Readings

The Readings column below provides assigned readings from the course's required textbook:

Amazon logo Smart, N. Cryptography: An Introduction. New York, NY: McGraw-Hill, 2002. ISBN: 0077099877. Please refer to the author's site for textbook errata.

LEC # TOPICS READINGS OPTIONAL READINGS
1 Introduction  

Whitten, Alma, Tygar, J.D. "Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0." Proceedings of the 8th USENIX Security Symposium, August 23-36, 1999, Washington, D.C.

Fu, et al. "Dos and Don’ts of Client Authentication on the Web." MIT Technical Report 818, 2001. (PDF)

Kohno, et al. "Analysis of an Electronic Voting System." (PDF)

2 User Authentication Overview, Passwords, Hashing

Section 10.3

Menezes, Alfred J., Paul C. van Oorschot, and Scott A. Vanstone. Handbook of Applied Cryptography. CRC press, October, 1996, pp. 321-327. ISBN: 0849385237. Reprinted (5th printing) in August 2001. [Hash functions and MACs].

Neumann, Peter G. "Risks of Passwords." Communications of the ACM 37, 4 (April 1994). New York, USA: ACM Press, 1994, pp. 126.

Evans, Arthur, Jr., William Kantrowitz, and Edwin Weiss. "A User Authentication Scheme not Requiring Secrecy in the Computer." Communications of the ACM 17, no. 8 (August 1974). New York, USA: ACM Press, 1974, pp. 437-442.

FIPS Standard for Password Usage

Sit, Emil, and Kevin Fu. "Inside Risks: Web Cookies: Not Just a Privacy Risk." Communications of the ACM 44, no. 9 (September 2001). New York, USA: ACM Press, 2001, pp. 120.

3 Hash Functions  

Secure Hash Standard

"Collision in part of MD5 (the compression function." RSA Laboratories' CryptoBytes newsletter, Volume 2, Number 2, Summer 1996. (PDF)

Tripwire

HMAC Papers

Fu, et al. "A file system using Merkle's hash trees for integrity." ACM Transactions on Computer Systems. Volume 20, Issue 1, 2002, pp. 1 - 24.

4 More Hashing Applications, Unconditional Security

Chapter 4

Lamport, Leslie. "One-Time Passwords: Password Authentication with Insecure Communication." Communications of the ACM 24, no. 11 (November 1981). New York, USA: ACM Press, 1981, pp. 770 - 772.

NSA VENONA Project

Hash cash (Adam Back)

One-time passwords

5 Unconditional Security  

A worked one-time-pad decryption (by your TA's) (PDF)

RSA Laboratories | Cryptography FAQ | What is a stream cipher? (Contains information on one-time pads.)

National Security Agency's pages on Venona (Successful decryption of one-time pads that were reused.)

RFC 1750: Randomness Recommendations for Security

6 Block Ciphers, Modes of Operation

Chapter 5

AES/Rijndael

Slides on the relative speed of hardware implementations of AES finalists and DES, 3DES

NIST: Modes of Operation for Block Ciphers

7 Intro to Number-Theoretic Crypto

Chapters 1 and 8

Notes on number theory (very rough draft) (PDF)

 
8 GCD and Modular Inverses, Generators, Discrete Logs, Diffie-Hellman Key Exchange, El Gamal Encryption and Signatures

Chapter 7

Diffie, Whitfield, and Martin Hellman. "New Directions in Cryptography."

9 RSA, Chosen-Ciphertext Attacks, RSA-OAEP

Sections 10.1 and 10.2

For PS 4: Paillier and Pointcheval. "Efficient Public-Key Cryptosystems Provably Secure Against Active Adversaries."

For PS 4: Know Your Enemy: Sebek2 (PDF)

Rivest, R. L., A. Shamir, and L. Adleman. "A Method for Obtaining Digital Signatures and Public-key Cryptosystems." Communications of the ACM 21, no. 2 (February 1978): 120-126.

Cramer and Shoup. "A Practical Public Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Attack."

History and multiple drafts of Ralph Merkle's paper, Secure Communications over Insecure Channels, which was finally printed in the Communications of the ACM of April 1978 (pp. 294-299), but which was written in 1974.

