Midterm # 2 Flashcards
1
Q
Authentication is?
A
The process of determining whether a user should be allowed access to a system.
2
Q
Authentication question?
A
are you who you say you are?
3
Q
authorization
A
are you allowed to do that?
4
Q
The three authentication methods?
A
Something you know
Something you have
Something you are
5
Q
How to prevent forward search attack
A
To prevent a forward search attack on a public key encryption we append random bits to the message before encrypting it
6
Q
Salt?
A
Appending a non secret random value known as salt to each password before hashing it.
7
Q
What is a salt?
A
a non secret value that causes identical password to hash to different values
8
Q
What is a two factor authentication?
A
any authentication method that requires two out of the three “somethings” is known as a two factor authentication
9
Q
what is the common criteria?
A
EAL1 through EAL7
10
Q
what is EAL1
A
functionally tested
11
Q
what is EAL2
A
Structurally Tested
12
Q
What is EAL3
A
Methodically Tested and Checked
13
Q
What is EAL4
A
Methodically Designed, Tested, and Reviewed
14
Q
What is EAL5
A
Semiformally Designed and Tested
15
Q
What is EAL6
A
Semiformally Verified Design and Tested
16
Q
What is EAL7
A
Formally Verified Design and Tested
17
Q
What are ACL’s?
A
Access control lists, columns
18
Q
What is C-lists?
A
Capabilities, rows, subject trying to perform an operation
19
Q
What are the advantages of capabilities?
A
with capabilities the association between users and files is built into the system. Capabilities are more complex to implement, and have higher overhead
20
Q
what are the advantages of ACL
A
ACL based system, which is a separate method for associating users to files is required.
21
Q
what is the confused deputy?
A
the confused deputy is a classic security problem. fooled by some other party into misusing its authority. the compiler is acting on Alice’s behalf.
22
Q
Classification applies to…
A
Objects
23
Q
Clearances apply to…
A
Subjects
24
Q
Classification and Clearances order?
A
Top Secret
Secret
Confidential
Unclassified
25
what is BLP
Bella-LaPadula
26
What is Bella-LaPadula
is to capture the minimal requirements with respect to confidentiality, that any MLS system must satisfy
27
BLP consists of two statments
Simple Security Condition,
| Property
28
What is Simple Security Condition
Subject S can read object O if and only if L(O) <= L(S)
29
What is Property
Star property, Subject S can write objects O if and only if L(S) <= L(O)
30
what is the point of compartments?
to further restrict information flow "across" security level, compartments enforce he need to know principle.
31
what is a covert channel?
communication path
32
what is captcha?
is a test that a human can pass, but a computer can not pass with a probability better than guessing.
33
what does firewall provide?
firewall provides access control for the network. Each type of firewall filters packets by examining the data up to a particular layer of the network protocol stack.
34
What are the five layers of packet filter?
application, transport, network, link, physical
35
what is the advantage of a packet filer
efficiency
36
concept of firewall?
firewall has no concept of state so each packet is treated independently of all others.
37
what do packet filters use?
they are configured using access control ists or ACLs
38
what is a port scan?
Trudy tries to determine which ports are open through the firewall
39
Application proxy?
the incoming packet is destroyed and a new packet is created in its place when the data passes trough the firewall.
40
Protocol what is bad?
it is a bad idea to have the two sides in a protocol do exactly the same thing, since this might open the door to an attack. small changes to a protocol can result in big changes in its security.
41
Remember..
You should not use the same key pair for signing as you use for encryption
42
how prevent MiM attack?
Alice and Bob can use their shared symmetric key K_AB, to encrypt the diffie hellman exchange
43
what is timestamp?
a time value
44
what is the benefit of timestamp?
is that we do not need to waste any messages exchanging nonces, assuming that the current time is known to both Alive and Bob.
45
Zero knowledge proofs
bobs cave which side
46
what is Fiat shamir?
relies on the fact that finding a square root modulo N is as difficult as factoring.
47
Why is it better to hash passwords with a salt than to hash passwords without a salt?
Not a secret, stored with passwords
dictionary attack more difficult
it creates more work for hacker
hacker can not use precomputed work.
48
why do we hash passwords with a salt rather than encrypt the password file?
store you have to encrypt the key, if you get the password file you get the key.
Password file is a single point of failure
49
What purpose do timestamps and nonces serve?
challenges used to verify authentication session PREVENT REPLAYS
50
Advantage of timestamp as compared to a nonce?
MORE EFFICIENT
51
One significant disadvantage of timestamp as compared to nonce?
CLOCK SKEW
| time is a security concern
52
Lampson's access control matrix, capabilities?
C-lists, rows and describe permissions for subjects
53
Lampsons access control matrix, ACLs?
Access control lists, are columns
54
2 advantages of C-lists over ACL's
Easy to add or delete
| easy to delegate permissions
55
2 advantages of ACLs over C-lists
Easier to implement
| Easy to change permissions
56
Differences between Authentication and identification?
One to one VS one to many
| subject compliance VS non subject compliance (data)
57
Which is easier and why? authentication or identification?
```
authentication is easier:
Only one way for authentication
Already know i am authenticating
Comparisons to ONE
with identification one to many, comparisons depends on data
```
58
Packet fileter
works at the network layer, attacker uses TCP ACK scan
59
Stateful packet fileter
works at the transport layer, attacker uses firewalk to send packets.
60
what is firewalk
to check for port opening, port scanning
61
Application proxy
works at the application layer, DLS attack can perform a port scanning
62
MIG
if bob and alice are doing the same thing you can get MIG
63
Method used to prevent covert channels are inherently weak. Is it better to use such weak methods or to do nothing at all?
better fuse weak , reduces bandwidth, EASY TO DO RELATIVELY
64
methods used for inference control are inherently weak. is it better to use weak or nothing?
