Alexandra, a high net worth customer, banks on-line at Banking Bureau Services (BBS) and has agreed to use 3DES in communicating with BBS. One day, Alexandra received a statement that shows a debit of $10,000,000 from her account. On inquiring, she was told that the bank manager, Billy, transferred the money out of Alexandra's account and into an account of his own in an offshore bank. When reached via long distance in the Cayman Islands, Billy produced a message from Alexandra, properly encrypted with the agreed upon 3DES keys, saying: "Thanks for your many years of fine service, Billy. Please transfer $10,000,000 from my account to yours as a token of my esteem and appreciation. Signed, Alexandra."

Alexandra filed suit against Billy, BBS and the government of the Cayman Islands, claiming that the message was a forgery, sent by Billy himself and asking for 5x damages for pain and suffering. Billy has responded by claiming that all procedures were followed properly and that Alexandra is filing a nuisance suit. You have been employed by BBS as a cryptographic expert to assist in the investigation of this matter, and will produce a report for the BBS Board of Directors, which will assist them in determining how to proceed in this matter.

Your report to the Board of Directors should address the following issues:

• What can be determined from the facts as presented about whether Alexandra intended to make Billy a gift of $10,000,000?
  Assuming BBS wishes to continue using only 3DES as its cryptographic system, what could BBS and Alexandra have done to protect against this controversy arising?
  Would this controversy have arisen if BBS had been using AES rather than 3DES?

What can be determined from the facts as presented about whether Alexandra intended to make Billy a gift of $10,000,000?

Assuming BBS wishes to continue using only 3DES as its cryptographic system, what could BBS and Alexandra have done to protect against this controversy arising?

Would this controversy have arisen if BBS had been using AES rather than 3DES?

Clearly address these issues, with sufficient detail and background to allow the "cryptographic-ally challenged" Board of Directors to understand the issues involved and formulate plans for how to approach the immediate issue with Alexandra, and to continue business in the future, assuming that they want to continue using 3DES.