additional lecture (instead of 9.10.2020): time=11.11.2020, 11:15-13, as usual the lecture will be recorded
and made available for participants
exam:
3.2.2021, online, 9:00-11.00
the second chance: 10.2.2021, online, 9:00-11.00
the password to the internal subpage have been sent over Edukacja
the preparatory set of problems for the exam given in the internal subpage and on ePortal
Assignments:
Assignment 1 ``malicious devices'' :
We have discussed examples on how to create a trapdoor in the output of a device
that allegedly follows some secure cryptographic protocol.
Your task is to examine a communication protocol of your choice -- the only conditions is that it must be used in practice.
You have to show how to create such a trapdoor in the following situation:
you have the full access to the protocol implementation on the attack device,
the modification should be undetectable when the messages of the protocol are inspected by an observer having
no access to attacker's secrets,
the attacker (and nobody else) should be able to recover the plaintext messages sent with this protocol.
In particular, a person who has a read
access to the code contained in the device should not be able to do it.
Your task: provide a report containing:
a concise and clear description of the attacked protocol,
a description of the attack focusing on the crucial details.
Submission:
deadline: 25.11 (strict)
format: pdf file
where: over ePortal
Assignment 2 ``ABAC'' :
Your task is to present an ABAC policy written in XACML language for the following real world case:
there is VOD server that enables downloading a movie if the following occurs:
the user has status active (the saldo on the account is higher than the price for downloading) -- in this case remember about the obligation to change the saldo!
some videos have the status ``free of charge'' so anybody with a positive saldo can download,
in case of retired people the price is reduced by 30%, some movies are free of charge for these customers,
but age limitations apply: for each movie there is a minimal age of the viewer
licence for a video can be restricted to some country.
Of course, you have to assume that certain data are in external data sets. E.g. you have to determine the age so you have to fetch the birthday of the subject requesting access rights.
The answer should be composed of two parts:
part 1: informal description of the solution architecture
part 2: XACML policy (you may interrupt it after you have got already 4 pages)
no penalty for copy-paste from available examples! Reuse the work already done.