IT 223 FINAL EXAM QUESTIONS WITH VERIFIED
ACCURATE ANSWERS
What is a public communications channel? Can you give examples? - Answers -A
means of talking over the internet, sending messages to someone.
What two things does the recipient of a message want assurance of? - Answers -The
origin of the message
The integrity of the message
How can authentication of the origin of a message be enabled? - Answers -To enable
authentication of origin by a recipient
the sender of a message must add some data
that a recipient can check
and that an attacker could not have created correctly.
What is/are the inputs to a MAC function? What is the output? - Answers -A message
authentication code (MAC)
is a data value produced by a cryptographic function
that takes a message and a key.
A good MAC function will produce a value
that has no apparent relationship with the message nor the key it appears to be random.
What makes the output pseudo-random? - Answers -Modern MAC functions don't use
symmetric ciphers for pseudo-randomness
for several reasons.
Instead they use hash functions
and incorporate a key into the data to be hashed.
What is a collision onto a MAC value? Why is it very unlikely? - Answers -With a good
MAC function it is extremely unlikely
that it will produce the same output value
for a different message and/or a different key.
(This is called a collision onto the MAC value.
Unlikely because its pseudo random
What does the recipient of a message and a MAC do with them? Why? - Answers -She
can compare her MAC' with the one that came
with the message. IF they are identical they are correct.
How can an encryption algorithm be used in a MAC function? - Answers -When an
encryption algorithm is used in a MAC function only the "forward cipher" (the encryption
part) is used. The "reverse cipher" (decryption part) is not used.
,What is/are the inputs to a hash function? What is the output? - Answers -In
cryptography a hash (or message digest) is a value produced by a hash function.
What makes the output pseudo-random in hash? - Answers -A hash function takes a
sequence of bits,
chops it up, mixes it around,
and puts out a fixed-length value. Its always the same for 1 input.
What is a collision onto a hash value? Why is it very unlikely? - Answers -With a good
hash function it is extremely unlikely
that it will produce the same output value
for a different input.
What does the recipient of a message and a hash do with them? Why? - Answers -She
can compare her hash' with the one that came
with the message. If its the same, no collision has occurred.
What information security service is provided by a MAC but not by a hash? - Answers -
MAC's provide the origin of the message.
What is an HMAC? - Answers -keyed-hash message authentication code
If the key is known only to the sender and the recipient (and no-one else)
the matching hash could have been produced only by the sender or the recipient.
The recipient knows she didn't send this message+hash to herself
so it must have come from the apparent sender.
She has authenticated the origin of the message
What information security service is not provided by a MAC? - Answers -A MAC
provides authentication of origin to the recipient
but does not deter the sender from lying about this
so it does not provide non-repudiation. `
What does the sender of a message know that no-one else knows? - Answers -their
private key.
What is a digital signature? How is it generated? - Answers -When the sender of a
message generate a hash of it and encrypt the hash using an asymmetric algorithm with
his/her private key.
How is a digital signature verified? - Answers -The recipient can generate a hash of the
received message. She can decrypt the received encrypted hash using the public key*
of the apparent sender.
She can compare her hash to the decrypted hash.
Encryption is reversible by decryption. Is a hash function reversible? - Answers -A hash
function is a one-way process
, - the hash value does not have enough content to reproduce the message.
What is a rainbow table? Why does it make an attack feasible? - Answers -Table of
likely passwords and the hash for each
and search it for a matching hash in reasonable time.
How does "salting" password hashes affect the usefulness of a rainbow table? -
Answers -add a pseudo-random value known as a "salt" to a password. An attacker
would need to generate a rainbow table
of all possible salt values for each likely password.
With a large enough salt range this is impractical.
How does MS-CHAP use a hash function? - Answers -client sends a login request to
the server, server returns a pseudo-random value, user provides the password to the
client, client appends the provided password to the challenge
and calculates a hash of the result and sends to server, server appends the password it
holds to the challenge it generated and gets hash , If the hash from the client is identical
to the hash calculated by the server the login request is accepted.
MS-CHAP hash function: What user function does this enable? - Answers -The
password is not transmitted over the network link.
What is information? - Answers -knowledge obtained from investigation, study, or
instruction
What is the difference between "information" and "data"? - Answers -Data has no
context. Information is data with more context so you know what youre looking at.
information security (IS) - Answers -focuses on protection of information assets
information assurance (IA) - Answers -focuses on the correctness of information. Is
sometimes described as providing the right information to the right users at the right
time.
Non-repudiation - Answers -It deters the sender of a message from claiming he didn't
send it.
threat action - Answers -a specific instance of that potential being realized.
threat agent - Answers -someone or something that creates a threat action.
This includes:
- people who deliberately attack;
- people who make mistakes or have accidents;
- natural events.
