CS 463 - Cryptography and Data Security

Meeting time: MWF 3:30-4:30pm
Room 208 Gruening

University of Alaska Fairbanks

UAF CS F463-F01
3.0 Credits, Spring 2013
Prerequisites: Math 307 (Discrete) and CS 311 (Data Structures)

Instructor: Dr. Orion Lawlor
lawlor@alaska.edu, 474-7678
Office: 201E Chapman
Hours: 2-4pm TR, by appointment, or just drop by!

Readable and Useful Textbook:
Applied Cryptography
Bruce Schneier
2nd Edition, Wiley

Course Website: http://www.cs.uaf.edu/2013/spring/cs463

ADA Compliance: I will work with the Office of Disability Services (208  WHITAKER BLDG, 474-5655) to provide reasonable accommodation to students with  disabilities.


Course Goals and Requirements

This is an application-oriented tour of modern cryptography, and will range from mathematical proofs, to network protocol design, to binary disk sector manipulation, to applied statistical cryptanalysis.  As such, you'll need a range of skills to succeed in this course.  First, you'll need a solid mathematical background, including induction proofs and familiarity with primes and factoring.  Second, you need good applied low and high-level programming skills, including bitwise arithmetic, performance analysis, and the ability to read and write large programs.  We will *briefly* review each of these skills before use, but we will move quickly.

Students finishing this course will be able to follow modern cryptographic and data security practice, such as:

Calendar

Last day to drop: Friday, Feb 1. Midterm exam: Wednesday, March 6.  Spring break: March 9-17.  Last day to withdraw: Friday, March 22. Springfest: Friday, April 26.  Last class: Monday, May 6. Final exam: 3:15 - 5:15 p.m. Wednesday, May 8.

Student Resources

Academic Help: Rasmuson Library, Academic Advising Center (509 Gruening, 474-6396), Math Lab (Chapman Room 305), English Writing Center (801 Gruening Bldg).

Grading

Your work will be evaluated on correctness, rationale, and insight. Grades for each assignment and test may be curved up or down if needed. Your grade is then computed based on four categories of work:

  1. HW: Homeworks and machine problems, to be distributed through the semester.

  2. PROJ1: a paper and in-class presentation on a crypto topic, due in March.

  3. PROJ2: a software development or cryptographic performance analysis project, due in May.

  4. MT: Midterm Exam, Wednesday, March 6.

  5. FINAL: Final Exam (comprehensive), 3:15 - 5:15 p.m. Wednesday, May 8.

Your overall score is then calculated as:
GRADE = 20% HW + 15% PROJ1 + 15% PROJ2 + 25% MT + 25% FINAL
This percentage score is transformed into a plus-minus letter grade via these cutoffs: A >= 93%; A- 90%; B+ 87%; B 83%; B- 80%; C+ 77%; C 70%; D+ 67%; D 63%; D- 60%; F. The grades “C-”, “F+”, and “F-” will not be given. “A+” is reserved for truly extraordinary work.



Course Rules

At my discretion, I may round your grade up if it is near a grading boundary. Homeworks are due at midnight on the day they are due. Late homeworks will receive no grade credit, but you'll sleep better knowing you did them anyway. At my discretion, I may allow late work without penalty when due to circumstances beyond your control. Everything you turn in must be your own work--violations of the UAF Student Code of Conduct will result in a minimum penalty equal to THAT ENTIRE SECTION OF YOUR GRADE (e.g., one plagiarized homework question will negate an otherwise perfect grade on all homeworks). However, even substantial reuse of other people's work is fine (and not plagiarism) iff it is clearly cited; you'll be graded on what you've added to others' work. Group projects (NOT homeworks) are acceptable iff you clearly label who did what work; but I do expect a two-person group project to represent twice as much work as a one-person project. Department policy does not allow tests to be taken early; but when necessary I may allow them to be taken late. In extraordinary circumstances, such as an ice storm or zombie outbreak, classes may be held electronically via Blackboard/Elluminate Live.


Course Outline (Tentative)

- Game theory and cryptographic assumptions
    - The keeping of secrets
    - Assumed powers of the adversary
    - Authentication vs. secrecy
    - Security by obscurity

- Brief review of statistics
    - Combinatorics & expectation
    - Information theory & entropy
    - "Guess my number"
    - Birthday attack

- Cryptanalysis
    - Bit correlation tests
    - Spectral noise analysis
    - Chosen plaintext attack

- (Pseudo) Random Number Generation
    - entropy & information content
    - linear congruential PRNG
    - Blum Blum Shub PRNG

- Secret key ciphers [Ch 12]
    - One time pad
    - DES
    - AES

- Hashing [Ch 18]
    - SHA-1 and SHA-256
    - Hashing and cracking passwords
    - Rainbow tables
    - Nonces, replay, and secure authentication

- Brief review of networks
    - TCP sockets, UDP datagrams
    - SOCK_RAW and sniffing
    - Network protocol design
    - Tinfoil hats and crossing the "air gap"

- Disk and RAM Erasure and Recovery
    - Data at rest principle
    - Encrypted backups

- Whole-disk encryption
    - Block based encryption, losetup
    - Watermarking and IV attacks
    - Differential cryptanalysis [Ch 12.4]

- The key distribution problem [Ch 8]
    - Remembering versus storing passwords
    - Key stretching (iterated hashing)
    - Key strengthening (private salt)

- Public key ciphers [Ch 19 & 20]
    - RSA and the difficulty of factoring
    - DSA and elliptic curve cryptography
    - Certificates & Verisign

- Hardware Implementations
    - GPU hash cracking
    - Two-factor authentication (fob)