Weak, reduces data leaks, EASY TO DO RELATIVELY
65
suppose that the only cryptosystem you have access to is known to be weak is it better to use this system to encrypt your data or to do nothing at all?
Do nothing at all , because you could flag it as import since the system is weak.
66
Why do we hash passwords that are stored in a password file?
so if the password file is stolen or accessed by trudy they can not determine the passwords and use it to log in to that system or other resources.
67
Why is it better to hash passwords than to encrypt the password file with a symmetric cipher?
hashes are one way and do not require that we decrypt any password files. Decrypting a password file would require that the key to be stored some where so that the system can automatically decrypt the file when verifying password. creates a security problem as to where to store the key.
68
Time stamps and nonces
are both used in security protocols to prevent replay attacks
69
Advantage of timestamp as compared to a nonce?
less messages required to achieve authentication as the nonce does not need to be exchanged.
70
Advantage of nonce as compared to timestamp?
Time stapts in the first case are security critical parameter and require a window of "opportunity" to account for clock skew. Nonce do not have that and it is a disadvantage.
71
One significant advantage of packet filter as compared to a stateful packet filter.
fast, less overhead s it does not monitor the state. stateful keeping track of state of lots of connections
72
Significant advantage of stateful packet filter as compared to packet filter.
prevents simple TCP ACK attack on firewall to determine if ports are blocked as the firewall will know that there is no valid session or state and reject the packet.
73
cost passwords are...
free
74
connivence passwords are...
easier for admin to reset pwd than to issue a new thumb
75
ECB
same plain text and same ciphertext
76
forward search prevented
padding with random bits prevents forward search attach, can not use a precomputed set of passwords, more work for trudy
77
No salt No dictionary
brute force, hash it and compare to all the passwords
78
yes salt
talk the salt hash it and compare work
79
work
size of dictionary / prob passwords in dictionary
80
2^10
1024
81
web cookies
cookie is provided by a website and stored on users machine, cookie indexes a database at website, cookies maintain STATE across sessions
82
web uses a what protocol
a stateless protocol HTTP
83
authorization is a form of
access control
84
ACL
Access control lists store matrix by column
85
ACLS
permissions tied to a file
86
capabilities
permissions tied to the user
87
ACLS
easier in changing files
88
Confused deputy
complier is acting on alices behalf, confusing her permission with Alice's permissions overriding a bill for example
89
in practice...
ACLs are used more often
90
capabilities make it ...
easy to delegate authority
91
Classifications apply...
to objets ressources
92
Clearances apply...
to subjects users
93
MLS is needed
when subjects and objects at different levels use on same system
94
MLS is a form of
Access Control
95
MLS enforces
Multilevel security enforces access control up and down
96
compartments enforce
enforce restrictions across, the need to know principle
97
Cover Channel
MLS designed to restrict legitimate channels of communication
98
Covert channel
desecrate means of communication, 1 it is there , 0 it is not there
99
a firewall is like a...
secretary
100
packet filter operates at the
network layer
101
stateful packet filter
operate at the transport layer, firewall will keep track then it can drop it
102
packet filer disadvantages
```
no concept of state
cannot see TCP connections
blind to application data
less information to go on
on going connections we do not see it just like ARP cacheing
```
103
dis advantage of stateful packet filter
can not see application data
slower than packet filtering
more work
state DoS is an issue
104
what is a proxy
something that acts on your behalf
105
Application proxy disadvantages
speed more work DoS
106
Application proxy advantages
complete view of connections and applications data
| Filter bad data at application layer
107
webcookies make a
stateless protocol
108
application -->
user space
109
transport -->
os
110
network -->
os
111
link
NIC card
112
Physical
NIC card
113
client
speaks first
114
server
responds to clients request
115
spoofed email doesn't have
authentication
116
UDP is
efficcent
117
TCP is
reliability
118
compartments help
need to know bases
119
UDP
certain delays long or short packets
120
botnet
compromised machines
121
botnet
can do DoS an spam
122
inference control
not too difficult to do
123
captcha the attacker
the attacker knows the algorithm, the data, except the random numbers
124
TCP 3-way
the TCP 3-way handshake makes denial of service DoS attacks possible
125
TCP three way handshake
first send SYN request
BACK SYN-ACK
ACK and data
126
ARP is
stateless
127
Ideal security protocol
Efficient
Precise
Robust
easy to implement, easy to use ,flexible
128
security protocol over a
Network layer, sending important information over the network back and forth attacker can replay messages.
129
challenge response
prevents replay, only alice can respond to properly Bob has to verify it. Number used one is a Nonce
130
Number used once
Nonce
131
another version of nonce
timestamps
132
diffie hellman
man in the middle has to happen in real time
133
nonce
generate it and send it current to prevent replay
134
Time stamp disadvantage
synchronization of clocks, network delay
135
Nonce
3 messages
136
timestamp
2 messages
137
Encrypt and sign with timestamp.....
insecure
138
sign and encrypt with nonce
secure
139
encrypt and sign with nonce
secure
140
sign and encrypt with timestamp
secure
141
Fiat shamir what is x
x = r^2 mod N
142
fiat shamir what is y
y = r * s^e mod N
143
fiat shamir what is v
v = S^2 mod N
144
what does bob verify in fiat shamir
y^2 = x * V^2 mod N
145
fiat shamir wha tis y ^2
y^2 = r ^2 * S ^(2e)
