Fichas
COMP312 T1
Fichas del conjunto (83)
- 1What is Symmetric Encryption?- When both parties have a secret shared key
- Fast - 2What is the negatives about Symmetric Encryption? How can we fix it?If a key is revealed then all information sent is compromised, we would need to have a secure method to distribute keys
- 3What is Asymmetric Encryption?Sender has a Key pair
- Private and Public
- Slower than Symmetric Encryption
- Public key is related to private key but difficult to reverse engineer because of its size - 4What are the two keys WE used in asymmetric encyrption for DNSSEC?KSK: Key Signing Key - Public Key
ZSK: Zone Signing Key - Private Key - 5What are one-way hashes?They generate a fixed length "checksum" over data and are impossible to derive data from the hash
- 6What command do we use do generate keys?dnssec-keygen
- 7Why would we would we use Digital Signitures for signing emails?To prove that the emails sender sent the email as claimed
- 8Why would we use Digital Signatures for DNS responses?To prove that the answer received in DNS is authentic and comes from the authoritative source rather than an intermediary
- 9Why would we use Digital Signatures for BGP route advertisements?- To prove that the network announcing a prefix is allowed to do so (is not hijacking address space)
- To prove that the path taken by the prefix from announcer to receiver is authentic - 10What protocol does DNS use by default?UDP: User Datagram Protocol
- 11What are A records?A records Map names to IPV4 addresses
- 12what are AAAA records?AAAA records map names to IPV6 addresses
- 13what are PTR records?PTR records map IP addresses to names
- 14what are NS records?NS = Name Server
- Who will answer DNS requests for specified domain - 15what are CNAME records?CNAME = Canonical Name
Maps alias to a single true name - 16what are MX records?MX = Mail Exchanger
Host willing to accept mail - 17what are TXT records?TXT - Text Records
Arbitrary Text - 18In a zone file what are the NS and A records that are connected to the domain name of the zone fileNS is the authoritatic
A is the glue - 19What do recursive name servers do?They can iterate on behalf of the client
- 20What is the DNSSEC Chain of Trust?Trust the root zone key and use that key to build up a chain of trust for other keys
- 21What are the 7 DNS Record Types?A, AAAA, PTR, NS, CNAME, MX, TXT
- 22What are the 4 DNSSEC Record Types?RRSIG, DNSKEY, DS, NSEC/NSEC3
- 23What is a RRSIG record?Sign resource record with private key
- 24What is a DNSKEY record?Public key used to verify RRSIG signatures
- 25What is a DS Record?Delegation Signer
Hash of the public key used to sign records, stored in parent zone - 26What is an NSEC/NSEC3 record?Proof of record non-existence
Provide the ability for a DNS server to authoritatively say a record or record type for a name server does not exist and client authenticate than answer - 27DNS ISSUE: Responses may require more space than 512 byte limit originally standardised for DNS over UPD, what can we do as a solution?- Use EDNS0 extension to indicate ability to cope with >512 bytes
- Use TCP (not recommended)
- Large responses from small requests provide means for denial of service attack using amplicafication - 28What are some DNS Issues?Responses may require more space than 512 bytes
- Need secure mechanism to provide parent DNS server DS records
- Key rollovers should occur regularly (automated) - 29How many DNSKeys are there per zone?Two
- 30What are the two DNSKeys used?Key Signing Key (KSK)
Zone Signing Key (ZSK) - 31What is the DNSKEY KSK used for?used to sign ZSK DNSKEYs = public
- 32What is the DNSKEY ZSK used for?used to sign other records in the zone = private
- 33What is the Authenticated Denial of Existence?NSEC and NSEC3 records provide the ability for a DNS server to authoritatively say a record or record type for a name server does not exist, and client authenticate than answer
- 34Why is Authenticated Denial of Existence important?It is important for detecting attacks that attempt to break chain of trust
- 35How do we distinguish between a child zone that has not deployed DNSSEC, from a man in the middle attack?A MITM can remove DS records and corresponding RRSig records. preventing a DNSKey in a child zone becoming trusted
- 36Whose key is used to sign a Resource Record?RRSIG: Sign resource record with private key
- 37What information is stored in a DNSKEY?The public key: KSK
- 38What is a delegation signer (DS) record?It is a hash of the public key (KSK) used to sign records and it is stored in the parent zone
- 39In the DNS hierarchy, where is a DS record stored?In the parent zone
- 40Explain how a resolver can establish a chain of trust that proves a DNS response came from the authoritative sourcetrust the root zone key (it is signed) and use that key (using hashes) to build up a chain of trust for all other keys
- 41How do we distinguish between a child zone that is unsigned from a MITM attack that removes a DS record?We expect responses to be signed
- 42What is TCP?TCP is a reliable, connection oriented, network friendly, stream-based transport protocol
- 43Why do most Internet Applications use TCP?Because it is stream based anda stream based, reliable transport protocol is useful in many scenarios
- 44In what scenarios is TCP useful?Bulk transfer (file transfer, email)
Interactive data flows(reliability important, delay intolerant) - remote login - 45What internet applications dont use TCP? Why?Voice and Games because reliability in the form of retransmissions is inappropriate
- 46How is a connection defined in TCP?Source IP address
Destination IP Address
Source Port
Destination Port - 47What happens before data can be transmitted in TCP?A connection needs to be established
- 48In TCP, can two connections share the same combined set of address/port values?No, because it would be hard to distinguish them
- 49How is TCP considered reliable?- It has a retransmission timer (RTO) where if acknowledgement is not received in time, packet is retransmitted
