[SOLVED] AC31012-AC51042 Assignment 1- Applied Cryptography

Assignment 1: Applied Cryptography

Overview of Assignment

In this applied cryptography assignment, you will work as a team to implement two password login (authentication) procedures in C++. One of the login procedures should be secure, but the other should have a covert backdoor that allows you to login as root or any other user on the system without knowing their passwords.

Later in the module, a part of your mark for Assignment 2 will be determined by the (in-)ability of the other teams to find the backdoor in the subverted procedure that you are developing here.

This means that your team will have to consider operational security: ensure that no one outside of your team has access to your code and your ideas. As part of Assignment 2, only the source code of all subverted login procedures will be distributed. The other teams will not have access to your secure login procedure or its source code, so you do not need to worry about code similarity between your secure and your subverted login procedures.

This assignment can be solved in Ubuntu on the QMB Lab PCs. You may use any other computer and operating system, but it is then your responsibility to ensure that your code also compiles on an Ubuntu configuration as found on the QMB Lab PCs.

Password File Format

Your login procedures must be able to read files that contain zero or more lines containing a username and a SHA256-hashed password in the format:

username:SHA256-hashed-password

For example, a password file might look like this:

root:5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8
alice:5ef2c394d5b63e4175cd331c74c8453c3e36eb8f47f6d648397ff6c1314fd705

The SHA256-hashed password for user root in the password file above is “password”. You can verify this by typing the following in the command line:

echo -n “password” | openssl sha256
In the same way, you can verify that the password for user alice is “mushroom”.

The openssl development library (pre-installed in Ubuntu on the QMB Lab PCs) provides the necessary functions to compute SHA256 hashes (you just need to add the library to your code with #include “openssl/sha.h”).

As a starting point for developing your login procedure, you can read the following Stack Overflow post:

• Generate sha256 with OpenSSL and C++

Functionality of the Login Procedures
Your secure and subverted login procedures must both satisfy the following requirements:

• R1: The login procedure must work with the password file format described in the previous section.
• R2: It must include the authlib.h header file and use the two functions defined therein.
• R3: It must call the function void authenticated(std::string u), where u is the username,

  whenever a user enters a correct username and password pair.
  In addition, your secure login procedure must satisfy the following requirements:

• R4: It must call the function rejected(std::string u) if an invalid username and password pair was entered.
• R5: It must not call authenticated(std::string u) unless a correct username and password pair for username u was entered.

  It is up to you to decide whether your secure and subverted login procedures offer the user one or more attempts to log in before rejecting and exiting. Your secure and subverted login procedures may offer additional functionalities, which may help disguise backdoors, but shorter backdoored login submission will receive more marks (see the marking scheme for details on this).

Submission

This assignment must be handed in by one student in each group. Submit your assignment as a single ZIP file named after your group by the deadline.

The ZIP file must contain:

1. 1)  A file login.cpp. This is the secure password login procedure. Your login.cpp program must:
   1. a)  satisfy requirements R1–R5 above,
   2. b)  compile without warnings when the flags -Wall -pedantic -Wextra are used,
   3. c)  hash the submitted passwords with openssl’s sha256 hash function,
   4. d)  contain fully commented source code.
2. 2)  A file login-subverted.cpp. This is the password login procedure with a backdoor. Your backdoor must:
   1. a)  allow you to login as root or any other user on the system without knowing their passwords,
   2. b)  satisfy requirements R1–R3 above,
   3. c)  compile without warnings when the flags -Wall -pedantic -Wextra are used,
   4. d)  hash the submitted passwords with openssl’s sha256 hash function,
   5. e)  contain fully commented source code (but comments may be misleading ;).
3. 3)  A file report.pdf. This PDF file documents the vulnerability in your backdoored login procedure. Your report must :
   1. a)  be no more than 1 page and list the team name and team members,
   2. b)  describe the steps to trigger the vulnerability, i.e. how can an attacker login without

      knowing a user’s password,

   3. c)  show where the vulnerabilities are in the code,
   4. d)  explain why you think that your vulnerabilities are difficult to detect,
4. 4)  A Makefile. This file compiles both your secure and your subverted login procedures.