Prof. Wang sent out an encrypted message to ECE 443/518 students. Unfortunately he forgot the password as well as the original message. Prof. Wang still remembers how he obtained the encrypted message: first, a 256-bit key is generated as the SHA256 sum of a 4-digit password; then, AES-GCM is used to encrypt and authenticate the message with the nonce including all 0 bytes and the additional data being his email address.

For your convenience, Prof. Wang has put what he remembers in a Go program here. Now it is your turn to find the password and the original message using knowledge of cryptographic hash functions and ciphers.

Before you actually write code to find the password, you will first need to understand how to compute SHA256 hash and encrypt/decrypt with AES-GCM properly in Go. You will need to read the two functions validateSHA256() and validateAESGCM() and to observe their outputs in order to understand how they work. Answer the following questions in your project report:

1. From the output of validateSHA256(), decide the length of the hash generated by SHA256. Is it as expected?
2. What is the size of the key space used in this AES-GCM setup?
3. What is the length of the nonce used for AES-GCM? What is the maximum message length implied by this nonce length?
4. What is the length of the plaintext in validateAESGCM()?
5. What is the length of the byte slice returned by the Seal function? How is this length related to the length of the plaintext? Why is it named ciphermac?

Now you are ready to modify the function findPassword() to find the correct password and then the original message. I have provided a loop to generate all possible 4-digit password and you will need to add code to locate the correct one via brute-force attack. Answer the following questions in your project report:

1. How many possible passwords are there? How does this size compare to the key space size for the AES-GCM setup (you have answered in Section II)?
2. Show the lines of code you have added and explain your approach to perform the brute-force attack.
3. What is the password used by Prof. Wang and what is the original message?
4. How much time does it need to find the password?
5. If Prof. Wang uses an 8-digit password, how much time will you expect to spend to find the password? Why?

Prof. Wang's story in previous sections reveals the danger of using a weak password consisting of just 4 digits. Let's consider theoretical and practical limits to understand how we can make use of stronger passwords. First of all, answer the following questions:

1. To make full use of the 256-bit AES key, how many digits should Prof. Wang use in the password?
2. Prof. Wang chooses to use lower case letters as well as digits in the password. What is the length of the password to match the 256-bit AES key?
3. Name one practical issue to use the passwords that match the 256-bit AES key.

On the other hand, since attackers will be bounded by the available computational power, we may consider the time that an attacker takes to evaluate a password in order to estimate how long the password should be. Please do your own research to find how to measure time precisely in Go, and design experiments to answer the answer the following questions:

4. What is the time to evaluate one 32-byte password on your computer? You should include time to compute its SHA256 hash and to decrypt a 1024-byte message with AES-GCM using 256-bit AES key and no additional data. Show yoru code and include screenshots for the measurements.
5. Assume lower- and upper-case letters and digits can be used in the password. Consider attackers that have accesses to 1000, 1000000, and 1000000000 computers with similar computational power as yours. To make sure they cannot find your password within a year using brute-force, what are the lengths of the password?

Complete the tasks for Section II to IV (5 points each), include them in a project report in .doc/.docs or .pdf format, and submit it to Canvas before the deadline for a total of 15 points.

The project should be done individually. You can discuss the project with other students but all the source code and writings should be your OWN. PLAGIARISM will be called for DISCIPLINARY ACTION. NEVER share your source code and reports with others.