- Acknowledge data successfully received
- Checksum over TCP header, and data
- Transparently handles segments received out of order
- Transparently handles segments being duplicated
- Flow control to avoid overwhelming end-host and network - 50How is TCP Stream based?TCP Applications do not deal in packets, they deal in bytes
- 51What is TCP RST?TCP RST is used to indicate that a received packet does not make sense of the current connection
- connection state is not open
- no application listening on port
RST can also be used to abort an ongoing connection
- data in queue is discarded - 52What are two Data Transmission methods in TCP?Stop and wait
- Uses TFTP defined in RFC1305 uses
Sliding Window
- What TCP uses - 53Explain Stop and Wait (TFTP)Whenever a node transmits a frame
- It waits to receive an ack from destination for a predetermined time
Whenever a node receives a frame that passes error checking
- it responds to the source of that frame with an ack
if the predetermined time expires without the source receiving an ack
- it retransmits that frame
Whenever the source receives an ack
- It is free to transmit another frame if it has more data to send - 54Draw an example of a Stop and Wait diagram
- 55Draw an example of a Stop and Wait digram with the predetermined time expiring with DATA and and ACK
- 56What is the time to transfer a frame composed of?- The time to put the packet on the wire (serialisation delay, Ts)
- The time for it to travel (propagation delay, Tp)
- and processing time at nodes - 57What is Stop and Wait: Seriallisation Delay? What do we use to represent it?The time to put the packet on the wire
Represented by [ Ts ] - 58What is Stop and Wait: Propagation Delay? What do we use to represent it?The time for it to travel
Represented by Tp - 59For stop and wait what is the time to transmit each frame?One serialisation delay and two propagation delays (Ts + 2Tp)
- 60In stop and wait, where is the useful work being done?During the serialisation delay
- 61In stop and wait, what does it mean if the propagation delay is large? What is it good for? What is it poor on?The efficiency is poor
Good for LANs, poor on the internet - 62Draw a diagram for Stop and Wait performance
- 63Sliding Window: How is a Window size defined?W frames
- 64Sliding Window: How many frames is the source allowed to transmit without acknowledgement?Up to W frames
(Window Size) - 65Sliding Window: Why do frames contain sequence numbers?A frame contains sequences numbers so they can be identified (distinguished from each other)
- 66Sliding Window: What happens when the destination receives a frame that passes error check?It responds with an acknowledgement
- 67Sliding Window: What can the source do when it receives an acknowledgement for frame number n?It may transmit up to frame n + W
- 68What happens when the transmitter reaches W frames?They have to stop and wait for an acknowledgement
- 69What time does the transmitter have to send an acknowledgement?W . Ts
(Window Size . Serialisation Delay) - 70How do you know acknowledgements have already arrived and the window advanced?When the Window Size . Serialisation Delay is greater than the round trip propagation delay
W.Ts > 2
In this case sliding window throughput can approach 100% - 71What can W.Ts > 2 be restated to?Window size must be greater than the bandwidth delay product
- 72What is W.Ts > 2?When the Window size . Serialisation Delay is greater than the round trip propagation
delay
OR
window size must be greater than the bandwidth delay product - 73An Ethernet connected device has a receive buffer of only 500 bytes. What data rate can it receive from a host that is 10ms away round-trip, in bytes per second?500 bytes / 0.01 = 50,000 bytes/sec
- 74How much buffer memory would be required to receive at 100 kB/s from a host 50ms away round-trip?100 kB/s = 102400 bytes/sec
• Window = 102400 * 0.05 = 5120 bytes - 75How do you calculate WindowSize and ThroughPut?
- 76• You have a Windows 2000 computer at university with a default receive window of 17520 bytes • What is the maximum throughput available to a host 4ms away (say auckland to hamilton) AND • What is the maximum throughput available to a host 4ms away (say auckland to hamilton)• What is the maximum throughput available to a host 4ms away
(say auckland to hamilton)
17520 / 0.004 = 4,380,000 bytes/sec
• What is the maximum throughput available to a host 150ms away
(say west-coast USA to hamilton)
17520 / 0.150 = 116,800 bytes/sec - 77You have a FreeBSD or Linux system at home with a default receive window of 262144 bytes • What is the maximum throughput available from a system that is 240ms away? • How does this compare with Windows 2000 w/ 17520 byte window size?• What is the maximum throughput available from a system that is
240ms away?
262144 / 0.240 = 1,092,266 bytes / sec
• How does this compare with Windows 2000 w/ 17520 byte
window size?
17520 / 0.240 = 73,000 bytes / sec - 78What is TCP Tuning?TCP Tuning is the process of setting buffer sizes appropriate for the expected network connections
- 79In general it is useful to wait a small length of time before sending an acknowledgement back to the sender... What does delaying an acknowledgement do?It allows us to combine an acknowledgement for received data with a window update or a response from the application layer
It has the effect of increasing the RTT on the path - 80Draw a diagram to show delayed acknowledgements
- 81What is the window size?The window size specifies how much data the receiver can cope with sender transmitting
- 82What does the TCP Sliding Window require the window size to be? Why?It requires it to be the bandwidth delay product so that the window size is not limiting TCP performance
- 83What do link state databases describe?They describe routers and their links, networks etc...
Información
- Descripción
- Fichas sobre COMP312 T1, creado por Cherese Eriepa el 06/04/2018.
- Creado por
- Cherese Eriepa · abr 2018
- Actualizado
- 13 abr 2018
- Visitas
- 1
- Valoración