CSE508 Spring 2013. Network Security

Lecturer:	Rob Johnson [ rob at cs.stonybrook.edu ]
TA:	Rishab Nithyanand [ rnithyanand at cs.stonybrook.edu ]
Location:	Engineering 145
Time:	MoWe 5:30-6:50
Rob's Office Hours:	Mo 2-3:30, Tu 2:00-3:30, 2313D Computer Science Building
Rishab's Office Hours:	Mo 1-5pm, 1208 Computer Science Building
Home page:	http://www.cs.sunysb.edu/~cse508/
Textbook:	None, although see recommendations below.

News

Several old mid-terms and finals are available for your review:
- Fall 2009 Midterm, Final
- Spring 2011 Midterm, Final
- Spring 2012 Midterm, Final
But keep in mind I will likely make this year's final consist of more, smaller, questions.
Your project reports and source code are due at 11:59 pm on May 23rd (Thursday).
17/May: Notes have been updated for all lectures.
Rob's Office Hours for the week of May 6th are moved to Thursday and Friday at 1:30pm.
NOTE THE CHANGE: Rob's office hours for Tuesday, April 30th, are cancelled. Instead, he'll have office hours on Friday (May 3rd) from 3:30-5:00.
Projects are now available. You may also design a custom project, with my approval, if you think you have a good idea.
A self-study homework assignment is now available. You do not need to turn this in for a grade. You are encouraged to work all the problems in this homework. You are invited to ask questions about this homework during office hours. If you can complete all the problems on this homework, you should be able to do well on the cryptography portions of the final exam.
Notes have been updated for all lectures until March 11th.
Rishab's office hours on Monday (Feb 4th) will be from 1-3 pm. Make up hours will be held on Wednesday (Feb 6th) from 11am -1pm.

Overview

This course will divide into roughly three parts. In the cryptography section, we will cover number theory, symmetric and public key cryptography, and other fundamental cryptographic constructs. In the protocols section, we will discuss applications of the basic cryptogrpaphic tools, such as authentication and secure e-commerce. Finally, we will talk about attacks and defenses for current network architectures.

Topics

Security basics: security goals, threat models, trust, policies, mechanism, security through obscurity
Symmetric cryptography: Block ciphers, stream ciphers, MACs, hash functions, random-number generators
Public-key crypto: RSA, El Gamal, Signatures, PKI
Protocols and applications: Kerberos, SSH, SSL, IPSec, PGP
Network attacks: DoS attacks, DNS attacks, BGP corruption, TCP hijacking, etc.
Network defenses: Firewalls, Intrusion-detection systems, software security
Advanced topics: Zero-knowledge proofs, e-cash, secret-sharing, identity-based crypto

Requirements and Grading

Subject to tweaks throughout the semester.

Homeworks (20%). I will assign 4-5 homeworks throughout the semester. They will not take long - two to four hours each.
Class project (25%). You will work in groups of 2-3 on a class project in computer security.
Class participation (5%). I strongly encourage discussion and debate in class. Please don't hesitate to ask questions if you don't understand or disagree with anything covered in this course.
Midterm exam (25%).
Final exam (25%). The final is cumulative, so it will have questions covering topics from the entire semester.

Class Notes

If you would like to earn extra credit, you may volunteer to write up notes for a lecture. Notes will be weighted so that an entire semester of notes will improve your final grade by one full letter-grade. Only notes posted to the class web page will earn extra credit. Posted notes will be selected based on clarity and correctness. Notes should be submitted in PDF format (preferably made using LaTex), and should not just be a scan of your notebook. Submit notes via the following email address (cse508notes@gmail.com) using an attachment with name MM-DD-first-last.pdf e.g. 01-23-rob-johnson.pdf and subject line "CSE508 Notes MM-DD-first-last".

Textbooks

There is no required textbook, but the cryptography section of the class will borrow heavily from Bellare and Rogaway's online course notes, Introduction to Modern Cryptography. You may also refer to Goldwasser and Bellare's Lecture Notes on Cryptography. Other cryptography books you may find useful are:

Handbook of Applied Cryptography, Alfred Menezes, Paul van Oorschot, Scott Vanstone.
Introduction to Modern Cryptography: Principles and Protocols, Jonathan Katz, Yehuda Lindell.

