CS 5204 - Fall, 2009
Problem Set 7 20 points Assigned: October 6, 2009 Due: October 20, 2008 (noon)
.
1. (3 points) A system has a capability-list access control mechanism.
Is it possible to implement a role-based access control scheme on top
of this? If so, explain how this can be done. If not, explain why it
cannot be accomplished.
2. (3 points) A system has an access control list access control mechanism. Is it possible
to implement a role-based access control scheme on top of this? If so,
explain how this can be done. If not, explain why it cannot be
accomplished.
3. (5 points) Suppose users A and B exchange message M in a public-key
system using the following protocol:
(1) A encrypts M using B's public key (EB),
and sends the ciphertext message to B along with plaintext stating both
A's and B's identity:
(A, B, EB(M)).
(2) B deciphers the cipertext, and replies to A with
(B,A, EA(M))
Show how an active wiretapper could break the scheme to determine M. An
active wiretapper is a network intruder that can both copy messages as
well as insert new messages.
4. (6 points) Two parties wish to create a public
electronic document that provides each of them with assurance of agreement
of the other party to the document's content. The desired properties of
the electronic document are:
document visibility: the content of the document is readable in plain-text
form by anyone
document validity: each party can determine whether the document has been
altered during or after the agreement
mutual non-repudiation: once they have agreed to the document, neither
party can deny having provided its agreement
mutual authentication: each party knows that the agreement is obtained
from the other party
independent confirmation: either party, without the cooperation of the
other party, can conclusively demonstrate to an idependent entity that
both parties agreed to the document
Show how public key crytopgraphic techniques can be used to construct a
document of the desired properties. Assume that each party knows confidently
the public key of the other party.
5. (3 points) State three insightful questions about the concepts of protection and security based on the readings assigned for
the course.