Security and Cryptography (CSS 322)

Introduction to Security

Lecture Notes

PDF

Readings

Stallings: chapter 1 | Forouzan: chapter 1 | Kaufman: chapter 1

Links

(ISC)2 - security certification
SANS Institute - security training and certification
COMPTIA - computer and security certification and training
Computer Emergency Response Teams (CERT): Thai | US
Certificates and Verification: VeriSign | Thawte | Entrust
Top 20 Security Risks
ARBOR ATLAS security reports
Symantec Internet Security Threat Report

Classical Encryption Techniques

Lecture Notes

PDF

Readings

Stallings: chapter 2 | Forouzan: chapter 3 | Kaufman: chapter 2

Links

Simon Singh - a journalist who authored the Code Book. From the website you can download software from the CDROM that provides many examples and animations of classical (and current) encryption algorithms.
CrypTool - free software for apply many encryption algorithms (classical, symmetric, public key) and analysing (breaking) ciphertexts. Highly recommended that you install this software and try it out. I use it to demonstrate examples in the lectures.
NSA has some historical information, including documents on German cipher machines.
Alph open-source, command-line based encryption software for classical algorithms

Block Ciphers and DES

Lecture Notes

PDF

Readings

Stallings: chapter 3 | Forouzan: chapter 5/6 | Kaufman: chapter 3

Handouts

Simplified DES Example

Links

Advanced Encryption Standard

Lecture Notes

PDF

Readings

Stallings: chapter 5 | Forouzan: chapter 7 | Kaufman: chapter 3

Handouts

Simplified AES Example

Links

AES Standard (PDF)
NIST Computer Security Division
TrueCrypt - open source disk encryption using AES
Rijndael at NIST
Twofish - another block cipher
Serpent - another block cipher
And some other block ciphers

Confidentiality using Symmetric Key Encryption

Lecture Notes

PDF

Readings

Stallings: chapter 7 | Forouzan: chapter 8 | Kaufman: chapter 3

Handouts

Links

NIST Guidelines on Key Management (PDF)

Introduction to Number Theory

Lecture Notes

PDF

Readings

Stallings: chapter 8 | Forouzan: chapter 9 | Kaufman: chapter 7

Handouts

Summary and Examples

Links

Public Key Cryptography

Lecture Notes

PDF

Readings

Stallings: chapter 9 | Forouzan: chapter 10 | Kaufman: chapter 6

Handouts

Examples

Links

RSA Security (the company started by the creators of the RSA algorithm)
Detailed description and example of RSA from David Ireland. The site also has nice coverage of other aspects of security, including a detailed proof of RSA.
Another RSA example using larger numbers
Homepage of Ron Rivest, co-inventor of RSA, RCx, MD5, etc.
Bruce Schneier's website. Details on many protocols, algorithms, products and attacks. Schneier is a well-known security researcher, with popular books on security.

Public Key Management

Lecture Notes

PDF

Readings

Stallings: chapter 10 | Forouzan: chapter 15 | Kaufman: chapter 15

Handouts

None.

Links

Diffie Hellman Example
Diffie Hellman Key Exchange Protocol standardised by the IETF

Authentication and Hash Functions

Lecture Notes

PDF

Readings

Stallings: chapter 11/12 | Forouzan: chapter 11/12 | Kaufman: chapter 5

Handouts

Authentication Examples including Birthday Problem

Links

A very simple Online Hash Generator. Enter some text and it calculates the MD5, SHA-1 and SHA-256 hash value.
Another web-based hash generator
Example of MD5 Hash Collisions of two real documents (Postscript files)

Authentication Applications

Lecture Notes

PDF

Readings

Stallings: chapter 14 | Forouzan: chapter 14 | Kaufman: chapter 9/10

Handouts

Links

Word lists, including English, names, actors and common passwords
John the Ripper Password Cracker is popular open source software for password guessing
Passwords at Openwall - links to many different techniques for password discovery for different applications/operating systems, as well as word lists
IETF Public Key Infrastructure (X.509) Working Group - includes links to standards developed for public key exchange (and certificates) in the Internet.
Thawte and VeriSign are two large Certificate Authorities
Mozilla Firefox Certificates: list of Certificate Authorities included in Firefox, including the policy Mozilla uses in selecting CAs, and the audits that each CA has passed (to ensure they are trustworthy CAs).