3 types of threats: - Answers -Natural events, Human errors, Attacks
ACCURATE ANSWERS
What is a public communications channel? Can you give examples? - Answers -A
means of talking over the internet, sending messages to someone.
What two things does the recipient of a message want assurance of? - Answers -The
origin of the message
The integrity of the message
How can authentication of the origin of a message be enabled? - Answers -To enable
authentication of origin by a recipient
the sender of a message must add some data
that a recipient can check
and that an attacker could not have created correctly.
What is/are the inputs to a MAC function? What is the output? - Answers -A message
authentication code (MAC)
is a data value produced by a cryptographic function
that takes a message and a key.
A good MAC function will produce a value
that has no apparent relationship with the message nor the key it appears to be random.
What makes the output pseudo-random? - Answers -Modern MAC functions don't use
symmetric ciphers for pseudo-randomness
for several reasons.
Instead they use hash functions
and incorporate a key into the data to be hashed.
What is a collision onto a MAC value? Why is it very unlikely? - Answers -With a good
MAC function it is extremely unlikely
that it will produce the same output value
for a different message and/or a different key.
(This is called a collision onto the MAC value.
Unlikely because its pseudo random
What does the recipient of a message and a MAC do with them? Why? - Answers -She
can compare her MAC' with the one that came
with the message. IF they are identical they are correct.
How can an encryption algorithm be used in a MAC function? - Answers -When an
encryption algorithm is used in a MAC function only the "forward cipher" (the encryption
part) is used. The "reverse cipher" (decryption part) is not used.
,What is/are the inputs to a hash function? What is the output? - Answers -In
cryptography a hash (or message digest) is a value produced by a hash function.
What makes the output pseudo-random in hash? - Answers -A hash function takes a
sequence of bits,
chops it up, mixes it around,
and puts out a fixed-length value. Its always the same for 1 input.
What is a collision onto a hash value? Why is it very unlikely? - Answers -With a good
hash function it is extremely unlikely
that it will produce the same output value
for a different input.
What does the recipient of a message and a hash do with them? Why? - Answers -She
can compare her hash' with the one that came
with the message. If its the same, no collision has occurred.
What information security service is provided by a MAC but not by a hash? - Answers -
MAC's provide the origin of the message.
What is an HMAC? - Answers -keyed-hash message authentication code
If the key is known only to the sender and the recipient (and no-one else)
the matching hash could have been produced only by the sender or the recipient.
The recipient knows she didn't send this message+hash to herself
so it must have come from the apparent sender.
She has authenticated the origin of the message
What information security service is not provided by a MAC? - Answers -A MAC
provides authentication of origin to the recipient
but does not deter the sender from lying about this
so it does not provide non-repudiation. `
What does the sender of a message know that no-one else knows? - Answers -their
private key.
What is a digital signature? How is it generated? - Answers -When the sender of a
message generate a hash of it and encrypt the hash using an asymmetric algorithm with
his/her private key.
How is a digital signature verified? - Answers -The recipient can generate a hash of the
received message. She can decrypt the received encrypted hash using the public key*
of the apparent sender.
She can compare her hash to the decrypted hash.
Encryption is reversible by decryption. Is a hash function reversible? - Answers -A hash
function is a one-way process
, - the hash value does not have enough content to reproduce the message.
What is a rainbow table? Why does it make an attack feasible? - Answers -Table of
likely passwords and the hash for each
and search it for a matching hash in reasonable time.
How does "salting" password hashes affect the usefulness of a rainbow table? -
Answers -add a pseudo-random value known as a "salt" to a password. An attacker
would need to generate a rainbow table
of all possible salt values for each likely password.
With a large enough salt range this is impractical.
How does MS-CHAP use a hash function? - Answers -client sends a login request to
the server, server returns a pseudo-random value, user provides the password to the
client, client appends the provided password to the challenge
and calculates a hash of the result and sends to server, server appends the password it
holds to the challenge it generated and gets hash , If the hash from the client is identical
to the hash calculated by the server the login request is accepted.
MS-CHAP hash function: What user function does this enable? - Answers -The
password is not transmitted over the network link.
What is information? - Answers -knowledge obtained from investigation, study, or
instruction
What is the difference between "information" and "data"? - Answers -Data has no
context. Information is data with more context so you know what youre looking at.
information security (IS) - Answers -focuses on protection of information assets
information assurance (IA) - Answers -focuses on the correctness of information. Is
sometimes described as providing the right information to the right users at the right
time.
Non-repudiation - Answers -It deters the sender of a message from claiming he didn't
send it.
threat action - Answers -a specific instance of that potential being realized.
threat agent - Answers -someone or something that creates a threat action.
This includes:
- people who deliberately attack;
- people who make mistakes or have accidents;
- natural events.
3 types of threats: - Answers -Natural events, Human errors, Attacks
