Objectives:
CITS3004 Cybersecurity Lab 3: Public Key Encryption
1. To study keyed crypto system.
2. To evaluate vulnerabilities of crypto systems due to potential attacks from the man-
in-the-middle.
3. To learn how to create RSA keys using openssl.
Tasks:
Task 1: RSA
In this task we will create simple programs to derive the RSA public and private keys, and then we will use the keys to encrypt and sign a message. You can write these programs in Python or C. Keep in mind that your facilitator will have a solution for the task in Python.
a) Derive Private and Public keys
Derive the public key (e, n) and private key (d, n).
1. Let p, q, and e be three prime numbers and n = p*q.
2. Select e and two large (> 1024 bits) primes p, q. This will generate keys (n and d) of
size 2048 bits. For the primes generation, refer to the link below:
https://www.mobilefish.com/services/rsa_key_generation/rsa_key_generation.php
3. Implement the RSA algorithm which is found in the slides of lecture 3. You can use lab3_rsa_task1a as a template.
b) Encrypt a Message
Given e=0x010001 and n= 0xe726db87d69e55ef7e96ddcd5f837d29. Encrypt the message ¡°A top secret!¡±.
c) Decrypt a Message
Decrypt the message 0xcb42f3711ecfef4ac0b25aa2f4c0f48f. Given d=0xd34514c9a743b8ce1c06d2ae5a03aab1 and n=0xe726db87d69e55ef7e96ddcd5f837d29.
d) Sign a Message
Given a Private Key (d, n) where d= 0xd34514c9a743b8ce1c06d2ae5a03aab1 and n= 0xe726db87d69e55ef7e96ddcd5f837d29. Sign the message ¡°I owe you $4000¡±. The encrypted message is s=0x2e7de46cce98bb21c400ac8eb535e004
e) Calculate the key using openssl
Find the values of e, d, n, p and q for the following openssl rsa private key:
Note: download this key from LMS: lab3_taskf_rsa_privatekey.pem Task 2: Diffie-Helman (DH)
In this time you will derive shared DH keys, create your first cyberattack and then find a mechanism to mitigate the attack.
a) AliceandBobSharedKey
Derive the shared key between Bob and Alice. Do the following:
1. Alice calculates ga mod p for the parameters (g, a, p) = (10, 5, 541)
2. Alice sends ga mod p to Bob
3. Bob calculates gb mod p and k using (b, p) = (7, 541)
4. Bob sends gb mod p to Alice
5. Alice calculates k
Check that Bob and Alice derives the same k.
b) Man In the Middle Attack
Insert Eve to the scenario of Task a). Now calculate the shared keys between k1 = (Alice, Eve) and k2 = (Eve, Bob) given that secret value of Eve c=5. What would happen if k1 and k2 are different?
c) Mitigate the Man In the Middle Attacks
One approach for mitigating an attack is to ensure that Alice and Bob verify their identities. To do so, they must sign their message using the public and private keys. Do the following for this task:
1. Alice sends ga (same as previous tasks) and A=2791 to Bob.
2. Bob sends back B=8507, gb and SIGB(m), where m=(ga, gb, A).
3. Bob signs the message SIGB(m) using his key.
4. Alice uses the key of Bob to verify the signature SIGB(m)
How does Alice know if the what she receives was actually from Bob?.
Note: download Bob¡¯s key parameters from LMS: lab3_dh_task2_Bob_publicKey.txt and lab3_dh_task2_Bob_privateKey.txt.
Remember to complete the Lab Quiz 3 by this Sunday at 23:59 Good Luck and see you at next week lab 4!
—–BEGIN RSA PRIVATE KEY—– MIIBPAIBAAJBANc5q9/ityjK2hxh6SKjf8c+dsK2/0rq3UmDbRRhfo7aQ0xY8ANP Ws5i4/blhoxIMWXiOLbZ91G8LOS3VTtiOnMCAwEAAQJBAIPDAOBN8gf9OE6L+qiE JCQcr6RBWEXLR7JLzanejhZxlRbpyLR/eHO0FSF01hbxiRI3iGESn4lWrWz7xxA0 4tECIQD7DkNAR8DZzBVM/IrRPkNFGA1eVxnIwfqfJPusFXASzwIhANt2w4u7WfKg S2pA2MPakngG0zC2LNNoztICl+qp6JcdAiAY7TqaKEWqmkvHIA/8ZI0zUAcLxeQm fbQPlxFx7ZL6GwIhAI/cOjLOjRfOm6D7ARzhmkGzt5ymzpuGiIyBxrO8zQrBAiEA ySy0dyDDBQcibYwnUDS1/MmD8IzLS9SV8OPOsrHNwVc=
—–END RSA PRIVATE KEY—–
1. Seed Labs, Syracuse University
2. Primes Generator:
https://www.mobilefish.com/services/rsa_key_generation/rsa_key_generation.php
3. Openssl documentation
https://www.openssl.org/docs/man1.1.1/man3/EVP_EncryptInit.html
References
Copyright ý 2018 Wenliang Du, Syracuse University.
The development of this document was funded by the National Science Foundation under Award No. 1303306 and 1718086. This work is licensed under a Creative Commons Attribute-NonCommercial-ShareAlike 4.0 International Licence. A human-readable summary of (and not a substitute for) the license is the following: You are free to copy and redistribute the material in any medium or format. You must give appropriate credit. If you remix, transform, or build upon the material, you must distribute your contributions under the same license as the original. You may not use the material for commercial purposes.