| 1 | Introduction | | Whitten, Alma, Tygar, J.D. "Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0." Proceedings of the 8th USENIX Security Symposium, August 23-36, 1999, Washington, D.C. Fu, et al. "Dos and Don’ts of Client Authentication on the Web." MIT Technical Report 818, 2001. (PDF) Kohno, et al. "Analysis of an Electronic Voting System." (PDF) | | 2 | User Authentication Overview, Passwords, Hashing | Section 10.3 | Menezes, Alfred J., Paul C. van Oorschot, and Scott A. Vanstone. Handbook of Applied Cryptography. CRC press, October, 1996, pp. 321-327. ISBN: 0849385237. Reprinted (5th printing) in August 2001. [Hash functions and MACs]. Neumann, Peter G. "Risks of Passwords." Communications of the ACM 37, 4 (April 1994). New York, USA: ACM Press, 1994, pp. 126. Evans, Arthur, Jr., William Kantrowitz, and Edwin Weiss. "A User Authentication Scheme not Requiring Secrecy in the Computer." Communications of the ACM 17, no. 8 (August 1974). New York, USA: ACM Press, 1974, pp. 437-442. FIPS Standard for Password Usage Sit, Emil, and Kevin Fu. "Inside Risks: Web Cookies: Not Just a Privacy Risk." Communications of the ACM 44, no. 9 (September 2001). New York, USA: ACM Press, 2001, pp. 120. | | 3 | Hash Functions | | Secure Hash Standard "Collision in part of MD5 (the compression function." RSA Laboratories' CryptoBytes newsletter, Volume 2, Number 2, Summer 1996. (PDF) Tripwire HMAC Papers Fu, et al. "A file system using Merkle's hash trees for integrity." ACM Transactions on Computer Systems. Volume 20, Issue 1, 2002, pp. 1 - 24. | | 4 | More Hashing Applications, Unconditional Security | Chapter 4 | Lamport, Leslie. "One-Time Passwords: Password Authentication with Insecure Communication." Communications of the ACM 24, no. 11 (November 1981). New York, USA: ACM Press, 1981, pp. 770 - 772. NSA VENONA Project Hash cash (Adam Back) One-time passwords | | 5 | Unconditional Security | | A worked one-time-pad decryption (by your TA's) (PDF) RSA Laboratories | Cryptography FAQ | What is a stream cipher? (Contains information on one-time pads.) National Security Agency's pages on Venona (Successful decryption of one-time pads that were reused.) RFC 1750: Randomness Recommendations for Security | | 6 | Block Ciphers, Modes of Operation | Chapter 5 | AES/Rijndael Slides on the relative speed of hardware implementations of AES finalists and DES, 3DES NIST: Modes of Operation for Block Ciphers | | 7 | Intro to Number-Theoretic Crypto | Chapters 1 and 8 Notes on number theory (very rough draft) (PDF) | | | 8 | GCD and Modular Inverses, Generators, Discrete Logs, Diffie-Hellman Key Exchange, El Gamal Encryption and Signatures | Chapter 7 | Diffie, Whitfield, and Martin Hellman. "New Directions in Cryptography." | | 9 | RSA, Chosen-Ciphertext Attacks, RSA-OAEP | Sections 10.1 and 10.2 For PS 4: Paillier and Pointcheval. "Efficient Public-Key Cryptosystems Provably Secure Against Active Adversaries." For PS 4: Know Your Enemy: Sebek2 (PDF) Rivest, R. L., A. Shamir, and L. Adleman. "A Method for Obtaining Digital Signatures and Public-key Cryptosystems." Communications of the ACM 21, no. 2 (February 1978): 120-126. Cramer and Shoup. "A Practical Public Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Attack." | History and multiple drafts of Ralph Merkle's paper, Secure Communications over Insecure Channels, which was finally printed in the Communications of the ACM of April 1978 (pp. 294-299), but which was written in 1974. OAEP RSA Labs OAEP FAQ | | 10 | Cramer-Shoup, Commitment Schemes | Section 13.2 | | | 11 | Quiz 1 | | | | 12 | Key Agreement | Menezes, Alfred J., Paul C. van Oorschot, and Scott A. Vanstone. "Key Establishment Protocols." Chapter 12 in Handbook of Applied Cryptography. CRC press, October, 1996, pp. 321-327. ISBN: 0849385237. Reprinted (5th printing) in August 2001. Section 10.7 | Mao, Wenbo, and Colin Boyd. "Towards Formal Analysis of Security Protocols." 