7. (10 pts.) Suppose a stream cipher uses the CRC checksum algorithm CRC-32Q algorithm (http://crccalc.com/) that uses an initial value of zero and without post-processing for encrypting the data as follows:

Before communication the sender and receiver first agreed to a pair of keys K1, K2, where K1s length equals to the plaintexts length and K2 is 4 bytes (K2 is used to protects the CRC checksum). The stream cipher (similar to WEP) takes a plaintext A, calculates CRC(A), the plaintext As CRC value, then encrypts them using keys K1, K2, respectively, through the XOR operation, as AK1, CRC(A) K2, before transmitting them through a wireless channel. When the transmitted ciphertext is received, the receiver will use the same key pair to decipher, recover the original text, and verify the received texts integrity, through the same XOR operations as follows:

(A K1) K1 = A, and (CRC(A) K2) K2 = CRC(A).

Answer each of the below questions:

(a) Suppose an attacker knew the plaintext is of 2 bytes (i.e., 16 bits, bits numbered 0 to 15 from left to right), and the attacker wants to change/flip bits 6, 7, 14, and 15 (according to the above bit numbering) of the data, but the attacker does not know the key values. Describe precisely (with all details) how and what the attackers could do to modify the captured ciphertext and resend to the receiver, so that the receiver could not detect the data has been altered.

(b) Suppose the attacker knew the plaintext (which is a 2-byte text AB) and captured the ciphertext when the sender sent, in hexadecimal values, 0x4040 and 0x52BDD48B. Describe

precisely (with all details) how and what the attackers could do to figure out the key values of K1, K2 used in the stream cipher.