Networking Chapter 2 Reinforcementproblem What The Full Theoretical Size The Search Space For Pin

Unlock access to all the studying documents.

View Full Document

Chapter 2

Reinforcement

Problem R-2.5

What is the full theoretical size of the search space for a pin tumbler lock that has 30 possible

key blanks and 8 pins, each with 12 different distinct heights? What is the corresponding

theoretical size of the search space for the corresponding iterative master-key construction?

Problem R-2.6

Consider a pin tumbler lock with 5 pins and 8 pin heights. Explain why it is not actually

possible to have 85different change keys.

Problem R-2.7

The Acme Combination is rated as a two-hour lock, meaning that it takes two hours to

crack this lock by an experienced thief. The Smacme company has a half-hour lock that

looks exactly the same as the Acme lock and is much cheaper to buy. The XYZ Company

wanted to save money, so they bought one Acme lock and one Smacme lock. They put one

on their front door and one on the back door of their building. Explain how an experienced

thief should be able to break into the XYZ Company’s building in about an hour or less.

Problem R-2.10

Explain why knowing in which language the user is typing helps perform an eavesdropping

attack based on analyzing acoustic keyboard emissions.

Problem R-2.11

Discuss whether barcodes are more or less secure than magnetic stripe cards.

Problem R-2.15

A salesperson at a high-end computer security firm wants to sell you a protective cover for

your passport, which contains an RFID tag inside storing your sensitive information. The

salesperson’s solution costs “only” $79.99 and protects your passport from being read via

radio waves while it is in your pocket. Explain how you can achieve the same thing for

under $3.00.

Creativity

Problem C-2.2

For safety reasons, external locked doors on commercial buildings have mechanisms for

people on the inside to escape without using a key or combination. One common mechanism

uses an infrared motion detector to open an electronic lock for people moving towards a

door from the inside. Explain how an air gap under such an external door could be exploited

to open that door from the outside?

Problem C-2.3

A group of npirates has a treasure chest and one unique lock and key for each pirate. Using

hardware that is probably already lying around their ship, they want to protect the chest

so that any single pirate can open the chest using his lock and key. How do they set this

up?

Problem C-2.4

A group of nred pirates and a group of nblue pirates have a shared treasure chest and one

unique lock and key for each pirate. Using hardware that is probably already lying around

their two ships, they want to protect the chest so that any pair of pirates, one red and one

blue, can open the chest using their two locks and keys, but no group of red or blue pirates

can open the chest without having at least one pirate from the other group. How do they

set this up?

Problem C-2.5

A group of four pirates has a treasure chest and one unique lock and key for each pirate.

Using hardware that is probably already lying around their ship, they want to protect the

chest so that any subset of three of these pirates can open the chest using their respective

locks and keys, but no two pirates can. How do they set this up?

Problem C-2.6

A thief walks up to an electronic lock with a 10-digit keypad and he notices that all but

three of the keys are covered in dust while the 2, 4, 6, and 8 keys show considerable wear.

He thus can safely assume that the 4-digit code that opens the door must be made up of

these numbers in some order. What is the worst case number of combinations he must now

test to try to open this lock using a brute-force attack?

Problem C-2.9

A variation of the following biometric authentication protocol was experimentally tested

several years ago at immigration checkpoints in major U.S. airports. A user registers in

person by showing her credentials (e.g., passport and visa) to the registration authority

and giving her fingerprint (a “palmprint” was actually used). The registration authority

then issues to the user a tamper-resistant smartcard that stores the reference fingerprint

vector and can execute the matching algorithm. The checkpoint is equipped with a tamper

resistant admission device that contains a fingerprint reader and a smartcard reader.

The user inserts her smartcard and provides her fingerprint to the device, which forwards

it to the smartcard. The smartcard executes the comparison algorithms and outputs the

result (“match” or “no match”) to the device, which admits or rejects the user accord-

ingly. Clearly, an attacker can defeat this scheme by programming a smartcard that always

outputs “match.” Show how to modify the scheme to make it more secure. Namely, the ad-

mission device needs to make sure that it is interacting with a valid smartcard issued by the

registration authority. You can assume that the smartcard can perform cryptographic com-

putations and that the admission device knows the public key of the registration authority.

The attacker can program smartcards and is allowed to have an input-output interaction

with a valid smartcard but cannot obtain the data stored inside it.

Solution There are several valid solutions. One solution is to have the registration au-

Problem C-2.11

A bank wants to store the account number of its customers (an 8-digit number) in encrypted

form on magnetic stripe ATM cards. Discuss the security of the following methods for

storing the account number against an attacker who can read the magnetic stripe: (1)

store a cryptographic hash of the account number; (2) store the ciphertext of the account

number encrypted with the bank’s public key using a public-key cryptosystem; (3) store the

ciphertext of the account number encrypted with the bank’s secret key using a symmetric

cryptosystem.

Solution In each of these cases, the account number is assumed to be a secret. (1)

This solution is not very secure, even though it is considered computationally difficult to

Problem C-2.12

Consider the following security measures for airline travel. A list of names of people who

are not allowed to ﬂy is maintained by the government and given to the airlines; people

whose names are on the list are not allowed to make ﬂight reservations. Before entering the

departure area of the airport, passengers go through a security check where they have to

present a government-issued ID and a boarding pass. Before boarding a ﬂight, passengers

must present a boarding pass, which is scanned to verify the reservation. Show how some-

one who is on the no-ﬂy list can manage to ﬂy provided boarding passes can be printed

online. Which additional security measures should be implemented in order to eliminate

this vulnerability?

Solution The attack is committed by using two printed boarding passes. One of them is

the real boarding pass that is issued by the airline. The real boarding pass has the name