Homework #1
Introduction

Goal:

• Introduce yourself to the class, share your research interest.
• Learn how to request personal email certificates and set up secure email communication.

Assignment Date:8/23/2010

Due Date: Part 1: 9/1/2010; Parts 2&3: 9/6/2010

Description:

Part 1:

• Upload to warlus.uccs.edu your recent photo with face big enough for easy recognition, and save in JPEG/GIF/PNG as <your ufp login>.jpg in ~<login>/public_html/cs591/images directory on walrus.uccs.edu. I have created account for you on walrus.uccs.edu. Your login is the same as that of ufp. Note that they are not using the same file system of CS Unix machines or campus Unix systems. Change files on walrus will not show up on CS Unix machines. Walrus is behind firewall therefore use uccs resource vpn to access network services on walrus server. See http://www.uccs.edu/~helpdesk/vpn.htm for setting up the uccs resource vpn at home.
• Modify the web page, <your ufp login>.html, in cs591 directory with your name, img src pointing to
  your recent photo, revise short vita, at least email address, include your interests in CS591.
• See examples in http://cs.uccs.edu/~cs591/CS591S2007Photo.html
• Note that I have created account for you on walrus.uccs.edu with "#a" followed by your SID (no dash) as password.
• Check the file access right. Verify that http://walrus.uccs.edu/~<your ufp login>/cs591/<your ufp login> can be used retrieve the web page from a web browser.
• Email me the url when you are done.

Part 2. Secure Email Using Personal E-mail certificate

• In this exercise, we will practice generate certificate request on walrus (a Fedore Core Linux server), send in the certificate request for me to sign it with a csnet CA on walrus,
• Submit certificate request.

  Please submit youir certificate request to me by 9/1 Tuesday night,  I will return the signed certificate by Wednesday 9/2 night and give you chance to set it up the personal cerifiicate by next Friday and be able to sign and encrypt email. Please use your ufp account as Common Name and uccs email address for Email. Replace csnetReq.pem with <yourlogin>Req.pem and csnetKey.pem with <yourlogin>Key.pem

  Login to walrus
  cd public_html
  /etc/pki/tls/misc/CA –newreq
  cp newreq.pem csnetReq.pem
  mail -s "sign request" chow@eas.uccs.edu < csnetReq.pem
  cp newkey.pem csnetKey.pem

• Edward sign certficate.
  
  After receiving your certificate request, I will sign it on athena, leave a copy in http://walrus.uccs.edu/~cs591/cert, and return the signed certificate in an email.
• Generate .p12 file on walrus
  
  Assume your login name is csnet, here are the steps to create the .p12 file with your client certificate and private key for sending secure email and accessing secure web page on walrus.uccs.edu:
  • After receiving my email with csnetCert.pem as attachment, run the following command:
    openssl pkcs12 -export -in csnetCert.pem -inkey csnetKey.pem -out csnetClient.p12
• Steps for Importing personal and CA certificates to the firefox browser.
• Download from http://walrus.uccs.edu/~cs591/cert/ the csnetClient.p12  to the PC for accessing the midterm web page
• Import csnetClient.p12 file as your client certificate to firefox
  • Start firefox
  • Select Tools | Options
  • Select Advanced  | Encryption tab  then hit the “View Certificate” button
  • Select Your Certificates  tab then hit “Import” button
  • Select the csnetClient.p12 file  to import the certificate
  • 
• Import cacert.pem file as a trusted CA for email and web site identification purposes.
  • repeat the above steps but choose "Authorities tab"
  • 
• Setting up thunberbird mail client. Enter the name and email address. The thunderbird will contact the mail server identify the proper port to use. It will take a few minutes. After it identifies the incoming and outgoing mail server, you click "create account".
• 
• Sett up thunderbird certificates (Personal and CA certificates)
• 
• Setting sign/encrypt option
• 
• When choose the digitally sign, it will ask to select personal certificate.
• 
• 
• Here are the steps for import personal certificate and CA certifcate to IE browser.
  • Download http://walrus.uccs.edu/~cs591/cert/ the csnetClient.p12  to the PC you would like to use to to send secure email and access the midterm web page
  • Import csnetClient.p12 file as your client certificate to IE certificate store,
    if you use outlook (mail client) and IE(web browser) or Chrome
    • Start IE
    • Select Tools | Internet Options
    • Select Content tab  then hit the “Certificates” button
      
    • Select Personal Certificates  tab then hit “Import” button
    • 
    • Select the csnetClient.p12 file  to import the certificate
    • In Certificate Import Wizard,
      • when asked for file, choose "personal informattion exchange" as file type so that you can see .p12 file type.
      • 
      • enter password (which the same export password you enter when generate .p12 file).
      • Certificate store, click "Place all certificates in the following store" choice; click browser, and choose "Personnel".
      • 
  • Download the cacert.pem from http://walrus.uccs.edu/~cs591/cert/cacert.pem and repeat the above steps but
    • choose "Trusted Root Certification Authorities"
    • select "All Files" as file type to see the .pem file.
    • choose to "Place all certificates in the following store, and pick default "Trusted Root Certification Authorities" choice.
    • 
    • Send signed/encrypted emails
    • 
• Here are the detailed steps for setting up Outlook 2003 for retrieve uccs.edu mail from mail.uccs.edu using IMAP protocol.
  http://cs.uccs.edu/~cs591/outlookImap.html
  
• After setting up your email program, send me a signed email. I will reply with an encrypted email. You will then reply with an encrypted signed email. The encrypted email will contain a secret msg. Your score for part 2 will be sent with a signed email.

Part 3:

• Question 1. Basic Security Services.
  • a. What are the three basic security services?
  • b. Can the function of one service be replaced the others?
  • c. Give me an example where we need two of the basic secruity services at the same time.
  • d. In part2, we send signed email, then send signed/encrypted email. Which basic service corresponds to signing email? Which one corresponds to encrypting email?
• Question 2. In Software We Trust. For secure email to work, we need to trust software and related data in our computer systems.
  • a. List three software components we trust in secure email operations such as the exercise in part 2. For each of them, Identify the source of the software component and who install it for you. Why you trust them?
  • b. List three types of data in computer systems used for secure mail. For each of them, Identify the source of the data and who install them for you.
• Question 3. Defend with Diversity.
  • a. Will our systems be more secure, if we have more diverse choices for the components?
  • b. If users can choose different instruction set for their virtual machines, we can have a more secure cloud computing environment. Why is that? Give a brief explanation.
• Question 4. When we encrypted email with our own email address in cc section, we got msg similar to the one below? Why is that?
  

Please email me your work by 11:59pm 9/6/2010. It can be in MS Word, HTML, or PDF file format.

Related references:

• Here are the detailed steps for requesting Thawte email certificate and set up outlooks for signing and encrypting emails (last year's exercise).
  http://cs.uccs.edu/~cs591/semail.html