CS3235 Home Page

CS3235 Home Page

1	Administrative Stuff
1.1	Final Exam
1.2	Programming Assignment
1.3	Mid term exam
1.4	Tutorials
2	Lectures
2.1	Week of July 29
2.2	Week of August 5
2.3	Week of August 12
2.4	Week of August 19
2.5	Week of August 26
2.6	Week of September 2
2.7	Week of September 9
2.8	Week of September 16
2.9	Week of September 23
2.10	Week of September 30
2.11	Week of October 7
2.12	Week of October 14
2.13	Week of October 21
2.14	Week of October 28

1 Administrative Stuff

The textbook for this course is Security in Computing, 2nd edition, by Charles P. Pfleeger. You should consider this to be the first course in Computer Security. My intention is to keep it as practical as possible. For this, I will draw on other work outside the book.

The class meets in LT 27 on thursday between 2-4pm.

1.1 Final Exam

The final exam will be closed book, to be held on Nov 14th at 4.30pm in MPSH2. Please bring your calculators and 2B lead pencils to the exam. There will be multiple choice questions, questions whose answers are decimal numbers that need to encoded just like the mid term, and questions that you will answer in the exam booklet itself.

The structure of the final exam is here. I don't have the venue and time for the exam yet but I have been told that each student will receive e-mail with that information.

Study the following topics extra carefully for the final.

Classical ciphers (including Merkle-Hellman knapsacks) and their cryptanalyses.
DES and its encryption modes.
MACs (Message Authentication Codes).
Passwords, Salting, Lamport hash etc.
Read all the prescribed papers.
Number Theory. CRT, Primitive roots, Dlogs etc.
- If I ask you whether 3 is a primitive root in Z₁₁^*, you should be able to answer it.
- You should be able to convert a number into CRT tuples and back.
- If I ask you what dlog₃ 16 (mod 19) is, you ought to be able to tell.
- You don't need to know the proof of El-Gamal, but you should know how a signature is computed.
- You don't need to understand what sub groups are but you should know what an order of an element in Z_p^* is. I could ask you to compute it, say, what is the order of 3 in Z₁₉^*.
DDoS, IPSec, Viruses.
- I don't expect you to memorize the of IP or TCP datagrams but you should know how TCP can be confounded with an unfinished handshake.
- You should know how DOS is different from DDOS.
Security models: BLP, Biba, Chinese Wall, Clark-Wilson.
File system protection in Unix, the notion of users and groups, DACs & MACs etc.
- I could ask you how you might use a file system that permitted append-only operations to files to enhance security.

1.2 Programming Assignment

For questions regarding the programming assignment, send e-mail to shenxb@comp, not to me.

The grades for the assignment are here.

1.3 Mid term exam

The mid term exam is here and your grades should be here. Please bring shading the optical scan form incorrectly complaints to the attention of your TA. It is your responsibility to ensure that the information on this page is correct.

1.4 Tutorials

Tutorial 1. For questions 4 through 7, you may write a program that helps you solve part or all of it. You may be asked to show and or explain your program during the tutorial.
Tutorial 2.
Tutorial 3.
Tutorial 4.
Tutorial 5.
Tutorial 6.
Tutorial 7.
Tutorial 8.
Tutorial 9.
Tutorial 11.

An outline of the tutorial solutions (the combined enchilada) is here. Beware that it is only an outline (not complete) and solutions are not guaranteed to be correct, although they should be with a reasonably high probability. Send me corrections or suggestions for improvement.

2 Lectures

The combined lectures can be obtained as a zip file here. This isn't quite the same thing as a combined set of notes but probably more useful than getting them piecemeal. This is the latest as of Oct 26. It may change so don't print them right away. Wait for a few days.

2.1 Week of July 29

Lecture: Tentative slides for the lecture are here.
Tutorial: None this week.
Readings:

Chapter 1 of Pfleeger.
Basic Principles Of Information Protection part A of J.H. Saltzer and M.D. Schroeder's The Protection of Information in Computer Systems.
Why cyberterrorists don't care about your PC.
Buffer Overflows: Attacks and Defenses for the Vulnerability of the Decade.

2.2 Week of August 5

Lecture: Tentative slides for the lecture are here and here. You may ignore the slides that I didn't explicitly cover in class. They are remnants from another set of lectures that I've just decided to keep.
Tutorial: None this week.
Readings:

Chapter 2 of Pfleeger.

Try deciphering the following mono alphabetic substitution cipher using this cgi script. You should now be able to access this cgi-bin script from anywhere.

