Tribhuwan University

Institute of Science and Technology

Model

Bachelor Level / Third Year / Fifth Semester / Science

Bachelors in Information Technology (BIT303)

(Information Security)

Full Marks: 60

Pass Marks: 24

Time: 3 Hours

Candidates are required to give their answers in their own words as for as practicable.

The figures in the margin indicate full marks.

Section A

Long Answers Questions

Attempt any TWO questions.
[2*10=20]
1.
How encryption decryption is done in RSA? In RSA system, consider the public key of a given user is (3, 55). What is the private key d? What is the cipher text C, if message M= hi?[10]
2.
Consider a system having users U1, U2, U3 & files F1, F2 and F3 as F4. User U1 can read and write files F2 and F3. User U2 can read all the files but can perform write operation on F2. The user U3 can perform read operation on F3 and append on file F4. Now prepare access control matrix, access control list and capability list.[10]
3.
What are properties of hash function? In a hash function SHA-1, how padded message is computed before hash function computation? Using elongated message blocks from $w_0$ to $w_{79}$ how can you compute the final hash value? For the 160 bit hash value represented by 5 words A, B, C, D, E, write the expressions for $A_{79}$, $B_{79}$, $C_{79}$ after the last pass of the algorithm?[10]
Section B

Short Answers Questions

Attempt any Eight questions.
[8*5=40]
4.
What is attack tree? Construct an attack tree for internet banking authentication. [5]
5.
Write an algorithm for Extended Euclidean Algorithm. Illustrate the algorithm for a=84 and b=320. [5]
6.
What is digital signature? How it can be used for message authentication? [5]
7.
Define authentication system with its components. How challenge-response system can be used as an authentication system? [5]
8.
Discuss about different trust frameworks. [5]
9.
Define zombies, bots and rootkits. [5]
10.
How copyright is different from patent? [5]
11.
Describe security auditing architecture. [5]
12.
What is risk? How security risk analysis is done? [5]