- Introduction. Monoalphabetic ciphers. Polyalphabetic ciphers.
- Block ciphers. DES. GOST.
- Block ciphers. AES. Operation modes.
- Number theory.
- Public-key cryptosystems (RSA, ElGamal). Signatures. Hashs. MACs.
- User authentication. Key management on symmetric schemes. Kerberos.
- User authentication. Key management on asymmetric schemes. Certificates. PKI. X509.3. PGP.
- Encrypted channels. SSL/TLS. SSH.
- Encrypted channels. IPSec.
- Software vulnerabilities. Buffer overflow. Viruses.
- Payment systems. Cards. E-coins. Voting.
- Mobile networks (GSM, CDMA). Wireless networks.
- Elliptic Curves.
- Group projects.
1. Introduction. Monoalphabetic ciphers. Polyalphabetic ciphers.
- Bibliography, online resources.
- Terms. Cryptography, cryptology, cryptoanalysis. Encryption, decryption. Encoding, decoding, coding. Error-correcting coding. Protocol, algorithm, scheme.
- Mathematical definition of encryption/decryption. Alphabet. Domains of messages, ciphers, keys. Cardinality of domains. Encryption and decryption functions.
- Functions: bijective (one-to-one), surjective (one-to-many), injective (many-to-one), trap-door, one-way.
- Types of cryptosystems: symmetric (block, stream), asymmetric (public-key, signature, key distribution). Characteristics and applications.
- Exhaustive search (brute force) attack.
- Monoalphabetic ciphers. Definition. Shift ciphers. Caesar cipher. Affine ciphers. Cardinality of key's domain. Frequency cryptoanalysis. Samples.
- Polyalphabetic ciphers. Viginer cipher. Cryptoanalysis. Period detection methods: Kasiski, autocorrelation, index coincidence [rtf pdf].
- Decrypt Viginer's cipher [zip].
2. Block ciphers. DES. GOST.
- Application of block ciphers.
- Feistel's scheme. DES, 3DES (in short).
- Galois fieds GF(2), GF(2^k). Polynomials. Operations with polynomials (+,*,mod).
3. Block ciphers. AES. Operation modes.
- AES (Rijndael) [pdf].
- AES polynomials, operations.
- Operation modes (ECB, CBC, OFB, CFB), initialization vector IV.
- Comparison of block ciphers. Benchmarks.
- Operations with polynomials in AES [zip].
4. Number theory.
- Modular arithmetics.
- Technique of exponentiation of big integers modulo a number (square and multiply).
- Euclid's algorithm, extended Euclid's algorithm. Inverse numbers.
- Euler's phi-function, Euler's theorem. Fermat's theorem.
- Chinese Remainder Theorem (CRT).
- Groups, rings, fields. Generators. Irreducible polynomials. Ring Z_n. Groups Z_p^*, Z_n^*.
- Prime numbers. Distribution of primes.
- Primality tests
- Fermat's Little Theorem - criteria of prime.
- Miller-Rabin polynomial probabilistic test.
- AKS2002 (Agrawal, Kayal and Saxena) polynomial deterministic test [downloaded zip].
- Primes of special forms. Sophie-Germain primes, their application.
- Generation of primes.
- About AKS2002.
- Original paper AKS2002: PRIMES is in P.
- Primality Tests on MathWorld.
- Number theory: seminar notes №1 [ps], seminar notes №2 [pdf doc].
5. Public-key cryptosystems (RSA, ElGamal). Signatures. Hashs. MACs.
- Overview of PKCs [ppt].
- Number-theoretic problems of most PKCs: factorization, Discrete Logarithm Problem (DLP).
- Basics of factorization methods.
- Key sizes of PKCs based on factorization and DLP.
- Selecting Cryptographic Key Sizes, Arjen K. Lenstra, Eric R. Verheul
- Public-key cryptosystems: RSA, ElGamal. ElGamal in elliptic curves. Application.
- Message Authentication Codes (MAC). HMAC. Application.
- Digital signatures schemes: RSA, ElGamal. Standards: DSA/DSS, ElGamal in elliptic curves. Application.
- The Evolution of Public Key Cryptography, Video Lecture
- Sign and verify a message and a signature. Factorize numbers. [zip].
6. User authentication. Key management on symmetric schemes. Kerberos.
- Passwords, hashing, salts.
- Web authentication. Cookie.
- Dos and Don’ts of Client Authentication on the Web [pdf].
- Slides on Web User Authentication [pdf].
- Cookie Central.
7. User authentication. Key management on asymmetric schemes. Certificates. PKI. X509.3. PGP.
- Public-key infrastucture (PKI).
- Certificate chains, X509.3.
- PGP. OpenPGP.
8. Encrypted channels. SSL/TLS. SSH.
9. Encrypted channels. IPSec.
- IP Security Protocol (IPSec).
- A Cryptographic Evaluation of IPsec, N. Ferguson and B. Schneier
10. Software vulnerabilities. Buffer overflow. Viruses.
- Software vulnerabilities, buffer overflow, viruses.
- Blended attack exploits, vulnerabilities and buffer-overflow techniques in computer viruses [pdf].
- An Undetectable Computer Virus [pdf].
- Smashing The Stack For Fun And Profit.
- Do a simple buffer overflow on a webserver [zip].
- The Quine Page (self-reproducing code)
- Peter Szor's site
- Virus Bulletin
- Underground Information Center
11. Payment systems. Cards. E-coins. Voting.
- Electronic Payment Systems
- Electronic Credit Card payments
- SET (see also in Cryptography and Network Security by W.Stallings)
- Size of Payments
- UEPS (see also in Applied Cryptography by B.Schneier)
- Electronic Cash (E-cash) (see also Yiannis S. Tsiounis Ph.D. Thesis, Electronic Payments: where do we go from here?)
- On-Line Cash Payments
- Untraceability, Double Spending
- Blind Signatures (RSA Blind Signature), Unexpandability
- Off-Line Cash Payments, E-Coins
- Schnorr's Digital Signature Scheme
- Owner, Coin Tracing
- Sample Payment Systems: eCash, NetCash
- Tamper Resistance
- Differential Power Analysis, Investigations of Power Analysis Attacks on Smartcards
12. Mobile networks (GSM, CDMA). Wireless networks.
- Terms: TDMA, CDMA, 3G, GSM, EDGE, WCDMA.
- Data transmission: TDMA (in GSM) vs CDMA.
- GSM history: GSM, GSM2, GSM3.
- GSM2 scheme. User authentication.
- GSM2 algorithms: authentication (A3), encryption (A5/1, A5/2, A5/3), key generation (A8). Flaws in A3, A5/1, A5/2.
- GSM [zip].
13. Elliptic curves.
- Elliptic curves.
- Additive group of points of ellipic curve.
- Operations in elliptic curve group: addition of two points, multiplication of point by number.
- Elliptic curves, russian, pp. 65-85 [pdf].