Alice wants to set up a business company that securely deals with her clients. Bob is a potential client that Alice wants to have a good connection. As a security consultant, your job is to devise a plan to establish a secure information exchange. The assumption is made that Alice and Bob already have their public and public keys; (PrivA, PubA) and (PrivB, PubB) respectively, and both of them have exchanged their public key beforehand. Your plan includes comprehensive protocols to secure all messages, according to Alice’s requirements below. Discuss your answers based on Asymmetric Encryption. i) Integrity: Alice and Bob want to make sure that every message sent cannot be forged by anyone. ii) Authenticity: Alice and Bob can verify that messages actually came from them. iii) Confidentiality: Alice exchanges business-related documents with Bob in a way, so that Alice and Bob may open, read or modify the documents.

Alice wants to set up a business company that securely deals with her clients. Bob is a potential client that Alice wants to have a good connection. As a security consultant, your job is to devise a plan to establish a secure information exchange. The assumption is made that Alice and Bob already have their public and public keys; (PrivA, PubA) and (PrivB, PubB) respectively, and both of them have exchanged their public key beforehand. Your plan includes comprehensive protocols to secure all messages, according to Alice’s requirements below. Discuss your answers based on Asymmetric Encryption. i) Integrity: Alice and Bob want to make sure that every message sent cannot be forged by anyone. ii) Authenticity: Alice and Bob can verify that messages actually came from them. iii) Confidentiality: Alice exchanges business-related documents with Bob in a way, so that Alice and Bob may open, read or modify the documents.

Management Of Information Security

6th Edition

ISBN:9781337405713

Author:WHITMAN, Michael.

Publisher:WHITMAN, Michael.

Chapter10: Planning For Contingencies

Section: Chapter Questions

Problem 1EDM

See similar textbooks

Similar questions

Q: Alice wants to set up a business company that securely deals with her clients. Bob is a potential client that Alice wants to have a good connection. As a security consultant, your job is to devise a plan to establish a secure information exchange. The assumption is made that Alice and Bob already have their public and public keys; (PrivA, PubA) and (PrivB, PubB) respectively, and both of them have exchanged their public key beforehand. Your plan includes comprehensive protocols to secure all messages, according to Alice’s requirements below. Discuss your answers. i) Integrity: Alice and Bob want to make sure that every message sent cannot be forged by anyone. ii) Authenticity: Alice and Bob can verify that messages actually came from them. iii) Confidentiality: Alice exchanges business-related documents with Bob in a way, so that Alice and Bob may open, read or modify the documents.
Assume there is a Certificate Authority (CA) with a well-known public key. Further assume every user is issued a certificate for his/her public key. For convenience, we use PKu and SKu to represent user’s public key and private key, respectively. Draw diagrams to answer the following questions. a) Suppose Alice wants to send a large secret message M to Bob. Describe how Alice should send M in an authenticated way. b) Assume Bob receives the message sent by Alice. Describe how Bob should process the message. c) Suppose Alice needs to send a number of large secret messages to Bob. Alice would like to avoid signing digital signatures for all these messages. Develop a protocol for Alice and Bob so that all the messages can be sent in a confidential and authenticated way. Briefly describe the intuition of your protocol first and then draw a diagram.
An attorney signed a legal document electronically and sends it to the client. Explain how the client will make sure that the document is signed by his lawyer and is not altered during the transition. You also want to make the document confidential for unauthorized people. Everything should be done in one go. (Note: You have to explain the use of cryptographic algorithms in the above scenario and the order they will be applied. Marks are graded based on the best precise solution)
A government organization decides that in order to protect the communications it has with its international partners, encryption is necessary. In a discussion with its equivalents, it is decided to develop a proprietary cryptographic algorithm for the following reasons: Is this decision supported by any evidence. What dangers are being exposed?
Bob created a risky business venture plan and decided to regularly send electronic versions of it to Alice (who is out of town on business) for review, but he knows that his notorious (evil?) business competitor Malice maintains an office near enough to attempt to monitor his communications in the computer network (a) Bob first needs to establish a new key with Alice for communication (even though Malice is monitoring), without meeting physically with her. Explain how he could use cryptography to achieve this (b) With your help, Bob solved the previous problem. Next, Bob is concerned about sending so many copies of the plan, providing so much ciphertext for attackers to study to attack his key with, so he’d like to create a separate key and share it with Alice for message encryption. Propose a cryptographic technique to protect his new, 2nd key and explain how to use it here (c) Bob also wants to ensure that Alice knows each message containing the plan is from him (not someone else),…
7. Alice wants to communicate with Bob, using public-key cryptography. She establishes a connection to someone she hopes is Bob. She asks him for his public key and he sends it to her in plaintext along with an x.509 certificate signed by the root CA. Alice already has the public key of the root CA. What steps does Alice carry out to verify that she is talking to Bob? Assume that Bob does not care who he is talking to (e.g., Bob is some kind of public service). State each step. Solution:
Using asymmetric encryption methods, like those used in public-key cryptography, is a good idea. This is shown by the use of public keys in cryptography.Using asymmetric encryption methods, like those used in public-key cryptography, is a good idea. This is shown by the use of public keys in cryptography.
The mathematical formalization of encryption and decryption. If the message space is {a, b, c, d, e} and the ciphertext space is {1,2, 3,4,5}.What is the size of the key space? Write a number.
The main characteristic of the Public Key Infrastructure (ICP) – or Public Key Infrastructure (PKI) – is that it uses a pair of keys, public and private, to provide the underlying security services. Regarding aspects related to the security of a cryptographic system, analyze the following statements. I. Typically, what compromises the security of a cryptographic model has less to do with the design of that model and more to do with poor key management. II. Private keys must remain secret from all parties involved, throughout their lifecycle, including the owners of those keys, which is why they are also called secret keys. III. Because public keys are in the open domain they can be tampered with, there is no guarantee that a public key is correct. The infrastructure by which they are managed must be trusted. IV. A public key infrastructure (or Public Key Infrastructure - PKI) guarantees some aspects related to the life cycle of a public key, such as generation, installation and…
Bob has designed a secure login system for the student portal of the Xiamen University of Technology (XUT). In Bob's design, a two-factor authentication method is used for verifying the authenticity of the user. A brief description of the design is provided below. For the two-factor authentication, the followings are required: • Factor 1: a user first required to provide a secret password, • Factor 2: the user then needs to provide the correct answer to a security question. To securely store the user password in the system, Bob has used state-of-the-art encryption algorithm, Advanced Encryption Standard (AES), to encrypt the user password and stored the encrypted password in the system database. For securely signing in to the system: the user needs to provide his/her user ID and the corresponding password. This information will be transmitted to the system over a secure communication channel. Upon receiving this information, the system will: o locate/retrieve the corresponding…
Suppose that you receive a digital certificate that contains M and (h(M)]CA, where M = (Alice, Alice's public key) and "CA" is Certificate Authority. Assuming that you trust the CA, after verifying the signature on the certificate, what do you then know about the identity of the sender of the certificate? Remember that: [Xleob indicates encryption via Bob's private key to X (signature) h(X) indicates the cryptographic hash function applied to X O The sender is Alice O The sender is Trudy I cannot deduce the identity of the sender from the certificate The sender is the Certificate Authority
A government agency comes to the conclusion that it must use encryption in order to safeguard the communication that takes place between itself and its overseas counterparts. It is determined to design a proprietary cryptographic algorithm for this reason during a meeting with its counterparts, and this will be done in order to: Is there a justification for this choice. What risks are being taken?