Suppose a user employs one-time passwords as above (or, for that matter, reusable passwords), but that the password is transmitted sufficiently slowly. (a) Show that an eavesdropper can gain access to the remote server with a relatively modest number of guesses. (Hint: The eavesdropper starts guessing after the original user has typed all but one character of the password.) (b) To what other attacks might a user of one-time passwords be subject?

Suppose a user employs one-time passwords as above (or, for that matter, reusable passwords), but that the password is transmitted sufficiently slowly. (a) Show that an eavesdropper can gain access to the remote server with a relatively modest number of guesses. (Hint: The eavesdropper starts guessing after the original user has typed all but one character of the password.) (b) To what other attacks might a user of one-time passwords be subject?

Database System Concepts

7th Edition

ISBN:9780078022159

Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Publisher:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Chapter1: Introduction

Section: Chapter Questions

Problem 1PE

See similar textbooks

Similar questions

At best, I have just a fundamental grasp of what is meant by multi-factor authentication. To what extent does it aid in avoiding the theft of passwords, and how exactly does it achieve this?
When an attack is being carried out, what purpose does it serve to employ poison packets? Could you illustrate your point with a few specific instances?
Is it possible for a message authentication code to change the Tag or the ciphertext while it is in transit? Recipients will always be able to detect a tampered Tag/ciphertext, rendering this attack futile.
Is a MAC (message authentication code) capable of modifying the Tag and the ciphertext while they are in transit? This attack will fail because the recipient will always be able to identify a changed Tag/ciphertext.
Consider the following scenario: you receive an email from your company's mail server alerting you that your password has been changed and that you must take action to confirm this. However, as far as you are aware, you have not changed the password. What gives? Why was the password changed, and what could have caused it to be changed? How did an attacker obtain the information they required to successfully reset the password? Was it a virus, and on what systems did it infect?
The idea of authenticating a user by using two different factors is completely foreign to me. What sort of an effect does this have on the safety of people's passwords?
Consider the following scenario: you get a message from your company's mail server informing you that the password for your account has been changed and that you must confirm the change. According to what you know, you have not altered the password! What may have motivated the password change, and how did it happen? Was it a virus, and if so, on which computers, that may have given an attacker with the information they needed to successfully reset the password?
Is it possible to alter the Tag (the MAC) and the ciphertext while they are in transit using a MAC (message authentication code)? The receiver can always identify a changed Tag/ciphertext in this attack, therefore explain why it will not succeed.
What happens if an attacker attempts to modify the Tag (the MAC) and the ciphertext while the message is in transit while using a message authentication code (MAC)? Explain why this kind of attack will never succeed since the recipient would be able to recognise a changed tag or ciphertext.
Based on your understanding , what could be the impact of broken authentication vulnerability on your system? a. An attacker may induce the victim to perform an unintended action. b. An attacker may misuse the expected order of operations. c. An attacker may retrieve data that are not meant to be exposed to the public. d. An attacker may carry out a brute force attack to guess weak passwords.
For attacks that use MACs, the Tag (the MAC) and the ciphertext are both targets (message authentication code). In what ways could I possibly regret doing this? Even if the attacker is successful in changing the Tag or ciphertext, the target will always be able to tell the difference.
What happens if an attacker changes the Tag (MAC) and ciphertext of a message in transit? Explain why this attack fails because the recipient can always tell whether the Tag or ciphertext has been tampered with.