generated from mwc/lab_subrosa
56 lines
2.1 KiB
Markdown
56 lines
2.1 KiB
Markdown
# Sub Rosa Analysis
|
|
|
|
## Checkpoint 1
|
|
|
|
Decrypt the message you received from the Sub Rosa administrator.
|
|
Include the code you used to decrypt it. What does the message say?
|
|
|
|
I attempted to retrieve and decrypt the message from the Sub Rosa administrator using my generated private key. However, the Sub Rosa server did not respond to requests and returned a connection timeout error, so I was unable to obtain the encrypted message.
|
|
|
|
The code I would use to decrypt the message is shown below:
|
|
|
|
```python
|
|
from encryption import PrivateKey
|
|
|
|
private = PrivateKey.load("subrosa_private_key.pem")
|
|
|
|
ciphertext = "<ciphertext from server>"
|
|
|
|
print(private.decrypt(ciphertext))
|
|
```
|
|
|
|
If the server had returned the message successfully, this code would decrypt the ciphertext using my private key and display the original plaintext message.
|
|
|
|
|
|
## Checkpoint 2
|
|
|
|
Once you have a fully-working client and server for encrypted chat, let's
|
|
analyze potential vulnerabilities of the system. Answer the following
|
|
questions:
|
|
|
|
1. When you interact with the server at `https://subrosa.makingwithcode.org`,
|
|
you have no way of knowing what code is running. If the people running
|
|
the server are dishonest, is it possible for them to read your encrypted
|
|
messages? If so, explain how. If not, explain why not.
|
|
|
|
|
|
2. Is it possible to impersonate another user, sending messages in their name?
|
|
If so, explain how--or demonstrate this with code. If not, explain why not.
|
|
|
|
|
|
3. You can use a signature (a message and its encrypted version) to prove you
|
|
have a private key, without sharing the key itself. After you send someone
|
|
a signature, what stops them from using the same signature to later
|
|
impersonate you?
|
|
|
|
|
|
4. On most websites, you can reset your password if you forget it, via a link
|
|
sent to your email or a code sent to your phone. If you lose your private
|
|
key, would it be possible to recover your messages?
|
|
|
|
|
|
5. Even if you can't read other peoples' messages, you can see the sender and the
|
|
recipient for each message. Is this a big deal? Could the server be redesigned
|
|
so that the sender and the recipient are also encrypted?
|
|
|