6.857 Lectures and Handouts - Fall 2003

Below are links to material relevant to our lectures. Students are responsible for knowing the contents of the assigned reading, the handouts, the lecture notes, and any other items that are starred. In contrast, related readings are provided for your own interest, and are optional.

To suggest the addition of a hyperlink or paper, email 6.857-staff@mit.edu.

Lecture 01 (Th 9/04/2003): Introduction

• Handouts:
  • Handout 01: (Course information) [PDF, PS]
  • Handout 02: ("Why Johnny Can't Encrypt"/Whitten) [PDF, PS, HTML]
  • Handout 03: (Cookies/Fu): [PDF, PS]
  • Handout 04: ("Analysis of an Electronic Voting System"): [PDF]

Lecture 02 (Tu 9/9/2003): User Authentication Overview, Passwords, Hashing

• Handouts: None today
• Reading: Section 10.3 of the textbook
• Lecture Notes:
  • Lecture 02 notes from Fall 2002: [PDF, PS]
  • Lecture 04 notes from Fall 2001: [PDF, PS]
• Related (Optional) Reading:
  • Menezes et al. Handbook of Applied Cryptography, pages 321--327. [hash functions and MACs]
  • "Risks of Passwords" by Peter Neumann. Page 126, Communications of the ACM, April 1994, Vol 37, No. 4. [MIT-only pdf]
  • "User Authentication Scheme Not Requiring Secrecy in the Computer" Arthur Evans, Jr., William Kantrowitz, and Edwin Weiss. pages 437--442, Communications of the ACM, August 1974, Vol 17, Number 8. [MIT-only pdf]
  • FIPS Standard for Password Usage
• Related (Optional) Links:
  • Web Cookies: Not Just a Privacy Risk [HTML, MIT-only PDF]

Lecture 03 (Th 9/11/2003): Hash Functions

• Handouts:
  • Handout 05: Problem Set 1 [PDF, PS]
• Related (Optional) Reading:
  • SHA-1
  • Collision in part of MD5 (the compression function)
  • Tripwire
  • HMAC
  • A file system using Merkle's hash trees for integrity

Lecture 04 (Tu 9/16/2003): More Hashing Applications, Unconditional Security

• Handouts:
  • Handout 06: Lamport's One-Time Passwords [MIT-only PDF]
• Reading: Chapter 4 of the textbook
• Lecture Notes: Unconditional Security [PDF, PS]
• Related (Optional) Reading:
  • NSA VENONA Project
  • Hash cash (Adam Back)
  • One-time passwords and an implementation

Lecture 05 (Th 9/18/2003): Unconditional Security

• Handouts:
  • Handout 07: Problem Set 2 [PDF, PS]
    • tar file of two-time pad files
    • zip file of two-time pad files
• Related (Optional) Links:
  • A worked one-time-pad decryption (by your TA's)
  • RSA Laboratories | Cryptography FAQ | What is a stream cipher? (Contains information on one-time pads)
  • National Security Agency's pages on Venona (successful decryption of one-time pads that were reused.)
  • One-Time-Pad FAQ (by Marcus J. Ranum; excellent photograph!)
  • RFC 1750: Randomness Recommendations for Security

Lecture 06 (Tu 9/23/2003): Block ciphers, modes of operation

• Handouts:
  • Handout 08: Problem Set 1 Solutions [PDF, PS]
• Reading: Chapter 5 of the textbook
• Lecture Notes:
  • Lecture 11 notes from Fall 2001: [PDF, PS]
  • Lecture 12 notes from Fall 2001: [PDF, PS]
• Related (Optional) Reading:
  • AES/Rijndael
  • Slides on the relative speed of hardware implementations of AES finalists and DES, 3DES
  • NIST: Modes of Operation for Block Ciphers

