CSE408: Intro to Network Security (Spring 2012)

CSE408: Intro to Network Security (Spring 2012)

Course description:

The course is composed of two parts: in the first part we discuss mainly a set of fun security/crypto protocols (e.g. zero knowledge, secure payments etc). In the second part we discuss direct network security issues (e.g. SSL, PKIs etc).

Likely to be included in the first part (not necessarily in this order): a bit of crypto (hash functions, single-key crypto, public key crypto, signatures, IND-CPA/CCA), protocols (key exchange, secret sharing/splitting, all kinds of signatures, mental poker, interactive zero knowledge proofs, oblivious transfer, certified mail, secure elections, SMC, digital cash)

Likely to be included in the second part (not necessarily in this order): Kerberos, X.509, PGP, IPSec, SSH, SSL/TLS, SET, IOTP, Bluetooth, 802.11/wireless security, firewalls, intrusion detection.

We are not using any specific textbook. However, as a reference please feel free to look at any of the following:

Applied Cryptography (Second Edition) by Bruce Schneier
Free: Security Engineering by Ross Anderson
Free: Handbook of Applied Cryptography by Alfred J. Menezes, Paul C. van Oorschot and Scott A. Vanstone
Practical Cryptography by Niels Ferguson and Bruce Schneier is a nice and easy introduction to security
Free: Hardcore crypto fans take a look at this
Free: Crypto Class at Stanford
This is a great (still) reference on firewalls: Firewalls and Internet Security: Repelling the Wily Hacker, First Edition, William R. Cheswick and Steven M. Bellovin
http://www.cryptool.org/ - a free e-learning application that you can use to apply and analyze cryptographic algorithms
http://thehackernews.com

Times: 11:20-12:40 TUTH
Place: Heavy Engineering Lab 201
Office Hours: 13:30-14:30 TUE (CSE 2313F) or by email appointment
Contact Info: cse408 @ cs (course-related questions are only answered through this account)

Evaluation and Schedule (this is orientative and these are subject to change): 3-4 written homeworks, a midterm and a final. Grading criteria (subject to minor changes): midterm evaluation (30%), final (50%), homeworks (15%), activity and quizzes (5%). I expect you to mostly come to class.

Approximate summary of lectures:

