QMCS 490 - Class Today

QMCS 490 - Class Today • Handing back the exam • Projects • Certificates and Chaining • SSL and “Spot the Plaintext” R. Smith - University of St Thomas - Minnesota

Exam • 76 points total • Median: 88% (-9 points); Lowest: 82% • Let’s work through the problems • Problem 2 first – it’s easy • Just about everyone got it • I wanted to see physical security in sensible places • I wanted to see access control policies/procedures • Locks, access cards, whatever • Specify who gets in and who is excluded R. Smith - University of St Thomas - Minnesota

Problem 1 • Tradeoff study • You don’t list shared features! • I.e. choose between jeep and Hummer • 4WD • Gasoline powered • Internal combustion engine • Seats for driver and passengers • Which is most common today for linking sites? • If I didn’t come away convinced, you got 4 points off. • If you listed shared features, 2 points off • IDEALLY: 2 “real” reasons for/against each • Less than that, or wrong direction, and I took 4 points R. Smith - University of St Thomas - Minnesota

Problem 1 rough “answer” • Link encryption • Established technology (so says the book) • Potential crypto protocol weaknesses (replay, etc.) • Expensive to deploy – renting dedicated links (so says the book) • Expensive to add new links – new hardware EVERYWHERE • IPSEC crypto • More complex technology (so says the book) • Broader protections (anti replay, anti tamper) • Cheaper to deploy – just need an Internet connection • Cheaper to expand – just add the new site’s hardware R. Smith - University of St Thomas - Minnesota

Problems 3 and 4 • What are the 3 types/classes of firewall? • Problem 3: how can the different classes be used by a government to suppress information? • Points for identifying ‘real’ mechanisms • Points for linking it to information worth suppressing • Political items and commentary • Culturally inappropriate material (porn) • Problem 4: how can dissidents or other troublemakers circumvent these 3 firewalls? • At least 1 practical example for each for getting access • Not interested in plain old troublemaking R. Smith - University of St Thomas - Minnesota

Project Schedule • Team and project THIS WEEK • Tell me next Tuesday • What you’re doing; who you’re working with • Three page Outline by December 4 • Major ‘facts and elements’ of the topic • List of information sources you will use • Final Project Due last week of class R. Smith - University of St Thomas - Minnesota

Continuing with Certificates • Can someone tell me how a certificate works? • How does Firefox/Explorer, etc, validate a server certificate? • Crypto credentials • URL • How does ‘certificate chaining’ work? • Commercial certification authorities • Web of trust and confidence in keys R. Smith - University of St Thomas - Minnesota

How SSL Works • How do we use RSA to share secret keys? • Where is the plaintext? • What if we use RC-4 for encryption? • Generating distinctive keys from limited entropy R. Smith - University of St Thomas - Minnesota

That’s it • Questions? Creative Commons License This work is licensed under the Creative Commons Attribution-Share Alike 3.0 United States License. To view a copy of this license, visit http://creativecommons.org/licenses/by-sa/3.0/us/ or send a letter to Creative Commons, 171 Second Street, Suite 300, San Francisco, California, 94105, USA. R. Smith - University of St Thomas - Minnesota

QMCS 490 - Class Today