Esecurity: secure internet & e-cash

Corresponding entry in Aachen Campus, Bonn Basis Media Informatics, Bonn Basis CS-Master.

Responsible

Prof. Dr. Joachim von zur Gathen

Lecture

Michael Nüsken

Tutorial

Raoul Blankertz

Time & Place

Tuesday, 13³⁰-15⁰⁰, b-it bitmax.
Wednesday, 13³⁰-15⁰⁰, b-it bitmax.
Tutorial: Tuesday, 15¹⁵-16⁴⁵, b-it bitmax.

First meeting: Tuesday, 03 April 2012 at 13³⁰, b-it bitmax.

All times subject to agreement in class.

Exam

Exam: 27 July 2012, 10⁰⁰-13⁰⁰, b-it seminar room 2.1.

Post-exam meeting: 31 July 2012, 14⁰⁰, b-it cosec seminar room 1.25.

Notes

The screen notes (PDF 23.3MB) contain all handwritten stuff (last updated 11 July 2012, 17:22).

Exercises

Exercise 1 (PDF, last updated 04 April 2012, 16:54).
Exercise 2 (PDF, last updated 11 April 2012, 21:57).
Exercise 3 (PDF, last updated 18 April 2012, 18:32).
Exercise 4 (PDF, last updated 25 April 2012, 18:47).
Exercise 5 (PDF, last updated 09 May 2012, 16:10).
Exercise 6 (PDF, last updated 16 May 2012, 19:47).
Exercise 7 (PDF, last updated 23 May 2012, 19:57).
Exercise 8 (PDF, last updated 06 June 2012, 16:06).
Exercise 9 (PDF, last updated 13 June 2012, 17:14).
Exercise 10 (PDF, last updated 20 June 2012, 17:24).
Exercise 11 (PDF, last updated 27 June 2012, 22:29).
Exercise 12 (PDF, last updated 04 July 2012, 20:24).

Allocation

4+2 SWS, 8 credits. Optionally, 3+2 SWS, 6 credits.

Successful completion of the course yields 8 credit points. For students who only want 6 credit points, a breakpoint at about 3/4 of the teaching time will be defined, and only the course material up to that point will be relevant for their exams and grades.

Media Informatics: Computer and Communication Technology.
Recommendation for University of Bonn - Computer Science: A or A1, respectively.

Prerequisites

Basic knowledge in cryptography is needed, as for example the course Cryptography held in the previous winter. Compare our programme.

This course is about various aspects of security in the internet. In the first part we deal with secure connections, whereas the second part considers electronic voting schemes involving further tasks.

Who can read my email?
How do I know that eBay is eBay, or amazon is amazon?
What is the public key of Angela Merkel? Where do I get it and how do I verify that it's really hers?
...

In the internet a large variety of protocols ("chatting programs") are in use to make this or that `secure'. VPN, IPsec, SSL, PKI, PGP are just a few tokens that need explanations. We will try to understand a little of that and how things are used and made available.

The application issue this year deals with electronic cash. There are a variety of proposals about how to realize a counter part to real coins (cash!) in the internet. However, most of the approaches that are used in practive are account based. But then transactions are not anonymous. What we are heading for in this chapter are systems that are as anonymous as real coins are. In particular, they must be account free since otherwise the account manager sees all transactions. Thus a certain bit string may be a valid coin. The problem with bit strings as compared to real coins is: they are fairly easy to copy. But one should not be able to just duplicate coins because that would render that kind of coin worthless. There are solutions to this double spending problem. Further issues then arise: real coins can be transferred many times from owner to owner, in case of extortion we may want a tracing option, ...

Literature

J. Klensin (Editor) (2008). Simple Mail Transfer Protocol. RFC 5321.
Phong Nguyen (2004). Can We Trust Cryptographic Software? Cryptographic Flaws in GNU Privacy Guard v1.2.3. EUROCRYPT 2004.
N. Freed (Editor) (1995). SMTP service Extention. RFC 1869.
David Ross (2002-2011). PGP Public Key Servers.
Russ Cox (2008). Lessons from the Debian/OpenSSL Fiasco.
Debian (2008). Debian Security Advisory: DSA-1571-1 openssl -- predictable random number generator.
H. D. Moore (2008). The bug.
Thorsten Kleinjung et al. (2010). Factorization of a 768-bit RSA modulus.
Niels Ferguson and Bruce Schneier (2003). A Cryptographic Evaluation of IPsec.
C. Kaufman et al. (2010). Internet Key Exchange Protocol Version 2 (IKEv2). RFC 5996.
IETF (2005-2010). IPsec incl. IKEv2:
- RFC4301 Security Architecture for the Internet Protocol,
- RFC4302 IP Authentication Header,
- RFC4303 IP Encapsulating Security Payload (ESP),
- RFC4304 Extended Sequence Number (ESN) Addendum to IPsec Domain of Interpretation (DOI) for Internet Security Association and Key Management Protocol (ISAKMP),
- RFC4835 Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH),
- RFC5996 Internet Key Exchange Protocol Version 2 (IKEv2),
- RFC4307 Cryptographic Algorithms for Use in the Internet Key Exchange Version 2 (IKEv2),
- RFC4308 Cryptographic Suites for IPsec,
- RFC4309 Using Advanced Encryption Standard (AES) CCM Mode with IPsec Encapsulating Security Payload (ESP).
IETF (2006). SSH.
- The Secure Shell (SSH) Transport Layer Protocol RFC4253
- The Secure Shell (SSH) Protocol Assigned Numbers RFC4250
- The Secure Shell (SSH) Protocol Architecture RFC4251
- The Secure Shell (SSH) Authentication Protocol RFC4252
- The Secure Shell (SSH) Connection Protocol RFC4254
IETF (2004-2011). TLS/SSL.
- The Transport Layer Security (TLS) Protocol Version 1.2 RFC5246
- Transport Layer Security Protocol Compression Methods RFC3749
- Transport Layer Security (TLS) Extensions: Extension Definitions RFC6066
- Using OpenPGP Keys for Transport Layer Security (TLS) Authentication RFC6091
- Pre-Shared Key Ciphersuites for Transport Layer Security (TLS) RFC4279
- Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) RFC4492

Gregory V. Bard (2004). Vulnerability of SSL to Chosen-Plaintext Attack.
P. Rogaway & D. Wagner (2003). A Critique of CCM.
Christopher Soghoian & Sid Stamm (2010). Certified Lies: Detecting and Defeating Government Interception Attacks Against SSL.
M. Stevens, et al. (2009). Short Chosen-Prefix Collisions for MD5 and the Creation of a Rogue CA Certificate.

Mailinglist

We will put each member on the mailing list . You can also subscribe yourself. The list is intented for all participants of the course as a platform for discussions around the topic. Furthermore, announcements regarding the course are made here.