MAT 4906/MAD 6209 - Applying Mathematics to Information Security

The course explains mathematical techniques that are of interest in the context of information security. In addition to cryptographic protocols, the course discusses techniques to model access control questions and to describe policies formally. After completion of the course, you should be able to name and explain basic terms from information security. You should be able to describe different approaches to model security along with benefits and limits of these approaches. You should be able to give examples of how mathematical techniques are applied in the design and analysis of security-critical systems. More information on the course is available in the preliminary syllabus.
So far the following topics have been addressed in class, where [Bish03] stands for the book Computer Security: Art & Science (Matt Bishop, Addison-Wesley, 2003):

May 14, 2007: Basic components of computer security
Literature: M. Bishop, Computer Security: Art and Science, Ch. 1
May 16, 2007: Signing with RSA: RSA-FDH
Literature: J.-S. Coron: On the exact security of Full Domain Hash
May 18, 2007: Signing with RSA: RSA-FDH
Literature: J.-S. Coron: On the exact security of Full Domain Hash
May 21, 2007: no class
May 23, 2007: no class
May 25, 2007: Signing with RSA: RSA-FDH and RSA-PSS
Literature: J.-S. Coron: On the exact security of Full Domain Hash, Ch. 8.1 of PKCS #1 v.2.1: RSA Cryptography Standard
May 30, 2007: Certificates: X.509 and PGP
Literature: [Bish03, Ch. 10.4], M. Stevens et al.: Target Collisions for MD5 and Colliding X.509 Certificates for Different Identities
Jun 1, 2007: Access Control Matrix
Literature: [Bish03, Ch. 2]
Jun 4-8, 2007: Bell-LaPadula Model
Literature: [Bish03, Ch. 5.2], D. E. Bell: Looking Back at the Bell-La Padula Model
Jun 11-13, 2007: Using Passwords for authentication
Literature: [Bish03, Ch. 12]
Jun 15, 2007: A password-authenticated 2-party key exchange: SPEKE
Literature: M. Zhang: Analysis of the SPEKE Password-Authenticated Key Exchange Protocol
Jun 18, 2007: using fingerprints for authentication
Jun 22, 2007: no class
Jun 25, 2007: Classical cryptographic key exchange and authentication: protocols of Needham-Schroeder and Denning-Sacco
Literature: [Bish03, Ch. 10.2.1]
Jun 27, 2007: Classical cryptographic key exchange and authentication: Otway-Rees and Kerberos protocols
Literature: [Bish03, Ch. 10.2.1, Ch. 10.2.2]
Jun 29, 2007: Key Escrow
Literature: [Bish03, Ch. 10.5.1.1, Ch. 10.5.1.2]
Jul 2, 2007: KEA, Fair Diffie-Hellman
Literature: SKIPJACK and KEA Algorithm Specifications, Ç.K. Koç: Escrowed Encryption Systems
Jul 6, 2007: Merkle Signature Scheme
Literature: J. Buchmann et al.: CMSS - An Improved Merkle Signature Scheme, D. Naor et et al.: One-Time Signatures Revisited: Have They Become Practical?
Jul 9, 2007: Winternitz one-time signature scheme
Literature: J. Buchmann et al.: CMSS - An Improved Merkle Signature Scheme
Jul 11, 2007: Biba integrity model and Chinese Wall model
Literature: [Bish03, Ch. 6.2, Ch. 7.1.1]
Jul 13, 2007: Algebraic Modeling of Privacy Policies
Literature: M. Backes et al.: An Algebra for Composing Enterprise Privacy Policies
Jul 16, 2007: Security analysis of KEA
Literature: K. Lauter and A. Mityagin: Security Analysis of KEA Authenticated Key Exchange Protocol
Jul 18, 2007: Message Authentication Codes
Literature: M. Bellare et al.: Keying Hash Functions For Message Authentication, M. Bellare et al.: The Security of the Cipher Block Chaining Message Authentication Code, Wikipedia article on CBC-MAC
Jul 20, 2007: NMAC and HMAC
Literature: M. Bellare et al.: Keying Hash Functions For Message Authentication
Jul 23, 2007: VSH
Literature: S. Contini et al.: VSH, an Efficient and Provable Collision Resistant Hash Function
Jul 25, 2007: Punchscan
Literature: Punchscan website
Jul 27, 2007: Bingo Voting
Literature: J.-M. Bohli et al.: Bingo Voting: Secure and coercion-free voting using a trusted random number generator
Jul 30, 2007: Bingo Voting
Literature: J.-M. Bohli et al.: Bingo Voting: Secure and coercion-free voting using a trusted random number generator
Aug 1, 2007: Chaum mixes
Literature: D. Chaum: Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms
Aug 3, 2007: Ring signatures
Literature: R. L. Rivest et al.: How to Leak a Secret
Aug 6, 2007: ThreeBallot Voting
Literature: R. L. Rivest: The ThreeBallot Voting System
Aug 8, 2007: Group signatures
Literature: M. Bellare et al.: Foundations of Group Signatures: Formal Definitions, Simplified Requirements, and a Construction Based on General Assumptions

I would like to thank all course participants for their great commitment and continuous support of the course!

If you have comments or questions, or if you are interested in dwelling deeper into one of the subjects of the course, please contact me (see my homepage for email, phone number, etc.).

Aug 8, 2007