OAEP

RSA Labs OAEP FAQ

10 Cramer-Shoup, Commitment Schemes

Section 13.2

 
11 Quiz 1    
12 Key Agreement

Menezes, Alfred J., Paul C. van Oorschot, and Scott A. Vanstone. "Key Establishment Protocols." Chapter 12 in Handbook of Applied Cryptography. CRC press, October, 1996, pp. 321-327. ISBN: 0849385237. Reprinted (5th printing) in August 2001.

Section 10.7

Mao, Wenbo, and Colin Boyd. "Towards Formal Analysis of Security Protocols." 1993.

Mao, Wenbo, and Colin Boyd. "Classification of Cryptographic Techniques in Authentication Protocols." 1994.

13 SSL, IBS, IBE and Secret Sharing

Section 12.6

Boneh, D., and D. Brumley. "Remote Timing Attacks Are Practical." Usenix security, 2003. (PDF)

Wagner, D., and B. Schneier. "Analysis of the SSL 3.0 protocol." Usenix Workshop on electronic commerce, 1996.

Identity-Based Encryption

14 Secret Sharing  

Shamir. "How to Share A Secret."

Krawczyk. "Secret Sharing Made Short."

15 Zero-Knowledge

Section 13.3

 
16 Watermarking and Fingerprinting (Guest Lecture)  

Boneh, Dan, and James Shaw. "Collusion-Secure Fingerprinting for Digital Data." IEEE Transactions on Information Theory. Vol 44, No. 5, 1998. pp. 1897-1905.

17 Tamper Resistance and Disk Forensics  

Anderson, Ross, and Markus Kuhn. "Tamper Resistance --- A Cautionary Note."

Kocher, Paul, Joshua Jaffe, and Benjamin Jun. "Introduction to Differential Power Analysis and Related Attacks." (PDF)

Garfinkel, Simson, and Abhi Shelat. "Remembrance of Data Passed: A Study of Disk Sanitization Practices." IEEE Computer Society, January/February 2003. (PDF)

18 Physical Security: Physical Uncloneable Functions, TEMPEST

Kuhn, Markus, and Ross Anderson. "Soft Tempest." From Aucsmith, D. (Ed.) Information Hiding. Springer-Ve lag Berlin Heidelberg, 1998, pp. 124-142. (PDF)

Kuhn, Markus. "Optical Time-Domain Eavesdropping Risks of CRT Displays." Proceedings 2002 IEEE Symposium on Security and Privacy, 12–15 May 2002, Berkeley, California, pp. 3–18. (PDF)

FAQ on "Optical Time-Domain Eavesdropping Risks of CRT Displays."

Devadas, Srini, et al. "Silicon PUFs."

Devadas, Srini, et al. "Controlled PUFs."

Pappu, et al. "Physical One-Way Functions." Science. Volume 297, September 2002, pp. 2026-2030. (This resource may not render correctly in a screen reader.PDF - 2.1MB)

 
19 Self-Referential Programs, Viruses, Buffer Overflow Attacks

Slammed! (Story of Slammer worm)

Cowan, et al. "StackGuard."

Chess, David and Steve White. "An undetectable computer virus." (PDF)

Staniford, S., et al. "How to 0wn the Internet in Your Spare Time." Proceedings of the 11th USENIX Security Symposium, 2002.

 
20 More on Viruses

Chess, David and Steve White. "An undetectable computer virus." (PDF)

Thompson, Ken. "Reflections on Trusting Trust." CACM 27, no.8 (August 1984): 761-763.

Nazario, Jose, et al. "The Future of Internet Worms." (PDF)

21 Trusted Computing (NGSCB aka Palladium; TCPA)

Garfinkel, T., et al. "Flexible OS Support and Applications for Trusted Computing." (PDF)

Trusted Computing Group

Microsoft's Palladium FAQ

Ross Anderson's TCPA/Palladium FAQ

22 Trusted Computing, Java Security, Biometrics  

United States General Accounting Office (GAO). "Technology Assessment: Using Biometrics in Border security." (PDF) Report No. GAO-03-174, November 2002.

Cryptogram Newsletter from August 1998 that mentions biometrics

Pankanti, S., et al. "On the Individuality of Fingerprints." (PDF)

23 Quiz 2, Concluding Remarks    
24 Talks    
25 Talks    
26 Talks