1.1 Lab on encryption using binary/byte addition
1.2 Encryption using binary Exclusive-OR (XOR)
1.3 Triple DES with CBC mode and Weak DES keys
2.1 Lab on RSA Encryption and Factorization Attacks
2.2 Attack on RSA encryption with short RSA modulus
3.1 Lab on hash generation and sensitivity of hash functions to plaintext modifications
4.1 Lab on Digital Signature Visualization
4.2 Lab on RSA Signature
4.3 Lab on Attack on Digital Signature/Hash Collision
a. Programming Lab on Encryption Using Classical Techniques
In this project we will develop a program to encrypt plaintext text given a keyword. The plaintext will be encrypted by Playfair cipher and the cipher text is displayed for a user. Playfair Cipher (description taken from William Stallings “Cryptography and Network Security, Principles and Practice) is the best-known multiple letter encryption cipher, which treats diagrams in the plaintext as single units and translates these units into cipher text diagrams. (This cipher was actually invented by British scientist Sir Charles Wheatstone in 1854, but it bears the name of his friend Baron Playfair of St. Andrews, who championed the cipher at the British foreign office.)
View Lab: pdf
b. Programming Lab on Frequency Analysis
This lab will introduce students to frequency analysis, a method used to decode ciphertext by studying the frequency of letters.
View Lab: pdf
c. Programming Lab on Testing Different Modes in Symmetric Ciphers
This lab introduces students to various modes of operation in symmetric key cryptography, such as electronic cookbook (ECB), cipher-block chaining (CBC) and cipher feedback (CFB). Students must implement a symmetric key cipher, such as Data Encryption Standard (DES), triple DES, or Advanced Encryption Standard (AES) using several different modes of operation, and then investigate the properties of pattern preservation and error propagation for each mode.
View Lab: pdf
d. Programming Lab on Short Message RSA Attacks and Padding
This lab will introduce students to attacks against the RSA encryption algorithm, and mechanisms that can be implemented to guard against such attacks. Students will be asked to implement both padding-based and timing-based attacks on the RSA algorithm.
View Lab: pdf
e. Programming Lab on RSA Timing Attacks
A timing attack is an attack which cleverly uses the fourth dimension, time. If an algorithm is not specifically designed to thwart this attack, then an attacker can observe the required amount of time for a calculation to be done and monitor the differences in calculation times. For example, the calculation of converting a “0” in plain text to cipher text versus converting a “1” in plain text to cipher text may require less time. This measured amount of time can be used to rebuild the key or figure out the plain text.
View Lab: pdf
f. Programming Lab on Hash Function
This lab will introduce students to hash functions and how they provide for message integrity. Students will be asked to use hashing to detect if an ecrypted message has been tampered with. Students will also need to show that this integrity check can be bypassed by tampering with both the ciphertext and the hashcode.
View Lab: pdf
g. Writing a Simple Certificate Authority
Certificates, or to be more specific, public key certificates, provide a mechanism that allows a third party, or issuer, to vouch for the fact that a particular public key is linked with a particular owner, or subject. Every certificate has a private key associated with it, and a chain of certificates is a list of certificates where each certificate other than the first one and the last one have had its private key used to sign the next certificate after it. The first certificate, the root certificate, is normally self-signed; you have to accept it as trusted for the certificate chain to be valid. The last certificate, or the end entity certificate, simply provides you with a public key you are interested in, which, assuming you accept the root certificate, you can regard as authentic. The entity responsible for issuing the certificate is referred to as a certificate authority, or more commonly, CA.
View Lab: pdf
h. Programming Lab on Digital Signature
Generate keys and a digital signature for data using the private key and to export the public key and the signature to files. Verify a digital signature by importing a public key and a signature that is alleged to be the signature of a specified data file and to verify the authenticity of the signature.
View Lab: pdf
Crypto Case 1: How Do You Secure BlackBerry Devices?
Crypto Case 2: Do You Trust Others in Virtual Environment?
Crypto Case 3: Ensure the validity of Forensic Evidence by Using a Hash Function
Crypto Case 4: How Do You Secure Patient Data?
Crypto Case 5: Is SSL/TLS Enough to Secure E-commerce?
Attacking Security Systems (600.412)This course serves as an introduction to how security systems are broken in the real world. Topics include software flaws and reverse-engineering, protocol analysis and the misuse of cryptography, side channel attacks, and attacks on physical security measures such as locks and tamper-resistant devices.
Network Security (600.324/424)This course focuses on security in computer systems and networks. The course covers selected areas in network security, with particular focus on relatively recent research topics. We examine (in no particular order) critical network security services such as authentication and access control, routing, firewalls, domain naming service, traffic monitoring and intrusion detection, malware propagation and detection, secure auditing and searchable encryption, IP traceback schemes, Java Security, Web security and privacy, among others. Where appropriate, we examine threats and vulnerabilities to specific architectures and protocols.
Cryptography and Network Security (600.342/442)This course focuses on algorithms and protocols for secure network communication. Topics include cryptographic algorithms (DES, Diffie-Hellman, RSA), authentication, key management, secure networking, certification, trust management, and secure electronic commerce.
Security and Privacy in Computing (600.343/443)Topics include computer security, network security, basic cryptography, system design methodology, and privacy.
Selected Topics in Network Security (600.624)This course focuses on selected research topics in communications security. The course is structured as a research seminar where students present research papers to their peers. Topics may include side-channel attacks, searches on encrypted data, broadcast encryption, private information retrieval, covert channels and anonymous communication, information hiding, among others.
Computer and Network Forensics (600.625)This course exposes students to a myriad of fundamental concepts and techniques for recovering and inferring information in computer systems and networks. Topics include (but are not limited to) file system forensics, kernel-level rootkits and associated challenges, reconstructing malware evolution and dynamics, analysis of anonymization and privacy preserving techniques, advanced network traceback, traffic classification, biometrics and digital evidence, data integrity and audit trails, secure remote logging, and system call introspection.
Special Topics in Theoretical Cryptography (600.641)In this seminar, we will explore the foundations of modern cryptography. We will study how to formalize the security guarantee of a protocol and cover techniques for proving that a protocol meets a claimed guarantee. Some included topics will be zero-knowledge proofs, multiparty computation, program obfuscation, and anonymous authentication. An emphasis will be placed on major past results, recent progress and current open problems.
Advanced Cryptographic Protocols (600.642)This course will focus on advanced cryptographic protocols with an emphasis on open research problems.
Advanced Topics in Computer Security (600.643)Topics will vary from year to year, but will focus mainly on network perimeter protection, host-level protection, authentication technologies, intellectual property protection, formal analysis techniques, intrusion detection and similarly advanced subjects. Emphasis in this course is on understanding how security issues impact real systems, while maintaining an appreciation for grounding the work in fundamental science.
Designing Security Systems (650.412)This course serves as an overview of some techniques used in the design of secure systems. The bulk of the course will focus on real-life case studies; we will examine attacks on deployed systems and then investigate how these vulnerabilities have been subsequently addressed. Additionally, the course will examine the practical advantages and shortcomings of several notions of provable security.
Researching Security Systems (650.443)This course provides advanced students the opportunity to do closely directed research in small groups on selected topics in computer security. .Students will learn how to conduct literature searches, choose suitable topics for research, analyze existing systems, construct new systems, develop metrics and models to quantify their improvements, and present their results in both written and oral forums.