Worksheets are self-guided activities that reinforce lectures. They are not graded for accuracy, only for completion. Worksheets are due by the start of the next lecture via Blackboard link as a single PDF document. Be sure to properly label each question.
-
What is key management?
Reveal Solution
The collection of mechanisms and protocols for safely and conveniently distributing cryptographic keys for the purpose of confidential and authentication.
-
Why do public-key cryptography, on its own, not provide authenticity/integrity?
Reveal Solution
When you receive a public key from someone, you can use that to encrypt messages using the key that can only be decrypted by the public key, but you cannot determine if that public key your using is actually the public key of the recipient you intend. For example, anyone can send you a public key and say: “Hey, this key belongs to Google!” How do you check that?
-
How do public-key certificates address the challenges of authenticity of public keys? How is trust determined in these certificates? (Your answer should include “certificate authorities” (CAs))
Reveal Solution
A public-key certificate is a document, signed by a certificate authority, that authenticates that the public key by binding it to an identity (i.e., a subject).
If you know, for sure, the public key of the CA and you trust its judgement, you can verify the signature on the certificate and authenticate the owner of the public key.
-
What steps should a CA take before issuing a certificate? And provide an example of how each of these can be verified.
Reveal Solution
-
Evidence of knowledge of the corresponding private key. For example, this can be accomplished by providing the CA a signed certificate request that is signed with the corresponding private key of the public key that is being certified.
-
Evidence of ownership or control of a computer-addressable identity or asset domain (e.g., a web adress) in the Subject field. For example, this could be placing on a webpage a special signature showing you control the domain, or adding a field to the DNS registrar.
-
Confirmation of assert natural-world names. This could be done by submitting IDs. Note that this isn’t typically required for TLS/HTTPS, but could be the case for other kinds of authentication, such a chip-based ID cards.
-
What is a certificate chain? And when are they used? Provide an organizational example.
Reveal Solution
A root CA (the base of the chain) can also issue signatures for another CA, such as one for an organization, that in turn issues signatures for entities. Consider, for example, GW creating a CA for x.gwu.edu domains. A root CA would issue a certificate for GW’s signing certificate, that would sign all the certs for GW.
When validating this certificate, you verify each of the intermediate CA’s, up to the root CA.
-
What is a self-signed certificate and why, typically, they are considered untrusted except for known CAs?
Reveal Solution
A self-signed certificate is a certiciate that is only signed by corresponding private key of the public key being identified. It only shows that the entity that issued the cerficate possess the private key, but doesn’t directly authenticate public key.
Root CA certificates are self-signed as they are the root of trust, and as a result a known set of valid, trusted root CA certificates are distributed with devices.
-
What is the difference between a DV, OV, and EV certificate in HTTPS/TLS?
Reveal Solution
-
A DV certificate, or domain validated certificate, validates the subject of the certificate for a given domain, such as gwusec.seas.gwu.edu, and is only valid for that domain
-
A OV certificate, or organization validates certificate, requires showing that you own the domain and other manual listed information, such as physical information.
-
An EV certificate, or extended validation certificate, are further verifications of ownership, including checking real-word existence of the domain and exclusive control over the domain, like x.gwu.edu
-
Find two websites, one with an EV and one with just a DV certificate. How does your browser display these certificates differently, if it at all?
Reveal Solution
It’s actually very hard to tell! If you go to a website and click on the lock indicator, you can see that for some sites, they indicate the full details of the company to whom the certificate was issues vs. just who issued the certificate
-
Do some research on your own to determine why do you think EV certificates were de-emphasized in browsers? Here’s a hint.
Reveal Solution
EV certificates used to make the browser address bar turn green, but it turns out that this was not widely understood by users and didn’t actually impact security. Instead, browser developers determined that it would be better to instead directly empahsize if the connection is secure as the default state and only give indicators when this is not the case. Too complex indicators confuse users and can lead to decreased security.
-
There’s a great website for comparing browser behavior for different SSL certificates and other errors: badssl.com. Provide a brief comparison of some of the browser features to warn users of different states between a valid SSL and that of plain HTTP (no TLS)
Reveal Solution
In most browsers, these days, there is nothing or a simple lock displayed for the default state of secure. Without SSL, often a lock with a line through it, or some other indicator.
Again, this emphasizes that the goal of these indicators is more to note the BAD state only and assume the good state otherwise.
-
What is certificate transparency, and why is it important? Read about it on Wikipedia.
Reveal Solution
Certificate transparency refers to the process of tracking all the domains for which a certificate was issued. With the proliferation of new or rouge CAs, it’s difficult to trust that they wouldn’t issue a certificate for a large domain, like google! to prevent this, the browser can check that the right CA has signed the certificate by checking a monitor.
If you want to explore the CT log, you can do so here: crt.sh/
-
S/MIME is a PKI system for sending authenticated and encrypted email. And you’re going to use it send me an encrypted email! But it will take a bit of work.
First, you will need to create a S/MIME certificate for your email and have that certificate signed by a trusted certificate authority (CA). You should use your school email address for this, e.g., the one @gwmail.gwu.edu. Be sure to sign up with the email from which you send emails; otherwise, your signature will not match.You are free to choose whatever CA you wish and there are options you can (and should) find that cost no money. I recommend this one:
https://extrassl.actalis.it/portal/uapub/freemail?lang=en
After you do that … you’ll need to do some work to figure out how to do this on your system. That’s kind of the point of this exercise. Note that you cannot use the school GMail for this as it is not configured for S/MIME. Instead, I recommend using Outlook, which is incldued as part of Office 360 package from school.
Once you think you have this setup, send me an email with the subject S/MIME: YOUR FULL NAME where YOUR FULL NAME is your full name and include your certificate as an attachment. I will reply and do the same. Then, on the third email, send me an encrypted email now that you have my public key. I will reply with an encrypted email as well.
To answer this part, include the encrypted email message I sent to you in your submission, and also 2-3 sentences reflecting on this process. Do you think this was easy or hard? Could you convince your friend without a CS background to do this?
Reveal Solution