CMPS 122: Computer Security
Spring 2003

Homework #2

Please read the homework guidelines for information about how to work on the assignment and how to submit it.

1. Problem 4.3 in Stallings.
2. Problem 5.1 in Stallings.
3. [Problem 5.3 in Stallings] Each entry in the PGP public key ring contains an owner trust field that indicates the degree of trust associated with this public key owner. Why is that not enough? That is, if this owner is trusted and this is supposed to be the owner's public key, why is that not trust enough to permit PGP to use this public key?
4. For this problem, you're going to need to learn how to use PGP or GPG. You can install a free GPG client if necessary, or you can use a PGP client—they're interoperable (to some extent...).
   1. Create a public / private key pair for yourself using DSA and El-Gamal. Submit the public key to the MIT key server (http://pgp.mit.edu/).
   2. Email a (short) signed message to elm@cs.ucsc.edu and lanxue@cs.ucsc.edu. Include the phrase "CMPS 122" in the subject. This message should not be encrypted, but must be signed by your private key.
5. In a public key system using RSA, you intercept the ciphertext C=10 sent to a user whose public key is e=5, n=35. What is the plaintext M? You need to explain how you got your answer, and include in your answer any simple program(s) that you might have written.
6. In a public key system using El Gamal, you have intercepted a ciphertext C={515,18} sent to a user whose public key is <y=423,g=23,p=613>. What is the plaintext message M, and the user's private key x? HINT: you might want to write a simple program that computes modular exponentiation, and incorporate into your brute-force algorithm. If you do this in the naive way (g^x MOD p) on a calculator, you won't have sufficient accuracy. Instead, write a small piece of code that does a single multiply mod p and repeats this x times. Also, remember that (a/b) MOD m = c means that (b * c) MOD m = a. You need to explain how you got your answer, and include in your answer any program(s) that you might have written.