Applied Cryptography (VIHIA030)

This course is lectured at the Aquincum Institute of Technology, Budapest. However, it has been accredited and got a course identifier VIHIA030 at the Budapest University of Technology and Economics. This page is the course homepage, which contains practical information related to the course and the lectures, consequently, this page is always under construction.

Course syllabus (pdf)

Past semesters

2014/2015 spring semester, 2015/2016 fall semester

Lecturers

• Levente Buttyán, PhD, Associate Professor
  Head of the CrySyS Lab, BME
  
  
• István Lám
  CEO and CTO of Tresorit
  
  

Course objectives

The objective of the course is to give an introduction to the basics of cryptography, to explain how basic building blocks work, and to demonstrate how secure systems can be engineered by properly using them. Besides the theoretical background, we use lot of illustrative examples and show practical applications. In addition, besides the technical details, we give an outlook to the legal and business aspects of using cryptography.

Background and course content at a glance

Today, we live in an information based society: we communicate via networks, we store data in the cloud, we use on-line services, and we even socialize on-line. Trust in all these infrastructure and services is indispensable, and information security technologies play a key role in establishing trust in the cyber world. One of the key enablers of information security is cryptography. This course is about the basics of cryptography and its appications for building secure systems. As a matter of fact, cryptography has not always been used properly in practice; indeed, it is very often used in an inappropriate way, which leads to catastrophic failures. Proper application of cryptographic mechanisms is an engineering issue and needs training. This is the key motivation for our course.

This course has four parts. In the first part, we introduce the basic cryptographic building blocks (such as symmetric and asymmetric key encryption schemes, hash functions, and random number generators) and the basic protocols that use them (such as block encryption modes, MAC functions, and key establishment). In the second part, we deal with the application of cryptographic primitives for engineering secure communication protocols. We discuss in details well-known examples, such as TLS/SSL, IPsec, and the security protocols used in WiFi networks. In the third part, we show application of cryptography for securing cloud services, focusing on secure cloud based data storage, and sharing first hand experience in desiging and building Tresorit, an encrypted storage service in the cloud. Finally, in the fourth part, we discuss the concept and the practice of public key infrastructures (PKI) and electronic signatures, including issues such as issuing, using, and revoking public key certificates, the pitfalls of verifying electronic signatures, experiences in building and operating a certification authority (CA), as well as electronic signature laws and regulations in different countries and business models for PKI.

Methods of instruction

The course comprises a series of lectures with classroom exercises. In addition, the students receive reading assignments and homework projects. At the end of the course, the students have to pass an exam.

Grading

Final grading: 40% project work + 60% exam

Schedule and room

Course outline and material (2016 spring semester)

Recommended supplementary material

Important note: Currently, Avatao is available only for invited people. If you want to use Avatao to access hands-on challenges related to the course, please sign up at avatao.com. When signing up, please put the string "AIT-2016" in the optional comment field in order for us to know that you are a student from AIT. We will then send you an invitation e-mail and you can complete the registration by following the instructions given in that e-mail.

• General:
  • N. Ferguson, B. Schneier, and T. Kohno, Cryptography Engineering, Wiley, 2010.
  • A. Menezes, P. van Oorschot, and S. Vanstone, Handbook of Applied Cryptography, CRC Press, 1996.


• History of cryptography:
  • Reading:
    • Simon Singh, The Code Book
  • Avatao challenges:
    • Breaking the Nihilist historical cipher
    • Trithemius cipher
    • Four-Square game
  • Other:
    • The Imitation Game movie


• Symmetric key ciphers and block encryption modes:
  • Reading:
    • Lecture notes of Mihir Bellare on DES and AES
    • Wikipedia page on block encryption modes
    • Vaudenay's padding oracle attack on CBC
  • Avatao challenges:
    • (In)security by obscurity
    • Hide and Seek
    • One, two, buckle my shoe
    • Small is not always beautiful
    • A known attack against AES-CBC


• Cryptographic hash functions and message authentication codes:
  • Reading:
    • An overview of crypto hash functions and their applications
    • Wikipedia page on cryptographic hash functions
    • Wikipedia page on HMAC
  • Avatao challenges:
    • DM strengthening is indeed strengthening
    • Breaking a naive MAC construction


• Public-key cryptography:
  • Reading:
    • Twenty Years of Attacks on the RSA Cryptosystem
    • Chosen Ciphertext Attacks Against PKCS #1
    • A (relatively easy to understand) primer on elliptic curve cryptography
  • Avatao challenges:
    • RSA Prime Generation 4 da win!
    • Break the RSA!
    • Creating a fake certificate
    • PC master race


• Key exchange protocols:
  • Reading:
    • Prudent engineering practice for cryptographic protocols
    • Robustness principles for public-key protocols
    • A Logic of Authentication


• Random number generation:
  • Reading:
    • Cryptographic Random Numbers
    • Attacks on PRNGs
    • The Fortuna PRNG
  • Avatao challenges:
    • Exploiting a weak ANSI X9.17 PRNG
    • KriptoG (practice) -- Third part: Modern crypto


• WiFi security:
  • Reading:
    • An overview on WiFi security protocols
    • WEP weaknesses and attacks
    • FMS attack on RC4 in WEP
    • Attacks on WPA


• Transport Layer Security (TLS/SSL):
  • Reading:
    • The Transport Layer Security (TLS) Protocol, v1.2, RFC 5246
    • A survey on SSL/TLS attacks
    • Breaking SSL/TLS protected passwords
  • Other:
    • A talk on Convergence at BlackHat USA 2011


• Security in wireless sensor networks:
  • Reading:
    • LEAP: Efficient Security Mechanisms for Large Scale Distributed Sensor Networks
    • Paper on Random Key Pre-distribution
    • Establishing Pairwise Keys in Distributed Sensor Networks
    • A Pairwise Key Pre-distribution Scheme for Wireless Sensor Networks
    • SPINS: Security Protocols for Sensor Networks (includes micro-TESLA)
    • Tinysec: A link layer security architecture for wireless sensor networks
    • Packet leashes: a defense against wormhole attacks in wireless networks
    • Statistical Wormhole Detection in Sensor Networks
    • A book on Security and Cooperation in Wireless Networks


• Fair exchange protocols:
  • Reading:
    • A survey on fair non-repudiation protocols

Project assignments

• Project assignment 1:
  • Description of the task
  • Schedule: start: Feb 29. | deadline: Mar 18.
• Project assignment 2:
  • Schedule: start: Apr 4. | intermediate deadline: Apr 18. | final deadline: May 17.

Exam

The exam is scheduled for May 23, 2016.