Kerberos... providing strong cryptography

The Internet is an insecure place as we all know. Many of the protocols used in the Internet do not provide any security. Tools to identify passwords off of the network are in common use by malicious hackers. Thus, applications which send an unencrypted password over the network are extremely vulnerable. Some sites attempt to use firewalls to solve their network security problems. Unfortunately, firewalls assume that hackers are on the outside, which is often a very bad assumption. Most of the really damaging incidents of computer crime are carried out by insiders.Kerberos was created by MIT as a solution to these network security problems. The Kerberos protocol uses strong cryptography so that a client can prove its identity to a server (and vice versa) across an insecure network connection. After a client and server has used Kerberos to prove their identity, they can also encrypt all of their communications to assure privacy and data integrity as they go about their business.Lets see how it works.

Auth - Authenticator , SK1 - Session Key , TGT - Ticket

The client asks the authentication server for a ticket to the ticket-granting server(TGS). The authentication server looks up the client in its database, then generates a session key (SK1) for use between the client and the TGS. Kerberos encrypts the SK1 using the client’s secret key. The authentication server also uses the TGS’s secret key (known only to the authentication server and the TGS) to create and send the user a ticket-granting ticket (TGT).

The client decrypts the message and recovers the session key, then uses it to create an authenticator containing the user’s name, IP address and a time stamp. The client sends this authenticator, along with the TGT, to the TGS, requesting access to the target server. The TGS decrypts the TGT, then uses the SK1 inside the TGT to decrypt the authenticator. It verifies information in the authenticator, the ticket, the client’s network address and the time stamp. If everything matches, it lets the request proceed. Then the TGS creates a new session key (SK2) for the client and target server to use, encrypts it using SK1 and sends it to the client. The TGS also sends a new ticket containing the client’s name, network address, a time stamp and an expiration time for the ticket — all encrypted with the target server’s secret key — and the name of the server.

The client decrypts the message and gets the SK2. Finally ready to approach the target server, the client creates a new authenticator encrypted with SK2. The client sends the session ticket (already encrypted with the target server’s secret key) and the encrypted authenticator. Because the authenticator contains plaintext encrypted with SK2, it proves that the client knows the key. The encrypted time stamp prevents an eavesdropper from recording both the ticket and authenticator and replaying them later. The target server decrypts and checks the ticket, authenticator, client address and time stamp. For applications that require two-way authentication, the target server returns a message consisting of the time stamp plus 1, encrypted with SK2. This proves to the client that the server actually knew its own secret key and thus could decrypt the ticket and the authenticator.

The target server knows that the client is who he claims to be, and the two now share an encryption key for secure communications. Because only the client and target server share this key, they can assume that a recent message encrypted in that key originated with the other party.

Combination Generator program in java

This is a problem related to computability and complexity in computer science...Some problems in computer science cannot be resolved completely. Finding a correct solution might be impossible at some circumstances. Have you heard of these problems? Sorting, Partition problem, Halting problem. Here i present a case regarding partition problem.

The program takes numbers at run time and breaks it in to two sets where the sum of the elements in the two sets are equal. It should display the result, or it should say there are no such two sets in the given numbers. The time taken to get the solution against the numbers entered at run time is calculated. I started with 10 numbers and waited for the result. Then increased it to 14,16 and so on.. I hope you got a clear picture of what is happening now. Below is the program written in java. The timer runs in the program itself.

import java.math.BigInteger;
import java.io.*;
import java.awt.event.*;
import java.util.*;
import java.text.*;

public class CombinationGenerator {

private int[] a;
private int n;
private int r;
private BigInteger numLeft;
private BigInteger total;


// Constructor

public CombinationGenerator (int n, int r) {

if (r > n) {
throw new IllegalArgumentException ();
}
if (n < 1) {
throw new IllegalArgumentException ();
}
this.n = n;
this.r = r;
a = new int[r];
BigInteger nFact = getFactorial (n);
BigInteger rFact = getFactorial (r);
BigInteger nminusrFact = getFactorial (n - r);
total = nFact.divide (rFact.multiply (nminusrFact));
reset ();
}

// Reset

public void reset () {
for (int i = 0; i < a.length; i++) {
a[i] = i;
}
numLeft = new BigInteger (total.toString ());
}

