Figure below shows the SSL Protocol stack. The SSL Record Protocol provides basi

Question

Figure below shows the SSL Protocol stack. The SSL Record Protocol provides basic security services to various higher-layer protocols. In particular, the Hypertext Transfer Protocol (HTTP), which provides the transfer service for Web client/server interaction, can operate on top of SSL. Three higher-layer protocols are also defined as part of SSL: the Handshake Protocol, Change Cipher Spec Protocol, and Alert Protocol. These SSL-specific protocols are used in the management of SSL exchanges. For each attack listed below, which of the four higher-layer SSL protocols is most helpful for preventing the attack? Brute-Force Cryptanalytic Attack: An exhaustive search of the key space for a conventional encryption algorithm. Known Plaintext Dictionary Attack: Many messages will contain predictable plaintext, such as the HTTP GET command. An attacker constructs a dictionary containing every possible encryption of the known-plaintext message. When an encrypted message is intercepted, the attacker takes the portion containing the encrypted known plaintext and looks up the ciphertext in the dictionary. The ciphertext should match against an entry that was encrypted with the same secret key. If there are several matches, each of these can be tried against the full ciphertext to determine the right one. This attack is especially effective against small key sizes (e.g., 40-bit keys). Replay Attack: Earlier SSL handshake messages are replayed. Man-in-the-Middle Attack: An attacker interposes during key exchange, acting as the client to the server and as the server to the client. Password Sniffing: Passwords in HTTP or other application traffic are eavesdropped. IP Spoofing: Uses forged IP addresses to fool a host into accepting bogus data. IP Hijacking: An active, authenticated connection between two hosts is disrupted and the attacker takes the place of one of the hosts. SYN Flooding: An attacker sends TCP SYN messages to request a connection but does not respond to the final message to establish the connection fully. The attacked TCP module typically leaves the "half-open connection" around for a few minutes. Repeated SYN messages can clog the TCP module.

Explanation / Answer

brute force attack- SSL change cipher spec protocol known plain dictionary attack - SSL change cipher spec protocol replay attack - SSH handshake protocol man in the middle attack- SSL alert protocol password sniffing- SSL alert protocol IP spoofing- SSL alert protocol IP hijacking- SSL handshake protocol SYN flooding- SSL alert protocol

Related Questions

Navigate

• Browse (All)
• Browse F
• Subjects

---

---

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.