• Kerckhoff's Principle for cryptosystems. wiki ref
• Threat modeling.
• Game-based security definitions.

• Perfect secrecy and the one-time-pad.
• Security for encryption schemes: Ciphertext Only Attack (COA), Known Plaintext Attack (KPA), Chosen Plaintext Attack (CPA), Chosen Ciphertext Attack (CCA).
• Stream ciphers.
• Malleability.
• Definition of authentication. Message authentication code (MAC).
• Pseudorandom Functions (PRF); building a MAC from a PRF.
• The order of encryption and authentication, and the fact that encypt-then-MAC is both a good secure channel implementation, and a CCA-secure symmetric encryption scheme.
• The basics of AES.

• Merkle Damgard construction for hash function.
• Properties of cryptographic hash functions. Properties: Collision resistance. One-way functions (OWF). Currently we use SHA-256, SHA-3 to instantiate cryptographic hash functions. In the past we used MD5 (broken:collisions found) and SHA1 (cryptanalytic evidence suggest this will be broken soon, and is deprecated).
• PRFs and HMAC. These are keyed hash functions. We model these as indistinguishable from random functions for an adversary that does not know the key.
• Applications of hashing:
  • Manifests (or hash-and-MAC)
  • Password hashing
  • Hash proofs of work. (Used in bitcoin! This specific scheme we talk about in class (ie. to find a nonce n such that H(n,message)=00000000000........ was devised as part of hashcash)
• The birthday paradox and the difference between collision resistance and target-collision resistance (or one-wayness) for random functions. OR: Why does SHA-256 provide only 128-bits of security against collision attacks.

• PK Encryption
• Digital Signatures
• The basics of RSA encryption and RSA signatures. Why textbook RSA is not actually a secure encryption or digital signature. Why we need encryption standards like PKCS 1.5 and OEAP.
• The hash-and-sign paradigm for digital signatures.
• Key exchange protocols:
  • The basics TLS handshake (i.e the key exchange protocol). See here. The gory details are here.
  • Diffie Helman Key Exchange and Perfect Forward Secrecy (PFS). This article has a nice explanation, and talks about how SSL is moving towards using DH Key exchange, instead of the encryption-based protocol described above.
  • Why classic Diffie Helman is not secure against a ``active'' man-in-the-middle adversary that tampers/alters the messages sent between Alice and Bob.
  • Key exchange protocols that are based on Diffie Helman and are secure against active adversaries. My source for this is Hugo Krawcyzk's excellent slides on SIGMa protocols. These protocols are used for IKE (internet key exchange) for IPsec.

• Public Key Infrastructure and the web PKI. The principle of least privilege. Certificate Authorities (CAs). The difference between CA certificates and EE certificates. Attacks on CAs and probles with the web's PKI.
  • For instructions on how look at the preinstalled certificates on your browser, see here
  • The DigiNotar attack: EFF report.
  • Paper analyzing the web PKI.
  • Color map of certificate authorities from 2010.
  • An attack where TLS certs accidentally issued with CA permissions were then used it to make a rogue certificates. Here is a real world example where a *.google.com certificate was created.

• Ethan's presentation on the history of responsible disclosure and full disclosure: slides.
• BU researchers find vulnerability in yelp and airbnb, leading to the development of responsible disclosure policies for these sites.
• Computer Fraud and Abuse Act CFAA.
• List of websites with bug bounties: bugcrowd.com.

• The topics we will cover include: image tag security issues, same-origin policy, insecurities that arise from mixing http and https content on a page, security issues relating to session management with cookies, SQL injection, cross site scripting (XSS), cross site request forgery (CSRF).
• We discuss SQL injection using this excellent techtip from Steve Freidl.
• These slides from CS155 at Stanford provide an overview of the basic web security model.
• These slides from CS155 at Stanford provide an overview of web vulnerabilities.

• My slides will be posted on Piazza.
• We played with traceroute during lecture. If you have never done this before, log into csa2 and run the command traceroute example.com and see what happens; (obviously replacing example.com with whatever destination you like). How many hops does it take to get to a destination in India? A destination in the US? A destination in Singapore? A destination in South Africa?
• Here is a decent explanation of how traceroute works from wikipedia
• We talked about port numbers. Here is a list of port number to application allocations from IANA.
• We talked about NATs (Network Address Translation). Here is a reference NATs.
• A tutorial on IPsec in detail, from Steve Friedl's illustrated guide.
• In lecture, we'll try to think about why SSL (that is, "secure" TCP) caught on so much more effectively than IPsec ("secure IP").

DDoS and Amplification attacks (?)

• Slides from Dan Boneh in 2007, on DoS attacks of various flavors: ppt.
• Classic (1997!) slides about the smurf attack.
• The spring 2013 DDoS attack on Spamhaus that used DNS amplication.
  • The DDoS attack on spamhaus: Blog post from cloudflare
  • Smurf attacks and DNS amplification, from cloudflare
  • New York Times
  • List of open resolvers here .
• The winter 2014 DDoS attack that used NTP: cloudflare blog.

DNS security (April 17)

Core resources. Please review the below:

• A gentle introduction to DNS is here http://www.isoc.org/briefings/016/index.shtml.
• A list of the DNS root zones is here: http://www.root-servers.org/
• A very interesting FAQ about root zone operations, (e.g. why there is diversity in the code used to operate the root zone servers), by Daniel Karrenberg, an operator of the K-root.
• We discuss Kaminsky's famous attack on DNS using this UnixWiz article. See also this figure explaining the Kaminsky attack.
• We discuss DNSSEC using this presentation from Olaf M. Kolkman in 2004. This slide deck from Paul Wouters at Blackhat'09 is an additional resource, but you need not review this one in great detail.
• You can run you own DNS queries by logging into csa2.bu.edu and running dig +trace example.com, obviously replacing example.com with whatever domain you want to look at. Dig can let you look at pretty much anything in the DNS; type man dig on csa2 to see some options, or find a dig tutorial online. If you want to look at DNSSEC deployments using dig, this tutorial is a good place to start.

• DNS and censorship - the china I-root incident. renesys blogpost 1 and blogpost 2.
• DNSSEC deployment at the root zone. Talk at NANOG'48
• Track the progress of DNSSEC deployment with UCLA's security spider.
• Research: Here is an interesting research paper on the security risks associated with DNSSEC and NSEC Bau-Mitchell'10. Another nice paper on DNS cache poisoning: A hitchhikers guide to DNS cache posioning. See also Haya Shulman's DNS security research here, especially her IP fragmentation attack.

BGP security (April 29-May 1)

We discussed BGP security, the RPKI, Secure BGP, and Secure Origin BGP.

• This survey is a good source of information about BGP security.
• This talk I gave a few months ago provides a decent overview of BGP security issues.

Final poster session: Web security audits! (May 2)

Done! Thanks for a great semester and enjoy your summer!