Part 1: running an RSA cipher Demonstration

Objectives
summarize the basics of cryptographic concepts.

Activity
Estimated completion time: 30 minutes

Description
The steps for encryption using rsa can be illustrated in a Java applet on a website. In this project, you will
observe how RSA encrypts and decrypts.

1. Use your web browser to go to https://people.cs.pitt.edu/~kirk/cs1501/notes/rsademo/.

2. Read the information about the demonstration.
3. Click key generation page.
4. Change the first prime number (P) to 7.
5. Change the second prime number (Q) to 5.
6. Click Proceed.
7. Read the information in the popup screen and record the necessary numbers. Close the screen
when finished.
8. Click Encryption Page.
9. Next to Enter Alice’s exponent key, E: enter 5 as the key value from the previous screen.
10. Next to Enter Alice’s N Value: enter 35.
11. Click Encrypt. Read the message and record the values. Close the screen when finished.
12. Click Decryption Page.
13. Next to Enter the encrypted message enter 1.
14. Next to Enter your N value: enter 35.
15. Next to Enter your private key, D: enter 5.
16. Click Proceed. Note that 1 has been decrypted to A.
17. Close all windows.

Exercise
Now you can try it with your friends. Each of you generates a public key and private key. Then, you
can send the public key to your friends in the group and keep the private key secret. Each one can
try to send a secrete message to a friend. Can he/she decrypt the massage? Can you read the
message without knowing the private key?

Part 2: Blockchain tutorial

Objectives
Summarize the basics of cryptographic concepts.

Activity
Estimated completion time: 30 minutes
Description
Understanding how blockchain functions can best be accomplished by performing a
hands-on tutorial. In this project, you will use an online tutorial to learn about
blockchain.

1. Use your web browser to go to https://andersbrownworth.com/blockchain/

2. Watch the video Blockchain 101 – a Visual demo and Blockchain 101 – Part 2
Public/Private Key signing.

3. When the videos have completed click Hash.

4. In the Data: box, enter This is data set 1 and note how the hash changes as you enter
each letter.

5. Now change the 1 to 2. What happens to the hash?

6. Click Block.

7. What new fields have been added?

8. Click Blockchain. scroll to the right to see all the blocks in the chain. look at the Prev: for
Block #5. compare that with the hash: of Block #4. are they identical? Why?

9. Compare the Prev: and hash: of each block with the former block.

10. Return to Block #5. enter This is data set 5. What happens to the color of the block?
Why is this block now invalid?

11. go to Block #4. enter This is data set 4. What happens to the color of Blocks #4 and #5?
Why?

12. return to Block #5. click Mine to correct the information in the block.

13. return to Block #3. enter This is data set 3. What happens to Blocks #3, #4, and #5?
Why? how does this illustrate that the blockchain resists change?

14. In Block #3 click Mine. What happens to the color of this block?

15. go to Block #4 and click Mine.

16. go to Block #5 and click Mine.

17. If you were to make a change to Block #5, on which block must you click Mine to correct
it? If you were to make a change to Block #3, on which blocks must you click Mine? Why
the difference?
 18. Close all windows.

Part 3: SSL server and client tests

Objectives
Explain the importance of security concepts in an enterprise environment.

Activity
Estimated completion time: 30 minutes

Description
In this project, you will use online tests to determine the security of web servers and your local
web browser.

