6 \begin{document} |
6 \begin{document} |
7 |
7 |
8 \section*{Homework 4} |
8 \section*{Homework 4} |
9 |
9 |
10 \begin{enumerate} |
10 \begin{enumerate} |
|
11 \item What does the principle of least privilege say? |
|
12 |
|
13 \item In which of the following situations can the access control mechanism of Unix |
|
14 file permissions be used? |
|
15 |
|
16 \begin{itemize} |
|
17 \item[(a)] Alice wants to have her files readable, except for her office mates. |
|
18 \item[(b)] Bob and Sam want to share some secret files. |
|
19 \item[(c)] Root wants some of her files to be public. |
|
20 \end{itemize} |
|
21 |
11 \item Explain what is meant by \emph{Kerckhoffs' principle}. |
22 \item Explain what is meant by \emph{Kerckhoffs' principle}. |
12 |
23 |
13 \item How can a system that separates between \emph{users} and \emph{root} be of any |
24 \item How can a system that separates between \emph{users} and \emph{root} be of any |
14 help with buffer overflow attacks? |
25 help with buffer overflow attacks? |
15 |
26 |
16 \item Consider the following simple mutual authentication protocol: |
27 \item What does it mean that the program \texttt{passwd} has the |
|
28 \texttt{setuid} bit set? Why is this necessary? |
17 |
29 |
18 \begin{center} |
|
19 \begin{tabular}{ll} |
|
20 $A \rightarrow B$: & $N_a$\\ |
|
21 $B \rightarrow A$: & $\{N_a, N_b\}_{K_{ab}}$\\ |
|
22 $A \rightarrow B$: & $N_b$\\ |
|
23 \end{tabular} |
|
24 \end{center} |
|
25 |
|
26 Explain how an attacker $B'$ can launch an impersonation attack by |
|
27 intercepting all messages for $B$ and make $A$ decrypt her own challenges. |
|
28 |
|
29 \item Explain what are the differences between dictionary and brute forcing attacks against passwords. |
|
30 |
30 |
31 \item In the context of which information flow should be protected, explain briefly the |
31 \item In the context of which information flow should be protected, explain briefly the |
32 differences between the {\it read rule} of the Bell-LaPadula access |
32 differences between the {\it read rule} of the Bell-LaPadula access |
33 policy and the Biba access policy. Do the same for the {\it write rule}. |
33 policy and the Biba access policy. Do the same for the {\it write rule}. |
34 |
34 |