Security and Cryptography (CSS 322)

Introduction to Security

Lecture Notes

PDF | MP3 | Video: part 1

Handouts

Readings

Stallings: chapter 1 | Forouzan: chapter 1 | Kaufman: chapter 1

Links

(ISC)2 - security certification
SANS Institute - security training and certification
COMPTIA - computer and security certification and training
Computer Emergency Response Teams (CERT): Thai | US
Certificates and Verification: VeriSign | Thawte | Entrust
Top 20 Security Risks
ARBOR ATLAS security reports
Symantec Internet Security Threat Report

Classical Encryption Techniques

Lecture Notes

PDF | MP3: Part 1, Part 2, Part 3 | Video: part 1, part 2

Readings

Stallings: chapter 2 | Forouzan: chapter 3 | Kaufman: chapter 2

Links

Steganography example using outguess
Simon Singh - a journalist who authored the Code Book. From the website you can download software from the CDROM that provides many examples and animations of classical (and current) encryption algorithms.
CrypTool - free software for apply many encryption algorithms (classical, symmetric, public key) and analysing (breaking) ciphertexts. Highly recommended that you install this software and try it out. I use it to demonstrate examples in the lectures.
NSA has some historical information, including documents on German cipher machines.
Alph open-source, command-line based encryption software for classical algorithms

Block Ciphers and DES

Lecture Notes

PDF | MP3: Part 1, Part 2, Part 3 | Video: part 1, part 2, part 3

Readings

Stallings: chapter 3 | Forouzan: chapter 5/6 | Kaufman: chapter 3

Handouts

Links

Advanced Encryption Standard

AES is not covered in detail this year; you can find an explanation of AES in the textbook, as well as examples from the links below

Readings

Stallings: chapter 5 | Forouzan: chapter 7 | Kaufman: chapter 3

Handouts

Simplified AES Example

Links

AES Standard (PDF)
NIST Computer Security Division
TrueCrypt - open source disk encryption using AES
Rijndael at NIST
Twofish - another block cipher
Serpent - another block cipher
And some other block ciphers

Modes of Operation

Lecture Notes: PDF| MP3: Part 1, Part 2 | Video: part 1
Readings: Stallings: chapter 6 | Forouzan: - | Kaufman: chapter 4

Psuedorandom Numbers and Stream Ciphers

Lecture Notes

PDF | MP3: No recording

Readings

Stallings: chapter 7 | Forouzan: - | Kaufman: chapter 4

Handouts

Simplified RC4 Example

Links

Number Theory

Lecture Notes

PDF | MP3: Part 1, Part 2 | Video: part 1, part 2

Readings

Stallings: chapter 8 | Forouzan: chapter 9 | Kaufman: chapter 7

Handouts

Definitions
Summary and Examples

Public Key Cryptography

Lecture Notes

PDF | MP3: Part 1, Part 2, Part 3, Part 4 | Video: part 1, part 2, part 3

Readings

Stallings: chapter 9/10 | Forouzan: chapter 10 | Kaufman: chapter 6

Handouts

Examples

Links

RSA Security (the company started by the creators of the RSA algorithm)
Detailed description and example of RSA from David Ireland. The site also has nice coverage of other aspects of security, including a detailed proof of RSA.
Another RSA example using larger numbers
Homepage of Ron Rivest, co-inventor of RSA, RCx, MD5, etc.
Bruce Schneier's website. Details on many protocols, algorithms, products and attacks. Schneier is a well-known security researcher, with popular books on security.

Cryptographic Hash Functions

Lecture Notes

PDF | MP3: Part 1, Part 2, Part 3 | Video: part 1, part 2, part 3

Readings

Stallings: chapter 11 | Forouzan: chapter 11/12 | Kaufman: chapter 5

Handouts

Authentication Examples including Birthday Problem

Links

A very simple Online Hash Generator. Enter some text and it calculates the MD5, SHA-1 and SHA-256 hash value.
Another web-based hash generator
Example of MD5 Hash Collisions of two real documents (Postscript files)

Message Authentication Codes

Lecture Notes: PDF | MP3: Part 1, Part 2 | Video: part 1
Readings: Stallings: chapter 12 | Forouzan: chapter 11/12 | Kaufman: chapter 5

Digital Signatures

Lecture Notes: none (covered in Hash and MAC functions)
Readings: Stallings: chapter 13 | Forouzan: chapter 11/12 | Kaufman: chapter 5/6

Key Management and Distribution

Lecture Notes

PDF | MP3: Part 1, Part 2, Part 3, Part 4 | Video: part 1, part 2, part 3

Readings

Stallings: chapter 14 | Forouzan: chapter 15 | Kaufman: chapter 15

Links

Diffie Hellman Example
Diffie Hellman Key Exchange Protocol standardised by the IETF
NIST Guidelines on Key Management (PDF)
IETF Public Key Infrastructure (X.509) Working Group - includes links to standards developed for public key exchange (and certificates) in the Internet.
Thawte and VeriSign are two large Certificate Authorities
Mozilla Firefox Certificates: list of Certificate Authorities included in Firefox, including the policy Mozilla uses in selecting CAs, and the audits that each CA has passed (to ensure they are trustworthy CAs).

Passwords

Lecture Notes

PDF | MP3: Part 1, Part 2 | Video: part 1, part 2

Readings

Stallings: chapter 15/20 | Forouzan: chapter 14 | Kaufman: chapter 9/10

Links

Word lists, including English, names, actors and common passwords
John the Ripper Password Cracker is popular open source software for password guessing
Passwords at Openwall - links to many different techniques for password discovery for different applications/operating systems, as well as word lists

Transport Level Security

Lecture Notes

PDF | MP3: Part 1 | Part 2 | Part 3 | Video: part 1, part 2

Readings

Stallings: chapter 16 | Forouzan: chapter 17/18 | Kaufman: chapter 19

Handouts

HTTPS packet capture - trace of packets captured using tcpdump when access a web server by standard HTTP as well as using HTTPS
SSH packet capture - trace of packets captured using tcpdump when connecting to SSH server

Links

OpenSSL: toolkit/library for implementing SSL/TLS, as well as generic cryptography functions
OpenSSL Programming Examples: gives example C source code and articles decribing how OpenSSL can be used to create secure client/server applications.