Security and Cryptography (CSS 322)

Introduction to Security

Lecture Notes

• Presentation: PDF
• Video: part 1, part 2 (2011: part 1)

Readings

Stallings: chapter 1 | Forouzan: chapter 1 | Kaufman: chapter 1

Links

• (ISC)2 - security certification
• SANS Institute - security training and certification
• COMPTIA - computer and security certification and training
• Computer Emergency Response Teams (CERT): Thai | US
• Certificates and Verification: VeriSign | Thawte | Entrust
• Top 20 Security Risks
• ARBOR ATLAS security reports
• Symantec Internet Security Threat Report

Quizzes and Homework

• Quiz 1 - Introduction to Security
• Homework 1 - read the course website, making sure you are familiar with the resources available, assessment criteria and your login works for Moodle

Classical Encryption Techniques

Lecture Notes

• Presentation: PDF
• Video: part 1, part 2 (2011: part 1 (problem with audio), part 2)

Readings

Stallings: chapter 2 | Forouzan: chapter 3 | Kaufman: chapter 2

Links

• Classical Cipher examples using crypto Bash script
• One Time Pad and brute force attack example using crypto Bash script
• Steganography example using outguess
• Simon Singh - a journalist who authored the Code Book. From the website you can download software from the CDROM that provides many examples and animations of classical (and current) encryption algorithms.
• CrypTool - free software for apply many encryption algorithms (classical, symmetric, public key) and analysing (breaking) ciphertexts. Highly recommended that you install this software and try it out. I use it to demonstrate examples in the lectures.
• NSA has some historical information, including documents on German cipher machines.
• Alph open-source, command-line based encryption software for classical algorithms

Block Ciphers and DES

Lecture Notes

• Presentation: PDF
• Video: part 1, part 2, part 3 (2011: part 1, part 2)

Readings

Stallings: chapter 3 | Forouzan: chapter 5/6 | Kaufman: chapter 3

Handouts

• Double Encryption and Modes of Operation Example
• Ideal Block Cipher Example
• Simplified DES Example
• Simplified AES Example

Links

• Official DES Standard
• Simplified DES Calculator
• AES Standard (PDF)
• NIST Computer Security Division
• TrueCrypt - open source disk encryption using AES
• Rijndael at NIST
• Twofish - another block cipher
• Serpent - another block cipher
• And some other block ciphers

Quizzes and Homework

• Quiz 5 - Block Cipher Concepts
• Homework 2 - Finish the simplified DES example started in the lecture. The input to the second round (i.e. the output of the SW) is 10011101. The final ciphertext should be 01110111.

Modes of Operation

Lecture Notes

• Presentation: PDF
• Video: part 1 (2011: part 1)

Readings

Stallings: chapter 6 | Forouzan: - | Kaufman: chapter 4

Pseudorandom Numbers and Stream Ciphers

Lecture Notes

• Presentation: PDF
• Video: part 1, part 2 (2011: part 1)

Readings

Stallings: chapter 7 | Forouzan: - | Kaufman: chapter 4

Handouts

• Simplified RC4 Example

Links

• True Random number service
• GNU Random Number Generation Software Library

Number Theory

Lecture Notes

• Presentation: PDF
• Video: part 1, part 2 (2011: part 1)

Readings

Stallings: chapter 8 | Forouzan: chapter 9 | Kaufman: chapter 7

Handouts

• Definitions
• Summary and Examples

Public Key Cryptography

Lecture Notes

• Presentation: PDF
• Video: part 1, part 2, part 3, part 4 (2011: part 1)

Readings

Stallings: chapter 9/10 | Forouzan: chapter 10 | Kaufman: chapter 6

Handouts

• Examples

Links

• RSA Security (the company started by the creators of the RSA algorithm)
• Detailed description and example of RSA from David Ireland. The site also has nice coverage of other aspects of security, including a detailed proof of RSA.
• Another RSA example using larger numbers
• Homepage of Ron Rivest, co-inventor of RSA, RCx, MD5, etc.
• Bruce Schneier's website. Details on many protocols, algorithms, products and attacks. Schneier is a well-known security researcher, with popular books on security.

Cryptographic Hash Functions

Lecture Notes

• Presentation: PDF
• Video: part 1, part 2, part 3 (2011: part 1, part 2)

Readings

Stallings: chapter 11 | Forouzan: chapter 11/12 | Kaufman: chapter 5

Handouts

• Authentication Examples including Birthday Problem

Links

• A very simple Online Hash Generator. Enter some text and it calculates the MD5, SHA-1 and SHA-256 hash value.
• Another web-based hash generator
• Example of MD5 Hash Collisions of two real documents (Postscript files)

Message Authentication Codes and Digital Signatures

Lecture Notes

• Presentation: PDF
• Video: part 1 (2011: part 1)

Readings

Stallings: chapter 12/13 | Forouzan: chapter 11/12 | Kaufman: chapter 5/6

Key Management and Distribution

Lecture Notes

• Presentation: PDF
• Video: part 1, part 2, part 3 (2011: part 1, part 2)

Readings

Stallings: chapter 14 | Forouzan: chapter 15 | Kaufman: chapter 15

Links

• Diffie Hellman Example
• Diffie Hellman Key Exchange Protocol standardised by the IETF
• NIST Guidelines on Key Management (PDF)
• IETF Public Key Infrastructure (X.509) Working Group - includes links to standards developed for public key exchange (and certificates) in the Internet.
• Thawte and VeriSign are two large Certificate Authorities
• Mozilla Firefox Certificates: list of Certificate Authorities included in Firefox, including the policy Mozilla uses in selecting CAs, and the audits that each CA has passed (to ensure they are trustworthy CAs).

Passwords

Lecture Notes

• Presentation: PDF
• Video: part 1, part 2, part 3 (2011: part 1)

Readings

Stallings: chapter 15/20 | Forouzan: chapter 14 | Kaufman: chapter 9/10

Links

• Password hashing and salting byJoshua Thijssen, a description of why hashing passwords is necessary, and what adding a salt protects against.
• Word lists, including English, names, actors and common passwords
• John the Ripper Password Cracker is popular open source software for password guessing
• Passwords at Openwall - links to many different techniques for password discovery for different applications/operating systems, as well as word lists

Transport Level Security

Lecture Notes

• Presentation: PDF
• Video: part 1 (2011: part 1)

Readings

Stallings: chapter 16 | Forouzan: chapter 17/18 | Kaufman: chapter 19

Handouts

• HTTPS packet capture - trace of packets captured using tcpdump when access a web server by standard HTTP as well as using HTTPS
• SSH packet capture - trace of packets captured using tcpdump when connecting to SSH server

Links

• OpenSSL: toolkit/library for implementing SSL/TLS, as well as generic cryptography functions
• OpenSSL Programming Examples: gives example C source code and articles decribing how OpenSSL can be used to create secure client/server applications.
• OpenVPN: free VPN software

Malicious Software

Lecture Notes

• Presentation: PDF
• Video: (2011: part 1, part 2)

Readings

Stallings: chapter 21 | Forouzan: - | Kaufman: -

Links

• Historical examples of malicious programs

Return to: CSS322 Home | Course List | Steven Gordon's Home | SIIT