encryption and hash algorithms

<Carmen Alcivar> NORTHEASTERN UNIVERSITY 360 Huntington Ave, Boston, MA.

LAB ASSIGNMENT 8 – FOUNDATIONS OF INFORMATION ASSURANCE (IA5010)

Contents Lab #7: Using Encryption to Enhance Confidentiality and Integrity ............................................... 2

a. Assessment Sheet ........................................................................................................................ 2 b. Challenge Question ..................................................................................................................... 2 c. Screenshots: ................................................................................................................................ 2

Lab #12: Applying Encryption and Hashing Algorithms for Secure Communications ..... 5 a. Assessment Sheet ........................................................................................................................ 5 d. Challenge Question ..................................................................................................................... 6 e. Screenshots: ................................................................................................................................ 6

Lab #7: Using Encryption to Enhance Confidentiality and Integrity

a. Assessment Sheet Course Name and Number: Foundations of Information Assurance – IA5010 Student Name: <Carmen Alcivar> Instructor Name: Derek Brodeur Lab Due Date: <3/6/16> Lab Assessment Questions & Answers 1. If you and another person want to encrypt messages, should you provide that person with your public key, private key, or both?

I should give only the public key and never give my private key.

2. What does Kleopatra allow you to do once it is installed? It allows to generate a public and private key as both, a sender and a receiver. I can use a sender’s keys to encrypt a file, send it to the receiver, then I can decrypt it using the receiver’s copy of the keys.

3. What key type was used to create the certificate on Kleopatra? What other types of encryption key types are possible? The key type used to create the certificate was of the type RSA. DSA is the other type of key that can be created in Kleopatra. 4. What was the fingerprint generated with your Kleopatra certificate? See fingerprint in screen below

5. If someone sends you his public key and you import it into Kleopatra, will he be able to

decrypt the encrypted messages you send him? Yes

b. Challenge Question c. Screenshots:

Part 1: [Deliverable Lab Step 8]: a screen capture showing the finger print generated by the key creation process

Part 4: [Deliverable Lab Step 25] : a screen capture showing the Kleopatra decryption results window, the successfully decrypted secret-message.txt

Lab #12: Applying Encryption and Hashing Algorithms for Secure Communications

a. Assessment Sheet Course Name and Number: Foundations of Information Assurance – IA5010 Student Name: <Carmen Alcivar> Instructor Name: Derek Brodeur Lab Due Date: <3/6/16> Lab Assessment Questions & Answers

1. Compare the hash values calculated for Example.txt that you documented during this lab. Explain in your own words why the hash values will change when the data is modified? Values changed because when the hash is applied to the data, one unique checksum is generated. If the content remains the same in the file during transmission, the checksum will remain the same every time. However, if the content varies, it will alter the calculation of the checksum. This is very useful so recipients of messages can confirm the identity of senders and ensure the integrity of the data after transmission. Hashes have a dual function since they help with authentication of sender and to ensure the integrity of messages.

2. Why are the MD5sum and SHA1sum hash values the same every time you calculate

for the example.txt file? What if it were different when you recalculated the hash value at the other end? They remained the same every time they were calculated because the information was not altered. On the contrary, a different value would mean that the information was altered during transmission.

3. If you want secure e-mail communications without encrypting an e-mail message,

what other security countermeasure can you deploy to ensure message integrity? Hash algorithms can be used to ensure message integrity of the message besides encryption.

4. What is the –e switch used for with running the GnuPG command? a. Extract b. Encrypt (answer) c. Export

5. What is the difference between MD5sum and SHA1sum hashing calculations?

Which is better and why? 2MD5 uses a 128-bit hash sum and SHA1 uses a 160-bit hash sum, the more bits in the hash sum, the greater the integrity checking of each bit that is transmitted from the source to its destination. For instance, the SHA1sum is better .

6. Name the cryptographic algorithms used in this lab? Two of the most common hash algorithms were used. 1) MD5 (Message-Digest algorithm) 2) SHA1 (Secure Hash Algorithm)

7. What do you need if you want to decrypt encrypted messages and files from a trusted sender? I need to have their public key (sender provided) and the respective encryption software. In this lab we used the free software GNU Privacy Guard (GnuPG)

8. What is the -d switch used for when running the GnuPG command a. Detach

b. Destroy c. Decrypt (answer)

9. When creating a GnuPG private key, what are ways to create entropy? At the prompt in a different opened terminal (second), we enter the code find * / && find

* / && find * / && find * / && find * / && find * / as many times as needed in order to get more random bytes (entropy) in the first terminal. Even, play solitaire works as well. All this until the prompt appears in the first window where we were working.

d. Challenge Question e. Screenshots:

Part 2: [Deliverable Lab Step 6]: screen capture to show create an MD5sum hash string for the Example.txt file

[Deliverable Lab Step 10] Enter to view the contents of the Example.txt.md5 hashed file

[Deliverable Lab Step 14] showing the SHA1sum hash string

[Deliverable Lab Step 18] a screen capture showing the contents of Example.txt.sha1

Part 3: [Deliverable Lab Step 4] a screen capture showing the new MD5sum hash string for the modified file.

[Deliverable Lab Step 6] a screen capture showing the SHA1 hash string for the modified file. Please note that the numbers have changed because the content of the file changed, more text was added. This is a very useful tool to an analyst because they can verify the integrity of the data, that it has not been compromised.

Part4: [Deliverable Lab Step 16] a screen capture showing the contents of the /home/student folder

[Deliverable Lab Step 24] a screen capture showing the contents of the /home/instructor folder

I had problems but at the end I was able to see the instructor.pub file as indicated. See below.

Part 5: [Deliverable Lab Step 7] a screen capture showing the GnuPG keys

Part6: [Deliverable Lab Step 8] a screen capture showing the contents of the encrypted file

[Deliverable Lab Step 18] screen capture showing the contents of the clear text.txt.gpg , decrypted text