Midterm2

Question 1

How many shared keys are derived between a client and a server that establish a TLS session?

Answer 1

Each side generates 4-6 keys

Question 2

In TLS, how does the server prove ownership of its private key?

Answer 2

Implicitly by decrypting the pre-master secret and finishing handshake

Question 3

In TLS, how does the client prove ownership of its private key when client authentication is (rarely) used?

Answer 3

Send digital signature to the server

Question 4

In TLS, who creates the pre-master secret?

Answer 4

Client

Question 5

In TLS, how is the pre-master secret securely transmitted?

Answer 5

It is encrypted with the server’s public key.

Question 6

In TLS, when do the client and server start encrypting traffic using symmetric encryption?

Answer 6

Finished message

Question 7

Buffer Overflow defenses

Answer 7

Write correct code (avoid vulnerable functions)
Make stack non-executable
Array bounds checking (type-safe language)
Code pointer integrity checking (detect when a pointer is corrupted; Canaries and pointer checking)