Brute Force Attack and Cryptographic Algorithms

Microsoft Office 1997-2003 RC4 protection

With clever programming a modern desktop computer can try roughly 1 million RC4 keys every second. (Indeed, there are services available that will use multiple computers and specialised hardware to speed up brute forcing of keys for specific cryptographic algorithms, such as crack.sh.Question 1.1:Microsoft Office 1997-2003 used 40-bit RC4 to protect documents with a user-supplied password. This was due to the export of cryptographic technology and devices from the United States were severely restricted by U.S. law at the time. What is the maximum amount of time that it would take for a computer that can try 1 million RC4 keys every second to do a brute-force attack on a Microsoft Office documentprotected using a 40-bit shared secret?Question 1.2:Microsoft Office 2007 onwards allows the use of the AES cryptographic algorithm with a 128-bit shared secret to protect access to documents. If AES keys can be tried with the same speed as RC4 keys using the computer described in Question 1.1, what is the maximum amount of time that it would take for a brute-force attack on a single document?Question 1.3:With advances in quantum computing it may be possible at some point in the future to build a computer that can implement Grover's algorithm than gives a reduction in time from n to the square root of n. For example, AES-128 has a 128-bit key requiring 2128tries. Grover reduces this to 264tries. If you upgrade your computer to quantum computer that can implement Grover's algorithm, is your secret still safe from attack? Justify your answer.(Note: assume that it can check AES keys at the same rate as before).Question 2: Stealing the ExaminationAs part of your preparation for the upcoming examination, you have the goal of stealing a copy of the 158.235 examination. *Note that this is a thought experimentthat is you should nottry it out in real life.When preparing the exam, the files are stored on the IT servers in a private directory only accessible to academic and examination admin staff (e.g., Julian and Hooman). All staff use their Masseyusername and passwords to authenticate themselves and gain access. A physical copy of the examination is also stored in the School office in a locked file cabinet and in the Science Faculty office in a locked room. Neither Juliannor Hoomanhas copies of the examination stored in their offices.If you are permitted to only use publicly available informationwhen building your profile, describe a scenario explaining how you use the social engineering techniques, e.g., phishing, pre-texting, baiting, quid pro quo and tailgating, —as described in the lecture—to achieveyour goal.Notethat you do not need to include filenames or directory name but you should be as specific as possiblein your answer.Question 2.1:Name the human target or target(s) for the scenario Question 2.2:Identify ONLY the information necessary for the attack, the reason why each piece of information is required and the source of the information (provide URLs where appropriate).Question 2.3:What are the steps describing how you will carry out the attack? These should be written such that you could provide these steps plus the previous information to a third party to carry out the attack.Question 2.4:Describe which of the concepts from the course that have been applied in your attack