Submission Guidelines
Submission Files:
1. A report in PDF file format. On various text editor software you can use ”Save as PDF” option or use free converters to convert your file to PDF.
2. A python file for password management.
3. A python file for dictionary attack on SSH.
4. An imn file containing the configuration for Core Network Emulator.
Notes:
1. Do not submit a compression of multiple files. Such submissions may risk losing partial or complete assignment marks.
2. A handwritten document is not acceptable and will not be marked even if converted and submitted electronically.
Submission Platform: Electronic submission via Moodle.
Filename Format: Name your files for different assignment tasks as follows,
1. report SID.pdf
2. mypass SID.py
3. jtrssh SID.py
4. core SID.imn
where SID is your Student ID.
Note: You must strictly follow the provided file name format or penalties will apply.
Marks
1. [20 Marks] Joe is using the following algorithm to generate RSA keys.
import gmpy2 as gmp from gmpy2 import mpz def rsa_keygen (N): ’’’To generate RSA of size N bits ’’’ key pair UB = 2**(N // LB = 2**((N // status = True 2) - 1 2) - 1) p = p = q = rand_n(LB , UB) gmp. next_prime (p) gmp. next_prime (p) e = mpz (65537) n = mpz(p * q) phi_n = mpz ((p - 1) * (q - 1)) if gmp.gcd(e,phi_n) == 1: d = gmp.invert(e, phi_n) else: status = False d = -1 returnSince you have done Information and Network Security subject in your undergraduate degree, the CIO of the company you are currently employed at asks you to analyse the security of Joe’s algorithm. To assist you in this task Joe has provided a sample public key generated using his method and an encrypted message. You can download these values from moddle under ”My Assessment” section named ”Download Individual Sample of Public Key and Ciphertext”. If you find Joe’s algorithm to be secure then you must justify it by explaining the difficulty of recovering the plaintext from the ciphertext and the knowledge of public key. If you find Joe’s algorithm to be vulnerable then you must first explain how you can recover the plaintext from the ciphertext and the provided public key. You must then include the recovered plaintext in your report.
If you are able to factor the modulus as well then you must include the factors (p and q) as well as the private exponent d.
Note: The rand n() function generates a random mpz number between lower and upper bounds. You can assume that this function is secure or in other words the security of this function is not the focus of this task. You can implement rand n() function if you wish to run the given code however that is not required to be able to answer this question.
2. [20 Marks] Write a simple personal password management application with python. Use the provided Virtual Machine for Lab exercises to test your code as it comes with pyca library installed. The application must have the following command line options (you can use argparse):
• -add followed by a name to add a password under the given name
• -show followed by a name to show a previously added password under the given name on standard output (without newline)
• -update followed by a name to update a previously added password under the given name
The provided name with -add option must be used as a file name that will contain the encrypted password. You must use RSA public key algorithm to encrypt the passwords. Generate a self-signed X.509 certificate using openssl tool where the private key file is password protected. For simplicity hard code the default location to store the certificate and private key files as well as encrypted password files to be ~/.mypass directory (use os.path.expanduser(’~/.mypass/’) to make the path absolute). You must use OAEP for padding. OAEP requires a hash function for the padding for which use SHA1 to be compatible with openssl tool.