Chapter 7
Reinforcement
Problem R-7.1
It doesn’t matter whether a domain name includes uppercase and lowercase letters, as they
are considered the same. So, for instance, example.com is the same as ExamPLE.com and
eXamplE.com. Is this case insensitivity also true for the rest of a URL? (Note that you can
test this question yourself by visiting any web site that has a URL with more than just a
domain name.)
Problem R-7.3
Which of the following security goals are addressed by the HTTPS protocol: (a) privacy,
(b) confidentiality, (c) availability.
Problem R-7.6
Can a web sever obtain SSL server certificates from two or more certification authorities?
Justify your answer.
Creativity
Problem C-7.2
Describe a method for protecting users against URL obfuscation attacks.
Problem C-7.7
From the perspective of any host, RootServer, the shortest paths in the Internet to Root-
Server form a tree structure. Imagine that this tree is a complete binary tree having n
nodes, with RootServer as its root and client hosts as its leaves. Suppose RootServer can
handle up to √ndifferent HTTP requests at any one time, but any more than this will
cause a denial-of-service. How many copies of RootServer would you need to create and
place at various nodes of the binary tree in order to protect any copy from a DDOS attack,
assuming that any HTTP request is always handled by the closest copy of RootServer?
Where should you place these copies?
Problem C-7.8
Suppose a web client and web server for a popular shopping web site have performed a key
exchange so that they are now sharing a secret session key. Describe a secure method for
the web client to then navigate around various pages of the shopping site, optionally placing
things into a shopping cart. Your solution is allowed to use one-way hash functions and
pseudo-random number generators, but it cannot use HTTPS, so it does not need to achieve
confidentiality. In any case, your solution should be resistant to HTTP session hijacking
even from someone who can sniff all the packets.
Problem C-7.9
Ad servers are increasingly being used to display essential content for web sites (e.g., photos
that are part of news items). Suppose that the same host is used to serve images for two
different web sites. Explain why this is a threat to user privacy. Is this threat eliminated if
the browser is configured to reject third-party cookies?