4. Consider a very simple symmetric block encryption algorithm, in which 64-bits blocks of plaintext are encrypted using a 128-bit key. Encryption is defined as C = (P ⊕ K0) @ K1 where C = ciphertext; K = secret key; K0 = leftmost 64 bits of K; K1 = rightmost 64 bits of K, ⊕ = bitwise exclusive or; and @ is addition mod 2^64.
a. Show the decryption equation. That is, show the equation for P as a function of C, K1 and K2.
b. Suppose an adversary has access to two sets of plaintexts and their corresponding ciphertexts and wishes to determine K. We have the two equations:
C = (P ⊕ K0) @ K1
C' = (P' ⊕ K0) @ K1
First, derive an equation in one unknown (e.g., K0). Is it possible to proceed further to solve for K0?
5. In this problem we will compare the security services that are provided by digital signatures (DS) and message authentication codes (MAC). We assume that Oscar is able to observe all messages sent from Alice to Bob and vice versa. Oscar has no knowledge of any keys but the public one in case of DS. State whether and how (i) DS and (ii) MAC protect against each attack. The value auth(x) is computed with a DS or a MAC algorithm, respectively.
a. (Message integrity) Alice sends a message x = "Transfer $1000 to Mark" in the clear and also sends auth(x) to Bob. Oscar intercepts the message and replaces "Mark" with "Oscar." Will Bob detect this?
b. (Replay) Alice sends a message x = "Transfer $1000 to Oscar" in the clear and also sends auth(x) to Bob. Oscar observes the message and signature and sends them 100 times to Bob. Will Bob detect this?
c. (Sender authentication with cheating third party) Oscar claims that he sent some message x with a valid auth(x) to Bob but Alice claims the same. Can Bob clear the question in either case?
d. (Authentication with Bob cheating) Bob claims that he received a message x with a valid signature auth(x) from Alice (e.g., "Transfer $1000 from Alice to Bob") but Alice claims she has never sent it. Can Alice clear this question in either case?