulJple dimensions to it.Within the realm of password set-up rules, many factors including human memory limitations with longand complex passwords, overhead in frequently asking users to change passwords, attacker capabilitiesand more must be balanced against providing robust and secure authentication.For this assignment, imagine that you are taking over as the Authentication Manager of an IT firm, andyou identify that things were done ad-hoc in the past. For the particular case of password set-up, theusers could choose from a set of 62 characters (lower/ upper case alphabets and ten digits), and apassword length of ten characters was fixed. You consider a powerful attacker that can guess 10,000passwords in one second. a. In order to evaluate the strength of these rules from the perspective of an attackercorrectly guessing a user’s password, what formal method/principle, you will use for yoursolution? You must state…
Salt enhances the difficulty of guessing in the UNIX login authentication procedure by a factor of ten. The salt, on the other hand, is saved in the same file as plaintext, in the same entry as the hashed password. As a result, if an attacker has knowledge of the salt and hashed password from the password file, the password does not need to be guessed. Why is it claimed that salt boosts security?
It is often claimed that passwords do not get saved as plaintext anywhere in systems, and even the system administrator does not know your password. Given what you learned about hash functions. Explain how such a claim is possible. In other words, how do systems perform authentication without having to store passwords in a format that can be read by the system administrators. Authentication is primarly the process of verifying that provided password is correct. Design a simple authentication system and implement the following two methods: def signup (username, password): '''store the user credential so that the system knows how to authenticate the user in the future (when login () gets called).' def login (username, password): "''returns True, if the provided username and password are correct'''
True/False 8. A substitution cipher is a good way to keep sensitive information secure.