1993. Mao, Wenbo, and Colin Boyd. "Classification of Cryptographic Techniques in Authentication Protocols." 1994. | | 13 | SSL, IBS, IBE and Secret Sharing | Section 12.6 | Boneh, D., and D. Brumley. "Remote Timing Attacks Are Practical." Usenix security, 2003. (PDF) Wagner, D., and B. Schneier. "Analysis of the SSL 3.0 protocol." Usenix Workshop on electronic commerce, 1996. Identity-Based Encryption | | 14 | Secret Sharing | | Shamir. "How to Share A Secret." Krawczyk. "Secret Sharing Made Short." | | 15 | Zero-Knowledge | Section 13.3 | | | 16 | Watermarking and Fingerprinting (Guest Lecture) | | Boneh, Dan, and James Shaw. "Collusion-Secure Fingerprinting for Digital Data." IEEE Transactions on Information Theory. Vol 44, No. 5, 1998. pp. 1897-1905. | | 17 | Tamper Resistance and Disk Forensics | | Anderson, Ross, and Markus Kuhn. "Tamper Resistance --- A Cautionary Note." Kocher, Paul, Joshua Jaffe, and Benjamin Jun. "Introduction to Differential Power Analysis and Related Attacks." (PDF) Garfinkel, Simson, and Abhi Shelat. "Remembrance of Data Passed: A Study of Disk Sanitization Practices." IEEE Computer Society, January/February 2003. (PDF) | | 18 | Physical Security: Physical Uncloneable Functions, TEMPEST | Kuhn, Markus, and Ross Anderson. "Soft Tempest." From Aucsmith, D. (Ed.) Information Hiding. Springer-Ve lag Berlin Heidelberg, 1998, pp. 124-142. (PDF) Kuhn, Markus. "Optical Time-Domain Eavesdropping Risks of CRT Displays." Proceedings 2002 IEEE Symposium on Security and Privacy, 12–15 May 2002, Berkeley, California, pp. 3–18. (PDF)
FAQ on "Optical Time-Domain Eavesdropping Risks of CRT Displays." Devadas, Srini, et al. "Silicon PUFs." Devadas, Srini, et al. "Controlled PUFs." Pappu, et al. "Physical One-Way Functions." Science. Volume 297, September 2002, pp. 2026-2030. (PDF) | | | 19 | Self-Referential Programs, Viruses, Buffer Overflow Attacks | Slammed! (Story of Slammer worm) Cowan, et al. "StackGuard." Chess, David and Steve White. "An undetectable computer virus." (PDF) Staniford, S., et al. "How to 0wn the Internet in Your Spare Time." Proceedings of the 11th USENIX Security Symposium, 2002. | | | 20 | More on Viruses | Chess, David and Steve White. "An undetectable computer virus." (PDF) Thompson, Ken. "Reflections on Trusting Trust." CACM 27, no.8 (August 1984): 761-763. | Nazario, Jose, et al. "The Future of Internet Worms." (PDF) | | 21 | Trusted Computing (NGSCB aka Palladium; TCPA) | Garfinkel, T., et al. "Flexible OS Support and Applications for Trusted Computing." (PDF) | Trusted Computing Group Microsoft's Palladium FAQ Ross Anderson's TCPA/Palladium FAQ | | 22 | Trusted Computing, Java Security, Biometrics | | United States General Accounting Office (GAO). "Technology Assessment: Using Biometrics in Border security." (PDF) Report No. GAO-03-174, November 2002. Cryptogram Newsletter from August 1998 that mentions biometrics Pankanti, S., et al. "On the Individuality of Fingerprints." (PDF) | | 23 | Quiz 2, Concluding Remarks | | | | 24 | Talks | | | | 25 | Talks | | | | 26 | Talks | | |
|
Help support MIT OpenCourseWare by shopping at Amazon.com! MIT OpenCourseWare offers direct links to Amazon.com to purchase the books cited in this course. Click on the book titles and purchase the book from Amazon.com, and MIT OpenCourseWare will receive up to 10% of all purchases you make. Your support will enable MIT to continue offering open access to MIT courses.