Lecture 07 (Th 9/25/2003): Intro to Number-Theoretic Crypto

• Handouts:
  • Handout 09: Problem Set 3 [PDF, PS]
• Reading:
  • Chapters 1 and 8 of the textbook
  • Notes on number theory (very rough draft) [PDF]

Lecture 08 (Tu 9/30/2003): GCD and Modular Inverses, Generators, Discrete Logs, Diffie-Hellman Key Exchange, El Gamal Encryption and Signatures

• Handouts:
  • Handout 10: Problem Set 2 Solutions [PDF, PS]
• Reading: Chapter 7 of the textbook
• Related (Optional) Reading:
  • Whitfield Diffie and Martin Hellman, New Directions in Cryptography.

Lecture 09 (Th 10/2/2003): RSA, Chosen-Ciphertext Attacks, RSA-OAEP

• Handouts:
  • Handout 11: Problem Set 4 [PDF, PS]
• Reading:
  • Sections 10.1 and 10.2 of the textbook
  • For PS4: Paillier and Pointcheval, Efficient Public-Key Cryptosystems Provably Secure Against Active Adversaries
  • For PS4: Know Your Enemy: Sebek2
  • R. L. Rivest, A. Shamir, L. Adleman, Method for Obtaining Digital Signatures and Public-Key Cryptosystems (1978)
  • Cramer and Shoup, A Practical Public Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Attack
• Related (Optional) Reading:
  • History and multiple drafts of Ralph Merkle's paper, Secure Communications over Insecure Channels, which was finally printed in the Communications of the ACM of April 1978 (pp. 294-299), but which was written in 1974.
  • OAEP
  • RSA Labs OAEP FAQ

Lecture 10 (Tu 10/7/2003): Cramer-Shoup, Commitment Schemes

• Handouts:
  • Handout 12: Problem Set 3 Solutions [PDF, PS] and Java code
• Reading: Section 13.2 of the textbook

Lecture 11 (Th 10/9/2003): Quiz 1

Quiz 1 today during lecture

• Prep Materials:
  • Quiz #1 from 2002 [PDF]
  • Quiz #1 Solutions [PDF, PS]

Lecture 12 (Tu 10/14/2003): Key Agreement

• Handouts:
  • Handout 13: Quiz 1 Solutions [PDF, PS]
• Reading:
  • Handbook of Applied Cryptography, Chapter 12 (Key Establishment Protocols)
  • Section 10.7 of the textbook
• Related (Optional) Reading:
  • Protocols for Authentication and Key Establishment (book), by Colin Boyd and Anish Mathuria
  • Towards Formal Analysis of Security Protocols, Wenbo Mao and Colin Boyd (1993).
  • Classification of Cryptographic Techniques in Authentication Protocols, Wenbo Mao and Colin Boyd (1994).

Lecture 13 (Th 10/16/2003): SSL, IBS, IBE and Secret Sharing

• Reading: Section 12.6 of the textbook
• Related (Optional) Reading:
  • Remote Timing Attacks Are Practical, D. Boneh and D. Brumley (Usenix security 2003) [PDF, PS]
  • Analysis of the SSL 3.0 protocol, D. Wagner and B. Schneier (Usenix Workshop on electronic commerce, 1996) [website] [revised PDF]
  • Identity-Based Encryption [website] [PDF]

Lecture 14 (Tu 10/21/2003): Secret Sharing

• Handouts:
  • Handout 14: Problem Set 4 Solutions [PDF, PS]
• Related (Optional) Reading:
  • Shamir: How to Share A Secret
  • Krawczyk: Secret Sharing Made Short

Lecture 15 (Th 10/23/2003): Zero-Knowledge

• Reading: Section 13.3 of the textbook
• Handouts:
  • Handout 15: Take-Home Midterm [PDF, PS]

Lecture 16 (Tu 10/28/2003): Watermarking and Fingerprinting (Guest Lecture)

• Related (Optional) Reading:
  • Collusion-Secure Fingerprinting for Digital Data, by Dan Boneh and James Shaw