The latter half of the class will cover more "systems-y" topics of network security. We will read papers to cover this material, but you may also find the following books helpful:

Network Security: Private Communication in a Public World, Charlie Kaufman, Radia Perlman, Mike Speciner.
Wireless Security: Models, Threats, and Solutions, Randall K. Nichols, Panos C. Lekkas.
Computer Security: Art and Science, Matt Bishop.
Security Engineering, Ross Anderson.

Note: If you have a physical, psychological, medical or learning disability that may impact on your ability to carry out assigned course work, please contact the staff in the Disabled Student Services office (DSS), Room 133, Humanities, 632-6748v/TDD. DSS will review your concerns and determine with you what accommodations are necessary and appropriate. All information and documentation of disability are confidential.

Course Schedule

Date	Topic/optional reading assignment Warning: Notes may contain errors. Still being heavily revised for 2013
1/28	Week 1, Mon: Administrative Stuff, A Brief History of Cryptography Notes: Anthony Jose
1/30	Week 1, Wed: How WEP was annihilated! Notes: Anthony Jose
2/4	Week 2, Mon: The CPA model of security Notes: Greg Cordts
2/6	Week 2, Wed: The DPI, Security of OTP, Introduction to PRFs Notes: Tu Nguyen, Yang Zhan
2/11	Week 3, Mon: CLASS CANCELED. Notes:
2/13	Week 3, Wed: PRFs and PRPs Notes: Greg Cordts
2/18	Week 4, Mon: Modes of Operation Notes: Yang Zhan
2/20	Week 4, Wed: MACs Notes: Jagat Pudipeddi
2/25	Week 5, Mon: The CCA model of security Notes: Yang Zhan, Tu Nguyen
2/27	Week 5, Wed: CBC-MAC and Differential Cryptanalysis Notes: Tu Nguyen, Yang Zhan
3/4	Week 6, Mon: Number Theory 101 and PKC Notes: Tu Nguyen, Yang Zhan
3/6	Week 6, Wed: The CRT, Fermats Little Theorem Notes: John Paul Pennisi, Yang Zhan
3/11	Week 7, Mon: The Miller Rabin Primality Test Notes: Tu Nguyen
3/13	Week 7, Wed: The RSA and Diffie-Hellman Problem Notes: Tu Nguyen, Yang Zhan
3/18	Week 8, Mon: Spring Break
3/20	Week 8, Wed: Spring Break
3/25	Week 9, Mon: Hybrid Arguments and El Gamal Encryption Notes: John Paul Pennisi, Yang Zhan
3/27	Week 9, Wed: Signature Schemes Notes: Qian Xu, Tu Nguyen, Yang Zhan
4/1	Week 10, Mon: Signature Schemes, Bit Commitments, and ZK Proofs Notes: Hemanga Borah, Tu Nguyen
4/3	Week 10, Wed: Zero Knowledge Proofs Notes: Ameya Patnekar, Hemanga Borah
4/8	Week 11, Mon: Authentication Protocols Notes: Hemanga Borah, Yang Zhan
4/10	Week 11, Wed: Certificates and PKI Notes: Tu Nguyen, Yang Zhan
4/15	Week 12, Mon: DNS-SEC Notes: Hemanga Borah
4/17	Week 12, Wed: DNS-SEC and DANE Notes: Yang Zhan
4/22	Week 13, Mon: Web Security Notes: Tu Nguyen, Yang Zhan
4/24	Week 13, Wed: More Web Security Notes: John Paul Pennisi, Tu Nguyen, Yang Zhan
4/29	Week 14, Mon: Still More Web Security Notes: Jagat Pudipeddi, Tu Nguyen, Yang Zhan
5/1	Week 14, Wed: Secure BGP Notes: Tu Nguyen, Yang Zhan
5/6	Week 15, Mon: DDOS and Side Channel Attacks Notes: Tu Nguyen, Yang Zhan
5/8	Week 15, Wed: Anonymity and TOR Notes: Ameya Patnekar
5/22	Finals Week, Wed, 8:30-10:00pm CSE508 Final, Engineering 145. Good luck!