Chad Maughan 12/05/2011

CS5460 - Assignment 6

Exercises from Chapter 4

6) Can any number of concurrent processes be protected from one another by just one pair of
base/bounds registers?

No. To fully protect data from concurrent processes, you need to have separate base/bounds
register for each process. This is one of the reasons that multi-threaded programming is
difficult.

11) A problem with either segmented or paged address translation is timing. Suppose a user
wants to read some data from an input device into memory. For efficiency during data transfer,
often the actual memory address at which the data are to be placed is provided to an I/O device.
The real address is passed so that time-consuming address translation does not have to be
performed during a very fast data transfer. What security problems does this approach bring?

The problem with passing in the real memory address is that the protections provided by the
OS. For example, the address translation table look-up is bypassed. If you had multiple I/
O devices connected at the same time, and protections were not added in the OS, you could
overwrite or read the data directly during the transfer.

14) Describe each of the following four kinds of access control mechanisms in terms of (a) ease
of determining authorized access during execution, (b) ease of adding access for a new subject,
(c) ease of deleting access by a subject, and (d) ease of creating a new object to which 
all
subjects by default have access.

● per-subject access control list (that is, one list for each subject tells all the objects to 

which that subject has access)

a. since the list is separate for each subject and the ACL controls access to the
subject, it is very easy to determine
b. very easy
c. very easy
d. more computationally intensive as a separate list must be created for each object

● per-object access control list (that is, one list for each object tells all the subjects who
have 
access to that object)

e. since the list is separate for each object and the ACL controls access to the
object, it is very easy to determine
f. very easy
g. very easy
h. more computationally intensive as a separate list must be created for each object

● access control matrix

Chad Maughan 12/05/2011
CS5460 - Assignment 6

a. more complex to access as the matrix

b. more complex
c. more complex
d. easy as the ACL is a shared matrix

● capability

a. more difficult
b. easy
c. easy
d. more difficult

27) A flaw in the protection system of many operating systems is argument passing. Often a
common shared stack is used by all nested routines for arguments as well as for the remainder
of the context of each calling process.

(a) Explain what vulnerabilities this flaw presents.

The vulnerability exists because the operating system controls access to resources
based on permissions to the executing program. If the common shared stack is used by
all programs, the nested routines could be executed with different permissions than the
parent program.

(b) Explain how the flaw can be controlled. The shared stack is still to be used for
passing 
arguments and storing context.

This can be controlled by verifying that the common shared stack use the same
permissions as the parent executing program. This requires additional checks to be
performed by the common stack to make sure there is not permission leaking.

Additional Questions

1) [Kerberos V4] Specify the complete set of Kerberos messages involved from the time a
user (e.g., Alice under Wonderland KDC) first walks up to a workstation to the time user is
successfully talking to something in another realm (e.g., Dorothy under Oz KDC). Give brief
explanation and show the important information contained in the messages. Drawing a diagram
is preferred.

1. An authentication request is sent from the client to the authentication server

2. The authentication server forwards the request to the Key Distribution Center (KDC)
3. KDC issues a Ticket Granting Ticket (TGT), encrypts it and returns to the client
4. The client then sends the TGT to the Ticket Granting Service (TGS)
5. The TGS verifies the TGT is valid and the user is permitted to access the service
6. TGS issues a Ticket and session keys that are returned to the client

2) [PKI] Compare all the following schemes for obtaining Bob’s public key, in terms of bandwidth
and computation efficiency, security, flexibility, and any other criteria you can think of:
Chad Maughan 12/05/2011
CS5460 - Assignment 6

1. downloading Bob’s key from the node located at a particular IP address (via an 

unauthenticated interaction);

Equal bandwidth, computationally efficient, not secure, but flexible.

2. looking up Bob’s key in a directory via an unauthenticated interaction;

Equal bandwidth, computationally efficient, not secure, but flexible.

3. having an authenticated conversation to the directory;

Equal bandwidth, less computationally efficient than the previous two methods, secure
and flexible.

4. having the directory sign the information you request;

Equal bandwidth, less computationally efficient than the three previous methods, more
secure than the previous three and less flexible.

5. storing and retrieving certificates from the directory;

Less bandwidth than the others, computationally efficient, potentially more secure
(although you’re relying on the OS for protection), and very flexible.

6. having no directory but having each principle responsible for keeping its own 
certificate
and sending it to someone who needs to talk to it.