Lecture 17 (Th 10/30/2003): Tamper Resistance and Disk Forensics

• Handouts:
  • Handout 16: Problem Set 5 [PDF, PS]
• Related (Optional) Reading:
  • Tamper Resistance --- A Cautionary Note, by Ross Andersona nd Markus Kuhn.
  • Introduction to Differential Power Analysis and Related Attacks, by Paul Kocher, Joshua Jaffe, and Benjamin Jun
  • Remembrance of Data Passed: A Study of Disk Sanitization Practices, Simson Garfinkel and Abhi Shelat.

Lecture 18 (Tu 11/4/2003): Physical Security: Physical Uncloneable Functions, TEMPEST

• Reading:
  • Soft Tempest, by Markus Kuhn and Ross Anderson
  • Optical Tempest and FAQ, by Markus Kuhn
  • Silicon PUFs, by Srini Devadas et al.
  • Controlled PUFs, by Srini Devadas et al.
  • Physical One-Way Functions, by Pappu et al.
• Related (Optional) Reading:
  • PowerPoint slides from guest lecture by Srini Devadas [PDF] [PDF 6up]

Lecture 19 (Th 11/6/2003): Self-Referential Programs, Viruses, Buffer Overflow Attacks

• Handouts:
  • Handout 17: Take-Home Midterm Solutions [PDF, PS]
  • Handout 18: Problem Set 6 [PDF, PS]
• Reading:
  • Slammed! (Story of Slammer worm)
  • Phrack Vol. 7, No. 49: "Smashing the Stack"
  • "StackGuard," by Cowan et al [PDF]
  • An undetectable computer virus [PDF]
  • How to 0wn the Internet in Your Spare Time

Lecture 20 (Th 11/13/2003): More on Viruses

• Handouts:
  • Handout 17: Midterm solutions [PDF, PS]
  • Handout 19: Problem Set 5 Solutions [PDF, PS]
• Reading:
  • David Chess and Steve White, "An Undetectable Computer Virus"
  • Ken Thompson's "Reflections on Trusting Trust" (CACM 1984 August, vol 27, no 8, pp 761--763.
• Related (Optional) Reading:
  • The Future of Internet Worms, Jose Nazario et all

Lecture 21 (Tu 11/18/2003): Trusted Computing (NGSCB aka Palladium; TCPA)

• Lecture Notes:
  • Lecture 12 notes from Fall 2002: [PDF, PS]
• Reading:
  • Flexible OS Support and Applications for Trusted Computing, by Tal Garfinkel, Mendel Rosenblum and Dan Boneh (2003)
  • TCPA slides [PPT, PDF] by Joe Pato of HP Labs (MIT distribution only)
  • Palladium slides [PPT, PDF] by Brain LaMacchia of Microsoft (MIT distribution only)
• Related (Optional) Reading:
  • Trusted Computing Group Website
  • Microsoft's Palladium FAQ
  • Ross Anderson's TCPA/Palladium FAQ

Lecture 22 (Th 11/20/2003): Trusted Computing, Java Security, Biometrics

• Handouts:
  • Handout 20: Problem Set 6 Solutions [PDF, PS]
• Reading:
  • Lecture 20 notes from Fall 2001 --- Java Security: [PDF, PS]
  • Lecture 21 notes from Fall 2001 --- Java Security and Biometrics: [PDF, PS]
  • Gummy finger slides
• Recommended (Optional) Reading:
  • Technology Assessment: Using Biometrics in Border security
  • Cryptogram from August 1998 that mentions biometrics
  • On the Individuality of Fingerprints

Lecture 23 (Tu 11/26/2003): Quiz 2, concluding remarks

Quiz 2 during lecture today

Lecture 24 (Tu 12/02/2003): Talks

Lecture 25 (Th 12/04/2003): Talks

Lecture 26 (Tu 12/09/2003): Talks