COMP 3704 Computer Security, Spring 2007

General Information

Prerequisites

The prerequisites for this class are a good understanding of imperative programming and discrete mathematics. You should be able to write non-trivial programs in C. You must have a good understanding of basic data structures such as arrays.

This is a class on applied cryptography with focus on cryptographic primitives and protocols. There will be programming assignments designed to make you use, implement and evaluate key security constructs. Programming assignments involve writing code in C or C++.

Lecture Hours and Location

The lectures will be held Mondays and Wednesdays from 4pm to 6pm in John Greene Hall 316.
In order to get a door code for the Computer Lab in John Greene Hall 216 please visit the labcode webpage. The code is updated on weekly basis.

Office Hours

Christian Grothoff - JGH 214
Monday, Wednesday 1pm-4pm and by appointment.

Textbook and Syllabus

"Applied Cryptography", by Bruce Schneier, John Wiley & Sons. This will be the main textbook for the class covering most of the material.
"Version Control with Subversion", on-line book (no need to buy a copy). You must know how to use subversion as a developer (not as an administrator) in order to submit your assignments. Use this book as a reference if you encounter problems. Basic knowledge of chapters 1-3 should be sufficient.

Specific topics that will be covered:

Assignments and Grading

There will be individual assignments where you will need to answer some specific questions in prose or with small fragments of code as well as larger individual programming assignments that must be turned in for grading by a certain deadline.
Students are encouraged to discuss the materials, homework, and projects together. However, all written assignments and programs must be done individually. Academic dishonesty includes, but is not limited to: plagiarism, cheating in exams, unauthorized collaboration and falsifying academic records. Violation of any of these may result in a grade penalty on assignments, an "F" in the course, dismissal from an academic unit, revocation of admission, suspension from the University as well as being roasted over a slow fire.
Generally, all assignments are due before class on the date specified with the assignment. Exceptions to this rule (allowing later submission) may be announced in class.

The different kinds of assignments are weighted as follows:

Assignments60 Pts
Midterm15 Pts
Final15 Pts
Class Participation10 Pts

There are theoretically a total of 100 Pts possible Grades will be given as follows:

GradePoints
A> 90 Pts
B> 75 Pts
C> 60 Pts
D≥ 45 Pts
F< 45 Pts

Software

You will need various applications for the class, all of which are freely available for various operating systems. Personally, I'm using Debian GNU/Linux unstable. If you have any problems installing the software, you can always use the department's HP lab which has all of the necessary software installed. Here is a list of the software programs that you will need (possibly incomplete):

libgmp
The GNU multiple precision library
OpenSSL
Crypto library
Subversion
Version control system
Compilers and tools for C, C++
I recommend installing gcc 4.x from GNU.

Submission of Assignments

Each student will get access to a subversion repository. Assignments must be committed to that repository by the respective deadline. Students are encouraged to use the repository for version control while still working on the assignment. Only the last version commited before the deadline will be used for grading.
In order to access your subversion repository, you must first request an account. For this, you first need to generate an encrypted password. On any GNU/Linux or UNIX machine (or even a Microsoft system with Apache) enter

    $ htpasswd -nb $USER PASSWORD
    
where PASSWORD is your desired password. You will not be able to change the password later. Send the output of the command to grothoff@cs.du.edu to request an account. Once your account has been created, you should do an initial check out:
    $ svn checkout https://svn.cs.du.edu/courses/comp3704/s2007/$USER
    $ cd $USER
    
You should then proceed to create a directory for the first project and commit it:
    $ mkdir p1
    $ svn add p1
    $ svn commit -m "comment"
    
Afterwards, you can add the files to submit just like you added the directory. Make sure to commit the final version with all files (hint: svn status) before the deadline. It is also a good idea to do a seperate checkout and verify that the result works.

Schedule

Note that existing assignments may still be corrected. Only the assignments up to and including Class 10 have been finalized at this point. Feel free to look at the other assignments if you want to know what the plan looks like. Feedback is welcome.

