Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
Both will have to be able to pass a number of pieces of information between each
other.
1. The Server is listening for a connection.
2. The Client connects to the Server.
3. The Server generates a random RSA key pair.
4. The Server sends its public key to the Client.
5. The Client receives the Servers public key and stores it in memory.
6. The Client sends events to the server.
Figure 8 shows the communication that takes place between the Client and Server.
When the Server has received an encrypted event from the Client it will decrypt the
message, and then add an additional timestamp, this will then be written to file.
Figure 8: Client-Server prototype
4.5 Encryption and Authentication
There are two main types of encryption, symmetric and asymmetric, as a brief
overview, asymmetric encryption uses two separate keys is more secure than
symmetric, which only uses one key, but it is dramatically slower and is generally
33