
b. If p = 13, q = 31, and d = 7, find e.
c. Using
p = 5, q = 11, and d = 27, find e and encrypt ''abcdefghij''.
15. Suppose a user, Maria, discovers that her private RSA key (
d 1, n 1) is same as the
public RSA key (
e 2, n 2) of another user, Frances. In other words, d 1 = e 2 and n 1 =
n 2. Should Maria consider changing her public and private keys? Explain your answer.
16. Consider the use of counter mode, as shown in
Fig. 8-15, but with IV = 0. Does the use
of 0 threaten the security of the cipher in general?
17. The signature protocol of
Fig. 8-18 has the following weakness. If Bob crashes, he may
lose the contents of his RAM. What problems does this cause and what can he do to
prevent them?
18. In
Fig. 8-20, we see how Alice can send Bob a signed message. If Trudy replaces P, Bob
can detect it. But what happens if Trudy replaces both
P and the signature?
19. Digital signatures have a potential weakness due to lazy users. In e-commerce
transactions, a contract might be drawn up and the user asked to sign its SHA-1 hash.
If the user does not actually verify that the contract and hash correspond, the user may
inadvertently sign a different contract. Suppose that the Mafia try to exploit this
weakness to make some money. They set up a pay Web site (e.g., pornography,
gambling, etc.) and ask new customers for a credit card number. Then they send over a
contract saying that the customer wishes to use their service and pay by credit card
and ask the customer to sign it, knowing that most of them will just sign without
verifying that the contract and hash agree. Show how the Mafia can buy diamonds from
a legitimate Internet jeweler and charge them to unsuspecting customers.
20. A math class has 20 students. What is the probability that at least two students have
the same birthday? Assume that nobody was born on leap day, so there are 365
possible birthdays.
21. After Ellen confessed to Marilyn about tricking her in the matter of Tom's tenure,
Marilyn resolved to avoid this problem by dictating the contents of future messages into
a dictating machine and having her new secretary just type them in. Marilyn then
planned to examine the messages on her terminal after they had been typed in to make
sure they contained her exact words. Can the new secretary still use the birthday attack
to falsify a message, and if so, how?
Hint: She can.
22. Consider the failed attempt of Alice to get Bob's public key in
Fig. 8-23. Suppose that
Bob and Alice already share a secret key, but Alice still wants Bob's public key. Is there
now a way to get it securely? If so, how?
23. Alice wants to communicate with Bob, using public-key cryptography. She establishes a
connection to someone she hopes is Bob. She asks him for his public key and he sends
it to her in plaintext along with an X.509 certificate signed by the root CA. Alice already
has the public key of the root CA. What steps does Alice carry out to verify that she is
talking to Bob? Assume that Bob does not care who he is talking to (e.g., Bob is some
kind of public service).
24. Suppose that a system uses PKI based on a tree-structured hierarchy of CAs. Alice
wants to communicate with Bob, and receives a certificate from Bob signed by a CA
X
after establishing a communication channel with Bob. Suppose Alice has never heard of
X. What steps does Alice take to verify that she is talking to Bob?
25. Can IPsec using AH be used in transport mode if one of the machines is behind a NAT
box? Explain your answer.
26. Give one advantage of HMACs over using RSA to sign SHA-1 hashes.
27. Give one reason why a firewall might be configured to inspect incoming traffic. Give one
reason why it might be configured to inspect outgoing traffic. Do you think the
inspections are likely to be successful?
28. The WEP packet format is shown in
Fig. 8-31. Suppose that the checksum is 32 bits,
computed by XORing all the 32-bit words in the payload together. Also suppose that the
problems with RC4 are corrected by replacing it with a stream cipher having no
weaknesses and that IV's are extended to 128 bits. Is there any way for an intruder to
spy on or interfere with traffic without being detected?
29. Suppose an organization uses VPN to securely connect its sites over the Internet. Is
there a need for a user, Jim, in this organization to use encryption or any other security
mechanism to communicate with another user Mary in the organization.