Class 1: Introduction (03/26/2007)

Material from the textbook
Chapter 1
Lecture
Slides
Useful links
Subversion
A Model for Information Assurance: An Integrated Approach
Assignments
  1. Hello World! (due: Class 3, 1 Pt), P1/driver_p1.sh

Class 2: Protocol building blocks (03/28/2007)

Material from the textbook
Chapter 2
Lecture
Slides

Class 3: Randomness and Entropy (04/02/2007)

Material from the textbook
Chapter 16
Lecture
Slides
Useful links
GNU Scientific Library, NIST PRNG tests, NIST Special Publication 800-22, Critical Values of the Chi-Square Distribution
Assignments
  1. PRNGs (due: Class 5, 9 Pts)

Class 4: Randomness and Computers (04/04/2007)

Lecture
Slides
Material from the textbook
Chapter 17.14
Useful links
Analysis of the Linux Random Number Generator, Linux /dev/random entropy estimates
Assignments
  1. Entropy Gathering (due: Class 7, 10 Pts)

Class 5: Protocols (04/09/2007)

Material from the textbook
Chapters 3, 4 and 23.2
Lecture
Slides

Class 6: Advanced Protocols (04/11/2007)

Material from the textbook
Chapter 5
Assignments
  1. Protocol Design and Analysis (due: Class 9, 10 Pts)
Lecture
Slides

Class 7: Privacy Enhancing Protocols (04/16/2007)

Material from the textbook
Chapter 6
Lecture
Slides

Class 8: Cipher Modes and Choosing Algorithms (04/18/2007)

Material from the textbook
Chapters 9 and 10
Lecture
Slides

Class 9: Cryptography Tools, Key Length and Key Management (04/23/2007)

Material from the textbook
Chapter 7 and 8
Lecture
Slides
Useful links
OpenSSL, GNU PG, Apache SSL/TLS mini-HOWTO
Assignments
  1. Key Generation (due: Class 13, 5 Pts)

Class 10: Midterm (04/25/2007)

Class 11: Mathematical Background (04/30/2007)

Material from the textbook
Chapter 11
Lecture
Slides

Class 12: Symmetric Ciphers (05/02/2007)

Material from the textbook
Chapters 12, 13, 14, 15 and 16
Lecture
Slides

Class 13: One-way Hash Functions (05/07/2007)

Material from the textbook
Chapter 18
Lecture
Slides
Exercise
  1. Write a program that creates a rainbow table (in memory) for SHA-1 that can invert passwords of up to 5 chararacters (A-Za-z). (due: Class 17, 6 bonus Pts)

Class 14: Public-key Algorithms (05/09/2007)

Material from the textbook
Chapter 19
Lecture
Slides
Useful links
Coverity Prevent (available in the Linux lab)
Assignments
  1. RSA (due: Class 17, 10 Pts)

Class 15: Applications of Public-key Algorithms (05/14/2007)

Lecture
Slides
Material from the textbook
Chapters 20-22

Class 16: Application security (05/16/2007)

Lecture
Slides
Useful links
CERT, National Vulnerability Database, A Taxonomy of Coding Errors that Affect Security, The Unexpected SQL Injection

Class 17: Operating system security (05/21/2007)

Lecture
Slides
Useful links
Orange Book Summary, grsecurity, Securing Debian Manual, Linux File System Quotas
Assignments
  1. Attack! (due: Class 20, 15 Pts)

Class 18: Network security (05/23/2007)

Lecture
Slides
Material from the textbook
Chapter 24
Useful links
DefCon

Class 19: Review (05/30/2007)

Class 20: Final Exam (06/04/2007 at 3pm!)

Grades

Grades will be e-mailed to the e-mail address given with the request for creating the subversion account. For how to interpret the e-mailed grades please ask in class or during office hours.


Christian Grothoff
Last modified: Sat Sep 29 21:58:42 MDT 2007