01/24	Introduction: What is security ? What isn't security ? Security by obscurity. Encryption. Hashes. View: The pleasure of finding things out - RP Feynman To Do: sign up for the crypto Class at Stanford! Read: Current Cryptogram Slides: 01
01/26	Crypto: Crypto-hashes. Encryption (cont'd) Read: Encryption, Ciphers, crypto hashes Slides: 02
01/31	Crypto: public key crypto Read: Diffie Hellman, forward secrecy Read: discrete logarithm (read entries in section Algorithms also), Discrete logarithms in finite fields and their cryptographic significance (this last one is optional!!!) Slides: 02
02/02	Crypto: PKI, randomness Read: PKI, Certificate Authority, RNG Read: New directions in cryptography Slides: 03
02/07	Internet: Anonymity (lecture: Moussa Ehsan) Read (one of the two): Anonymous Connections and Onion Routing, Crowds: Anonymity for Web Transactions Slides: anonymity
02/09	Trustworthy Hardware: Part One (lecture: Sumeet Bajaj) Optional: Evaluation Assurance Levels Optional: FIPS 140-2 Read: Trusted Computing Read: "Breaking Up Is Hard To Do: Modeling Security Threats for Smart Cards" Slides: tpms
02/14	Crypto: Randomness, Ciphers Read: ciphers, 3DES - solving the meet in the middle attack Homework 1: Handed out in class! (due: 2/28 in class/hardcopy, questions and answers here) Slides: 04
02/16	Crypto: PKI revisited Read: Ron Was Wrong, Whit is Right! Read: Current Cryptogram Optional: Bitcoin
02/21	Protocols: Kerberos Read: Windows Kerberos Authentication Slides: 05
02/23	Crypto/Systems: Semantic Security Read: semantic security, IND-CPA Slides: 06
02/28	Crypto: Secret Splitting, Bit Commitment, Coin Flipping, Oblivious Transfer, Time-stamping Read: Sovereign Keys Homework 2: Handed out in class! (due: 3/15 in class/hardcopy, questions and answers here) Note on Homework 2: wikipedia was wrong: here is the original WMF paper and another paper discussing it. Slides: 07
03/01	Crypto: performance, hash chains, merkle trees, mental poker, quadratic residues, goldwasser-micali, Quantum Key Exchange Read: Some Timestamping Protocol Failures, QKD Read (overview only): Prisoners of their own device: Trojan attacks on device-independent quantum cryptography Optional: Quantum Telecloning, Quantum Cryptography, It's Some Kind of MagiQ, Quantum Cryptography: Privacy Through Uncertainty, Fiber Optics attacks Slides: 08
03/06	Networks: IPSec Read: IPSec, Trustwave issued a man-in-the-middle certificate Optional: Why was the ethernet MTU set to 1500 historically? Slides: 09
03/08	Networks: SSL Read: EFF: How Secure is HTTPS today?, SSL Slides: 10
03/13	Midterm Prep and Recap + Discussion on Onion Routing
03/15	Midterm: in class (grades here)
03/20	Passwords Read: Passwords, Two Factor Authentication Read: Current Cryptogram Slides: 11
03/22	Intrusion Detection Read: Attacking the Washington, D.C. Internet Voting System Slides: 12
03/27	Malware Homework 3: Handed out in class! (due: 4/19 in class/hardcopy, questions and answers here) Read: Malware Watch: Stuxnet: Deep Dive Slides: 13
03/29	Malware Briefly browse the maps: Shadowserver Foundation Slides: 13
04/03	Spring Break
04/05	Spring Break
04/10	Malware, SPAM, Phishing Read: Phishing, Email SPAM Slides: 13, 14
04/12	Network Defenses: Firewalls Read: Current Cryptogram Slides: 15
04/17	Pizza Day: Open Discussion on Trusted Hardware, Network Security, and Jobs Watch: TPM Reset Attack Read: Building the IBM 4758 Secure Coprocessor Optional: Extracting a 3DES key from an IBM 4758 Slides: hardware tutorial
04/19	Wireless 802.11/Bluetooth Security and Attacks (lecture: Sumeet Bajaj) Read: how bluetooth works, Optional: wikipedia:bluetooth, Bluetooth Specs Slides: 17
04/24	Network Attacks: DOS, flooding, spoofing, sniffing, hijacking, replay etc. Read: Dan Kaminsky DNS cache poisoning attack explained Optional: Kevin Mitnick attack described Slides: 16
04/26	Network Attacks continued. Read: details of Mitnick attack
05/01	Even More Network Attacks. And a bit more on Bitcoin. Read: Bitcoin: A Peer-to-Peer Electronic Cash System Read: Current Cryptogram
05/03	Recap
05/08	Final: 2:15-4:45pm (location: Heavy Engineering 201, in class) (grades here)

Policy on seeing graded Exams/Homeworks: You can request to see a graded exam/homework only up to two weeks after it was graded. You should not come for re-grades at the end of the semester for homeworks graded in the beginning of the semester.

Policy on Missing Exams or Homeworks: Missing an exam/homework/project implies a grade of zero in that exam/homework/project, unless there is a properly documented reason (e.g., medical with documentation). Examples of non-valid reasons include oversleeping, forgetting, discretionary travel (travel whose timing is under your control, such as an interview trip), and a host of others. Such policy precedents are difficult for an instructor to deviate from without running the risk of being accused of "treating people unequally" ... etc, so I hope none of you will put me in that situation.

Ethics:

Note: If you have a physical, psychological, medical or learning disability that may impact on your ability to carry out assigned course work, please contact the staff in the Disabled Student Services office (DSS), Room 133, Humanities, 632-6748v/TDD. DSS will review your concerns and determine with you what accommodations are necessary and appropriate. All information and documentation of disability are confidential.