Assignment 2

On chapters 3 and 4

Due: September 1, 2009, Midnight EST

Total: 40

1. Determine whether the following passwords are good or bad. For each password you must explain why it is easily crackable or why not in light of the attacks that you have studied in chapter 3.                         3 points each

a. ACZ 1680

b. ArmStrong45

c. iLoToWaMo (I love to watch movies)

d. ColumbusState2009

2. Assume that passwords are limited to use 95 printable ASCII characters. All passwords must be of length 10 characters.

a. How many passwords can be generated with these constraints?                                  4 pts

b. Consider a password cracker that cracks passwords with a rate of 50 million passwords per second. How long will it take to test exhaustively all possible passwords in a UNIX system?                                                4 pts

3. For DAC model discussed in section 4.3 an alternative representation of the protection state is a directed graph in which each subject and each object are represented by a node. An entity which is both subject and object is represented by a single node. A directed line

from a subject to object indicates an access right. A label on that link [      Read            ] defines the type of access right.

a. Draw a directed graph that corresponds to the access matrix of Figure 4.3a.                                   4 pts

b. Draw a directed graph that corresponds to the access matrix of Figure 4.4.                                     4 pts

4. Assume a system with N job positions. For job position k, the number of individual users in that position X_k, and the number of permissions required for that position is P_k.

a. For a traditional DAC scheme, how many relationships between users and permissions must be defined?          3 pts

b. How many such relationships must be defined for a RBAC scheme?                                                                       3 pts

5. Consider a system with three users: Alice, Bob and Todd. Each owns files alicerc, bobrc and toddrc correspondingly. Bob and Todd can read alicerc, Todd can read and write bobrc, Alice can read bobrc. Only Alice can read and write alicerc, the file she owns. Assume that each file can be executed by its owner.

a. Create the corresponding access control matrix.                                                                    3 pts

b. Create access control lists for all three files.                                                                           3 pts