Inefficient with bandwidth, computationally inefficient, the most secure and the least
flexible.

3) [PKI] Suppose USU implements a “Top-Down with Name Constraints” PKI model with
two-level hierarchy. The root CA is pki.usu.edu, which has two delegated CA servers,
pki.cs. usu.edu and pki.ece. usu.edu, at the second layer for the CS department and the
ECE department, respectively. Suppose alice@cs. usu.edu wants to learn the public key of
bob@ece. usu.edu. The following statements explain how this PKI model works. Is each of the
following statements TRUE or FALSE? Explain your answer briefly.

● Every machine in USU is configured with the public key of the root CA.

True. This is required to have top-down with name constraints work.

● The domain of cs.usu.edu has a CA server (pki. cs.usu.edu) that is delegated

from the 
root CA (pki.usu.edu). The domain of ece.usu.edu also has a CA server 

(pki.ece.usu.edu) that is delegated from the root CA.

True. Other CAs are delegated to by the root CA.

Chad Maughan 12/05/2011
CS5460 - Assignment 6

● The root CA generates certificates for pki.cs.usu.edu responsible for the subdomain 

cs.usu.edu and for pki.ece.usu.edu responsible of the sub-domain ece.usu.edu.

True. Delegated CAs have certificates created by the root CA.

● Alice@cs.usu.edu is pre-configured with the public key of pki.cs.usu.edu and 


bob@ece.usu.edu is pre-configured with the public key of pki.ece.usu.edu.

False. They are both pre-configured with the public key of the root CA.

● Alice@cs.usu.edu and bob@ece.usu.edu obtain certificates from their own CAs, 
which
are pki.cs.usu.edu and pki.ece.usu.edu, respectively.

True. Certificates are issued by the delegated CA’s sub-domains.

● In order for alice@cs.usu.edu to authenticate the public key of bob@ece.usu.edu, 


bob@ece.usu.edu must send its certificate and its CA’s certificate to alice@cs.usu.edu.

True. With the top-down with name constraints model a trust path goes from the root to
the target.

4) [IPSec] In tunnel mode, when sending encrypted traffic from firewall to firewall, why does
there need to be an extra IP header? Why cannot the firewall simply encrypt the packet, leaving
the source and destination as the original source and destination?

Tunnel mode is when a virtual private network is created for network-to-network communication.
The entire packet (including headers) needs to be encrypted so the when the packet is received
it can be routed to the correct host. This allows NAT traversal to work.

5) [IPSec] Explain what ESP, AH, and IKE achieve, respectively.

Suppose host1 and host2 are communicating with end-to-end AH, transport mode, while
firewall1 and firewall2 enforce ESP, tunnel mode on all traffic between them.

host1 --- firewall1 --- Internet --- firewall2 --- host2


Consider a packet from host1 to host2. Describe the packet structure at the time when the
packet is in the Internet. (Write down the headers in the correct order and describe what portion
of the packet the AH/ESP headers protect, respectively.)

IKE (internet key exchange) uses X.509 certificates for authentication which are either pre-
shared or distributed using DNS.

AH (authentication headers) provide connectionless integrity, data origin authentication (for

IP datagrams), and protection against replay attacks. It protects the IP datagram (except for
mutable fields such as DSCP/TOS, ECN, Flags, Frament Offset, TTL and checksum).
Chad Maughan 12/05/2011
CS5460 - Assignment 6

ESP (encapsulating security payloads) provide confidentiality, data origin authentication,

connectionsless integrity and anti-replay service, and traffic flow confidentiality. ESP wraps the
entire original IP packet with another packet header. ESP protects the whole inner IP packet
while the outer header remains unprotected.

6) [SSL] The following figure illustrates the SSL handshaking protocol. Explain how the following
is achieved:


a) server authentication.

During the SSL handshake, the client checks the servers certificate to check that
it is during the validity period, that the Certificate Authority (CA) is a trusted CA,
that the CA’s public key validates the issuer’s digital signature, and the domain
name matches the server’s certificate. After that, the server is authenticated.


b) session key negotiation.

After the server authenticates the client, the server uses its private key to decrypt
the pre-master secret. After that the client and the server use the master secret
to generate the session keys.


c) message integrity protection.

Message integrity is achieved by sending a message digest with the encrypted

message. A message digest is a fixed length representation of the message, or
a hash.