QUESTION 1

(a) Describe the following security services: Confidentiality, Availability

(b) Explain "Known Plaintext" attack?

(c) What do you understand by the terms "Playback", "Spoofing"?

(d) Distinguish between unconditional security and computational security

(e) Discuss two drawbacks of steganography

(f) Describe the operation of a Trojan Horse program. How can we protect our computer from such a program

QUESTION 2

(a) Give 3 examples of physiological or behavioral traits that can be used for biometrics

(b) Give 2 reasons why biometrics is not as popular as password based systems

(c) Assume two entities A and B want to communicate securely using symmetric encryption. Describe how secure key distribution can be achieved by using a trusted key distribution centre (KDC)

(d) What is the major weakness of key distribution using KDC. List 2 ways how this can be overcome

(e) Give 2 examples of modern block cipher other than DES

(f) Digital signature provides non-repudiation. Explain how this is done

(g) Give one example of a MAC algorithm and one example of a hash function

QUESTION 3

(a) Given the following two password policies, which one would you choose for more security. Justify your answer

• A: only 8 letter passwords using only 26 letters (upper or lower case) or the 10 digits
• B: only 6 letter passwords but from any of the 127 ASCII characters

(b) What is the advantage of using groups for access control?

(c) Describe the following threats to firewalls-

(I) Denial of service

(II) IP Spoofing and

What countermeasures can be adopted against these threats

(d) IPSec uses two protocols for security: Authentication protocol (AH) and the Encapsulated Security Header Protocol (ESP). Why is AH used with ESP although ESP provides some authentication?

(e) What is a Security Association (SA) and what does it define? Why are there two SAs per one connection? How can two communicating peers agree on what kind of SAs they use?

QUESTION 4

(a) List 3 schemes for email security

(b) Give an example of a symmetric encryption algorithm is used by PGP?

(c) What algorithm is used by PGP for email compatibility and why?

(d) SET allows the merchant to view only the order information and not to have access to the payment information. Similarly, the payment gateway gets access only to the payment information. Explain how this can be achieved using a dual signature and public key cryptography