2016 07 20

Page 1

Cryptography and Architectures for Computer Security Exam Code: 095947 (old 090959), A.Y. 2014–2015, Semester: 2 Prof. G. Pelosi July 20th, 2016 – Exam Session Name: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Surname: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Student ID: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Signature: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Time: 2h:30’. Use of textbooks, notes, phones or Internet connected devices is not allowed. Prior to turn in your paper, write your name on any additional sheet and sign it. Question 1 [6 pts] Alice and Bob wish to use a block cipher in either CBC or CTR mode of operation for exchanging encrypted data. An (active) adversary is able to intercept and change messages sent between Alice and Bob. Consider the following scenarios. (a) In some messages sent by Bob, it is the case that the last block is a randomly generated secret key. For the two modes, establish whether the adversary can corrupt the transmitted messages, so that Alice receives a message that looks good after decryption, but contains the wrong key. (b) In some messages sent by Bob, the adversary may know the first blockM1 and want to replace it by another block A1 of his choice, leaving the rest of the message unchanged. Show that the adversary can achieve this if CTR mode of operation is employed. Do you think he can do it also with the CBC mode? Solution: (a) For both modes it is the case that the adversary can replace the last ciphertext block with any other block. When Alice decrypts the message all previous blocks will be unchanged and the message looks good; the last block will be corrupt, but since it is…