// Return number of combinations not yet generated

public BigInteger getNumLeft () {
return numLeft;
}

// Are there more combinations?

public boolean hasMore () {
return numLeft.compareTo (BigInteger.ZERO) == 1;
}

// Return total number of combinations

public BigInteger getTotal () {
return total;
}
// Compute factorial

private static BigInteger getFactorial (int n) {
BigInteger fact = BigInteger.ONE;
for (int i = n; i > 1; i--) {
fact = fact.multiply (new BigInteger (Integer.toString (i)));
}
return fact;
}

// Generate next combination (algorithm from Rosen p. 286)

public int[] getNext () {

if (numLeft.equals (total)) {
numLeft = numLeft.subtract (BigInteger.ONE);
return a;
}

int i = r - 1;
while (a[i] == n - r + i) {
i--;
}
a[i] = a[i] + 1;
for (int j = i + 1; j < r; j++) {
a[j] = a[i] + j - i;
}

numLeft = numLeft.subtract (BigInteger.ONE);
return a;

}

public static void main(String d[]) throws IOException{

long startTime; // Starting time of program, in milliseconds.
long endTime; // Time when computations are done, in milliseconds.
double time; // Time difference, in seconds.


//get the number of numbers in set
InputStreamReader reader = new InputStreamReader (System.in);
BufferedReader input = new BufferedReader(reader);
System.out.print("Enter the numer of numbers in you set=");
String p = input.readLine();
int q =Integer.parseInt(p);
//put the elements to an array

int sum_of_array=0;
int[] indices;
int elements[]=new int[q];
int half_of_set=0;
int sum_of_elm=0;

for(int r=0; r<q; r++){

System.out.print("Enter the numbers of your set=");
String c = input.readLine();
int e =Integer.parseInt(c);
elements[r]= e;
}
//get the sum of array
for(int x=0; x<elements.length; x++){
sum_of_array=sum_of_array+elements[x];
}
int reminder=sum_of_array % 2;
half_of_set=sum_of_array/2;

//
if(reminder==0){
startTime = System.currentTimeMillis();
for(int len_of_array=1;len_of_array<=elements.length;len_of_array++ ){

CombinationGenerator x = new CombinationGenerator (elements.length, len_of_array);
StringBuffer combination;
while (x.hasMore ()) {

combination = new StringBuffer ();
indices = x.getNext ();
for (int i = 0; i < indices.length; i++) {

sum_of_elm=sum_of_elm+elements[indices[i]];

}

if(half_of_set==sum_of_elm){


//print the sub set element

for(int g=0; g<indices.length; g++){
System.out.println("numbers in your one sub set are ="+elements[indices[g]]+",");

}
endTime = System.currentTimeMillis();
time = (endTime - startTime) / 1000.0;
System.out.println(time);

return;
}

sum_of_elm=0;//set the sum of elm to 0
}
}
endTime = System.currentTimeMillis();
time = (endTime - startTime) / 1000.0;
System.out.println(time);

}else{
System.out.println("given number set can not divide to two equal sets:Sorry");

}
}

}

The maximum number of numbers i could enter was 36..i couldn't go beyond that..the program stopped running....it explains the complexity of the problem. Finally the output was shown in a graph as below..

ISD Models..Systematic Approach vs Evolutionary

Instructional Systems Design, the most widely used methodology for developing new training programs. Today most of the e-learning programs are designed based on ISD. It is also known as Instructional Systems Design & Development (ISDD), the Systems Approach to Training (SAT), or just Instructional Design (ID). There are many ISD models that are used widely, like ADDIE, ASSURE, Dick & Carey Model etc. These are based on a systematic approach to online training.

But what do you think is the most effective approach? Systematic approach or the Evolutionary one? Some of the benefits of a system approach are characteristic of all systematic approaches. The ISD model is a management tool that makes courseware production more efficient. Effective training programs are more likely because the ISD model increases the probability that the courseware will match the objectives and not veer off in a different direction. Approach is scientific as it is empirical and can be replicated. The courseware can be improved and strengthened through data collection and analysis.



