information security

Sandra, a high net worth customer, banks on-line at Megagargantuan Bank and Trust (MBT) and has agreed to use 3DES (also known as Triple DES) in communicating with MBT. One day, Sandra received a statement showing a debit of $1,000,000 from her account. On inquiring, she was told that the bank manager, Janet, transferred the money out of Sandra’s account and into an account of her own in an offshore bank. When reached via long distance in the Cayman Islands, Janet produced a message from Sandra, properly encrypted with the agreed upon DES keys, saying: “Thanks for your many years of fine service, Janet. Please transfer $1,000,000 from my account to yours as a token of my esteem and appreciation. Signed, Sandra.”

Sandra filed suit against Janet, MBT and the government of the Cayman Islands, claiming that the message was a forgery, sent by Janet herself and asking for triple damages for pain and suffering. MBT filed a countersuit against Sandra, claiming that all procedures were followed properly and that Sandra is filing a nuisance suit. You are called in as an expert witness on the cryptographic issues of the case.

Explain to the Court:

What can be determined from the facts as presented about whether Sandra intended to make Janet a gift of $1,000,000.

What is a plausible explanation of what may have happened in this case?

Assuming MBT wishes to continue using 3DES as its cryptographic system, explain what MBT and Sandra could have done to protect against this controversy arising.