1. Go to https://www.ssllabs.com/.
2. Click Test your server >>.
3. Click the first website listed under recent best.
4. Note the grade given for this site. Under Summary, note the Overall rating along with
the scores for Certificate, Protocol Support, Key exchange, and Cipher Strength, which
make up the cipher suite.
5. If this site did not receive an Overall Rating of A under Summary, you will see the
reasons listed. Read through these. Would you agree? Why?
6. Scroll through the document and read through the Certificate #1 information. Note the
information supplied regarding the digital certificates. Under Certification Paths, click
Click here to expand, if necessary, to view the certificate chaining. What can you tell
about it?
7. Scroll down to Configuration. Note the list of protocols supported and not supported. If
this site were to increase its security, which protocols should it no longer support? Why?
8. Under Cipher Suites, interpret the suites listed. Notice that they are given in server-
preferred order. To increase its security, which cipher suite should be listed first? Why?
9. Under handshake simulation, select the web browser and operating system that you
are using or that are similar to what you are using. Read through the capabilities of this
client interacting with this web server. Note particularly the order of preference of the
cipher suites. Click the browser’s back button when finished.
10. Scroll to the top of the page, and then click Scan Another >>.
11. Select one of the recent worst sites. Review the Summary, Authentication,
Configuration, Cipher Suites, and handshake simulation. Would you agree with this
site’s score?
12. If necessary, return to the SSL report page, and then click Scan Another >>.
13. Enter the name of your school or work URL and generate a report. For example, you can
generate a report for vnu.edu.vn or is.vnu.edu.vn. What score did it receive?
 14. Review the Summary, Authentication, Configuration, Cipher Suites, and handshake
simulation. Would you agree with this site’s score?
15. Make a list of the top five vulnerabilities that you believe should be addressed in order
of priority. If possible, share this list with any IT personnel who may be able to take
action.
16. Click Projects.
17. Now test the capabilities of your web browser. Click SSL Client Test. Review the
capabilities of your web browser. Print or take a screen capture of this page.
18. Close this web browser.
19. Open a different web browser on this computer or on another computer.
20. Return to www.ssllabs.com, click Projects, and then click SSL Client Test to compare the
two scores. From a security perspective, which browser is better? Why?
21. Close all windows.

Part 4 Viewing digital certificates

Objectives
Given a scenario, implement public key infrastructure.

Activity
Estimated completion time: 30 minutes

Description
In this project, you will view digital certificate information using the Google Chrome
web browser.
1. Use the Google Chrome web browser to go to www.google.com.
2. Note the padlock in the address bar. Although you did not
enter https://, Google created a secure HTTPS connection.
Why would it do that?
3. Click the three vertical buttons at the far edge of the address bar.
4. Click More tools.
5. Click developer tools.
6. Click the Security tab, if necessary. (If the tab does not appear, click the >> button
to display more tabs.)
7. Read the information under Security Overview.
8. Click View certificate.
9. Note the general information displayed on the General tab.
10. Now click the details tab. The fields are displayed for this X.509 digital certificate.
11. Click Valid to to view the expiration date of this certificate.
12. Click Public key to view the public key associated with this
 digital certificate. Why is this site not concerned with
distributing this key? How does embedding the public key in a
digital certificate protect it from impersonators?
13. Click the Certification Path tab. Because web certificates are based
on the distributed trust model, there is a path to the root
certificate. Click the root certificate, and then click the View
Certificate button. Click the details tab, and then click Valid to.
Why is the expiration date of this root certificate longer than that
of the website certificate? Click Ok and then click Ok again to close
the Certificate window.
14. Click Copy to File.
15. Click Next.
16. Note the different file formats that are available. What do you know about each
of these formats?
17. Click Cancel to close this window.
18. Close all windows.

Part 5: Sending a secure email

Objectives
Securing the email communications

Activity
Estimated completion time: 40 minutes

Description
In this lab, you will apply data encryption and digital certificate concepts to secure a real-world
problem, how to send an email securely and we can verify the authenticity of the senders.

You will need to use PGP (Pretty Good Privacy) to encrypt and sign an email which contains
your report. After that, you must send it to my email address ([email protected]).

My pubic key ID: E4D9F579DBD90D3FEF59F52F9A5F7B5B51B7E3D5

You can download my Public Key by looking it up in https://keyserver.ubuntu.com

Your tasks:

1. Generate a key pair (public key and private key) and upload your public key to
keyserver.ubuntu.com
 2. Send a test email with your friends in your group and ask your friends to verify and
decrypt it. Ensure that your email will be decrypted correctly.

3. Each group sends an encrypted email to my email ([email protected]). Ensure that it

can be decrypted.

Tools that you can use:

• Email clients that support PGP (you can find some email clients on the Internet such as
thunderbird, claws-mail)

• gpg4win: encrypt emails and file separately then attach these contents into an email.
Download link: https://www.gpg4win.org/

• You can use your own tools

Reports:

• Create a report that explain the steps you have done and how it works.