HP PJJI HP QBT AMTHQ OFHUE VTFVTQ KHFF JRQPCST GY FCQQFT WCISJW WHP PBJQ WCQB AMTY, C AJQ RK HIS WTIQ SJWI PQHCMP; TVTMY OJHMS RKJI QBT WHY, HIS TVTMY UMHUE CI TVTMY OJHMS, UHFFCIA HNQTM GT, "PQJK QBCTN!" HIS "ATQ RK, GMP. DJT!" CI QBT KHIQMY, WBCUB WHP NHM GJMT HORISHIQFY PRKKFCTS QBHI RPRHF, JWCIA QJ QBT PTHPJI, C WHP VTMY GRUB HFHMGTS, OY H BHMT BHIACIA RK OY QBT BTTFP, WBJG C MHQBTM QBJRABQ C UHRABQ, WBTI GY OHUE WHP BHFN QRMITS, WCIECIA. C BHS IJ QCGT NJM VTMCNCUHQCJI, IJ QCGT NJM PTFTUQCJI, IJ QCGT NJM HIYQBCIA, NJM C BHS IJ QCGT QJ PKHMT. C PQJFT PJGT OMTHS, PJGT MCIS JN UBTTPT, HOJRQ BHFN H DHM JN GCIUTGTHQ (WBCUB C QCTS RK CI GY KJUETQ-BHISETMUBCTN WCQB GY FHPQ ICABQ'P PFCUT), PJGT OMHISY NMJG H PQJIT OJQQFT (WBCUB C STUHIQTS CIQJ H AFHPP OJQQFT C BHS PTUMTQFY RPTS NJM GHECIA QBHQ CIQJXCUHQCIA NFRCS, PKHICPB-FCLRJMCUT-WHQTM, RK CI GY MJJG: SCFRQCIA QBT PQJIT OJQQFT NMJG H DRA CI QBT ECQUBTI URKOJHMS), H GTHQ OJIT WCQB VTMY FCQQFT JI CQ, HIS H OTHRQCNRF MJRIS UJGKHUQ KJME KCT. C WHP ITHMFY AJCIA HWHY WCQBJRQ QBT KCT, ORQ C WHP QTGKQTS QJ GJRIQ RKJI H PBTFN, QJ FJJE WBHQ CQ WHP QBHQ WHP KRQ HWHY PJ UHMTNRFFY CI H UJVTMTS THMQBTI WHMT SCPB CI H UJMITM, HIS C NJRIS CQ WHP QBT KCT, HIS C QJJE CQ, CI QBT BJKT QBHQ CQ WHP IJQ CIQTISTS NJM THMFY RPT, HIS WJRFS IJQ OT GCPPTS NJM PJGT QCGT.
That should be plenty of text! Send me correct answers and I'll announce in class.

Don't check the Kasiski checkbox for such a large text. It's OK for text about 15 characters long.

2.3 Week of August 12

Lecture: Tentative slides for the lecture are here. These are just a beefed up version of the slides from last week on modular arithmetic.

2.4 Week of August 19

Lecture: Tentative slides for the lecture are here (still continuing on modular arithmetic) and here.

2.5 Week of August 26

Try out the EGCD cgi script.
Lecture: Slides on public key, macs and hashes, des. The DES equations propagated through its Feistel structure are here. No wonder DES is so non-linear!
The DES program might work. The FIPS specification is here. The first 11 pages aren't all that relevant.

2.6 Week of September 2

Lecture: Slides on public key and des carry over from before except that things have been updated. Many things still need to be changed (after the lecture).

2.7 Week of September 9

Programming Assignment 1 is here.

2.8 Week of September 16

Today's lecture will try to finish off left overs from symmetric ciphers, discrete logs and maybe start on protocols.

2.9 Week of September 23

Please get and read the paper titled Key Escrowing Today by Dorothy Denning and Miles Smid that appeared in the IEEE Communications Magazine in the September 1994 issue. You can get the article through the ACM Digital library off LINC.

We will continue with the lecture from last time. But please fresh copies of discrete logs+CRT and protocols.

2.10 Week of September 30

We will continue on the lecture from last time on protocols and cover a bit of file system protection and user authentication.

2.11 Week of October 7

A guest lecture on Computer Security models by Tan Wee Yeh. Here are his slides: OpenOffice, Power point.

2.12 Week of October 14

The lecture notes are here, here, here and here. We'll see how far I get.

2.13 Week of October 21

Readings:

Reflections on Trusting Trust or you could get it from LINC directly.
Computer Viruses: Theory and Experiments by Fred Cohen. Computers & Security. February 1987.

Lecture notes:

IPSec.
Viruses.
DDoS. A student sent me the following URLs on DDoS: 1, and 2. Looks like a pretty good read.

2.14 Week of October 28

The lecture notes on countering DOS that discuss cookies have been incorporated into the slides on DOS.