The figure shows the ADDIE model used widely for the systematic ISD approach..
Even though it has so many advantages they say it’s too systematic. A frequent criticism is that it is too time-consuming to be practical in the real world. There are practical challenges with a purely systemic design approach in the management of resources. In most cases, training programs must be developed under a fixed -- and often limited -- budget and schedule. While it is very easy to allocate people and time to each step in the ISD model, it is harder to plan deliverables when there are no distinct steps in the process.

Introducing Evolutionary & Rapid Prototyping Approach

An evolutionary approach includes both deterministic and incremental systems, in contrast to the systems approach, which is entirely deterministic. This approach is particularly appropriate for situations where there is limited past experience from which to draw guidance. A major benefit is that it enables a designer to test new ideas without making a long term commitment. A major disadvantage is that it lacks a defined set of steps. Also, it is difficult to specify in advance the amount of time and money that will be needed to complete significant events and it is logically impossible to specify the outcome of an evolutionary process.

Rapid Prototyping Design (RPD) uses a more formative model that is based on usability testing of prototypes. Results of usability tests on the prototypes are used to modify and improve the product. This model shares many attributes in common with the ISD model, and stresses the importance of iterative analysis and evaluation.

The conclusion is, if you know exactly what you are doing and exactly what needs to be built, then you are using the ISD (static or waterfall) method (however, this rarely happens in the real training world). When the subject is new, controversial, etc., then more prototypes are going to be built, hence you are more into RPD.

Write exceptions into error log(C#.net)

Try this console application code to write exceptions in to a log file.

using System;
using System.Collections.Generic;
using System.Text;
using System.IO;

namespace ConsoleApplication1
{
class errorlogs
{

String filepath = "C:/Documents and Settings/error/log.txt"; //path of errorlog file

static void Main(string[] args)
{
errorlogs er = new errorlogs();
object i = new IOException();
er.writelog(i); //passing the ioexception
}

public void writelog(object a){

try{
StreamWriter logWriter;
if(File.Exists(filepath)){
logWriter = File.AppendText(filepath);
}
else{
logWriter = File.CreateText(filepath);

}
logWriter.WriteLine();
logWriter.WriteLine("------"+ DateTime.Now +"--------");
logWriter.WriteLine();
logWriter.WriteLine(a);
logWriter.WriteLine();
logWriter.WriteLine("--------------------------------");
logWriter.Close();

}
catch(Exception e){
Console.Out.WriteLine("Error in writing errorlog:" +e.Message);
}
}

}
}

Sendmail

Sendmail is a mail transfer agent (MTA) that is a well-known project of the open source, free software and Unix communities, which is distributed both as free software and proprietary software. Its also called the mail server daemon. Other mail server daemons include qmail, postfix, exim, mmdf, smail etc. server daemons looks after the receiving incoming mail and delivers outgoing mail.

Sendmail configuration files
All sendmail related configuration files have to be put in /etc/mail directory.

1)/etc/mail/access
It specifies what hosts or IP addresses have access to the local mail server and what kind of access(OK, REJECT,RELAY) they have.
OK - allowed to send mail to the host as long as mail's final destination is the local machine.
REJECT - reject for all mail connections
RELAY - allowed to send mail for any destination through this server.
e.g.
cyberterror.com     550 we dont expect mail from you
a.source.of.spam     REJECT
cyberspammer.com     OK
128.32          RELAY

2)etc/mail/aliases
This database contains a list of virtual mailboxes that are expanded to other user(s), files, programs or other aliases.
e.g
root: ajantha
webmaster:kamal,lal
customers: :include: /etc/mail/lists/customer-list

The last alias causes how to keep a list of users for an aliases in an external file.

3)/etc/mail/local-host-names
Consist list of host names that sendmail is to accept as the local mail host. if the mail server was to accept mail for the domains cmb.ac.lk and ucsc.cmb.ac.lk the above file will contain:
cmb.ac.lk
ucsc.cmb.ac.lk

4)/etc/mail/sendmail.cf
It controls the overall behavior of sendmail. The master sendmail configuration file can be built from m4 macros.

5)/etc/mail/virtusertable
This maps email addressse for virtual domains and mailboxes to real mail boxes. The mail boxes can be local, remote, aliases defined.
e.g
info@msc.cmb.ac.lk ajantha
info@bit.cmb.ac.lk saman