

Applied Cryptography 
CSCI 531, Spring 2013


General Information


Time 
: 
MW 9:30am  10:50am 
Location 
: 
OHE 120 (NEW) 
Instructor 
: 
Bill Cheng
(for office hours, please see
instructor's web page),
Email:
<bill.cheng@usc.edu>.
(Please do not send HTMLonly emails. They will not be read.)

TA 
: 
(TBD)

Grader 
: 
Priyanka Bhalerao,
Email:
<pbhalera@usc.edu>.
(The grader will hold office hours the week after the announcement of each assignment's grades.)

Midterm Exam 
: 
during class, Wed, 3/13/2013 (firm) 
Final Exam 
: 
8am10am, Fri, 5/10/2013 (firm)



Class Resources




News

(in reversed chronological order)
 5/1/2013: The final exam will be closed book,
closed notes, and closed everything, except
for a single "crib sheet / cheat sheet". (You can write or print whatever
you want on it on both sides of the cheat sheet. Magnifying glasses are
not allowed, so don't print too small! You will be required
to turn in the cheat sheet together with the exam paper.)
Also, no calculators, cell phones, or any electronic gadgets are allowed.
Please bring a photo ID. Your ID will be collected at the beginning
of the exam and will be returned to you when you turn in your
exam. There will be assigned seating.
The final exam will cover everything from math background for AES
(slide 1 of lecture 14)
to the end of the last lecture.
Here is a quick summary of the topics (not all topics covered are listed):
 block ciphers
 AES
 math for Rijndael
 xtime()
 multiplication in GF(2^{8})
 multiplicative inverse in GF(2^{8})
 extended Euclidean algorithm
 table method
 multiplication of polynomials with coefficients in
GF(2^{8})
 components and structure of Rijndael
 SubBytes() and InvSubBytes()
 ShiftRows() and InvShiftRows()
 MixColumns() and InvMixColumns()
 AddRoundKey()
 key expansion
 equivalent inverse cipher
 security of Rijndael
 Generating Primes
 math background
 quadratic residue
 square root
 Legendre and Jacobi symbols
 pseudosquares
 Blum integers
 integer factorization
 Pollard's rho factoring algorithm
 primality proving algorithms
 using the factorization of n1
 Pocklington's theorem
 probabilistic primality tests
 Fermat's test
 Carmichael number
 SoloveyStrassen test
 MillerRabin test
 generating probable primes
 RANDOMSEARCH(k,t)
 incremental search
 generating provable primes
 Publickey Encryption
 background
 extended Euclidean algorithm
 modular exponentiation algorithm
 Chinese remainder theorem
 residue number system
 Garner's algorithm
 RSA
 the RSA problem
 key generation
 security of RSA
 small exponent problem
 forward search attack
 multiplicative properties
 common modulus attack
 cycling attack
 message concealing
 DiffieHellman
 the DiffieHellman problem
 ElGamal
 key generation
 encryption/decryption
 randomized encryption
 Rabin
 key generation
 encryption/decryption
 finding square roots
 Pseudorandom Bit Generators
 linear congruential generator
 polynomialtime statistical tests
 statistics background
 normal distribution
 chisquare distribution
 five basic tests
 frequency (monobit) test
 serial (twobit) test
 poker test
 runs test
 autocorrelation test
 cryptographically secure PRBG
 RSA pseudorandom bit generator
 BlumBlumShub pseudorandom bit generator
 Stream Ciphers
 synchronous vs. selfsynchronizing stream ciphers
 LFSR
 connection polynomial
 linear complexity
 BerlekampMassey algorithm
 Nonlinear FSR
 Stream ciphers based on LFSRs
 Geffe generator
 correlation attacks and correlation immunity
 summation generator
 nonlinear filter generator and knapsack generator
 clock controlled generators
 alternating step generator
 shrinking generator
 Stream ciphers not based on LFSRs
 RC4 (FMS attack excluded)
 SEAL
 Hash Functions
 keyed hash functions
 unkeyed hash functions
 hash function properties
 compression
 ease of computation
 preimage resistance
 2ndpreimage resistance
 collision resistance
 computational resistance for MACs
 Yuval's birthday attack
 oneway functions
 compression functions
 DESbased oneway functions
 other oneway functions
 iterated hash functions
 Merkle's metamethod for hashing
 Merkle Damgard strengthening
 padding
 MD5 & SHA1 seriously broken
 HW6, HW7
 3/6/2013:
The midterm exam will be closed book,
closed notes, and closed everything (and no "cheat sheet").
Also, no calculators, cell phones, or any electronic gadgets are allowed.
Please bring a photo ID. Your ID will be collected at the beginning
of the exam and will be returned to you when you turn in your
exam. There will be assigned seating.
The midterm exam will cover everything from the beginning of the
semester till the end of DES
(last slide of lecture 13 on 3/4/2013).
Here is a quick summary of the topics (not all topics covered are listed):
 overview
 functions
 bijections and inverses
 oneway functions and trapdoor oneway functions
 permutations
 encryption schemes
 max number of permutations
 model of communication and channels
 types of adversaries
 types of cryptanalysis
 symmetrickey encryption
 model of communication and channels
 block ciphers
 substitution ciphers
 monoalphabetic substitution cipher
 homophonic substitution cipher
 polyalphabetic substitution cipher
 transposition ciphers
 composition of ciphers and product ciphers
 stream ciphers
 Vernam ciphers and onetime pad
 key space issues
 digital signatures
 signing and verification transformations
 authentication and identification
 entity vs. data origina authentication
 publickey cryptography
 necessity of authentication
 digital signature from reversible publickey encryption
 cryptographic hash functions
 onewayness
 weak collisionresistance
 strong collisionresistance
 keyed vs. unkeyed hash functions
 protocols and mechanisms
 key management
 symmetrickey and trusted third party
 publickey and certificate authority
 attacks
 ciphertextonly
 knownplaintext
 chosenplaintext
 chosenciphertext
 security models
 unconditional security
 complexitytheoretic security
 provable security
 computational security
 ad hoc security
 block ciphers
 classical ciphers
 simple transposition ciphers
 monoalphabetic substitution cipher
 polygram substitution cipher
 homophonic substitution cipher
 cryptographic codes
 polyalphabetic substitution cipher
 Vigenere cipher and variants
 Jefferson cylinders and rotors and the Enigma machine
 cryptanalysis of classical ciphers
 language statistics
 method of Kasiski
 index of coincidences
 block cipher analysis
 True Random Cipher
 complexity of attacks
 birthday paradox
 modes of operation
 cascade cipher and multiple encryption
 meetinthemiddle attacks
 knownplaintext unicity distance
 attacks on multiple encryption
 DES
 product ciphers
 Fiestel
 DES algorithm
 DES key scheduling
 DES properties
 DES weak and semiweak keys
 cryptanalysis of DES
 HW1, HW2, HW4
 2/15/2013: Interesting article about Nokia getting caught doing an (I think) impersonation attack.
 2/14/2013: Office hour today is canceled.
Sorry about the inconvenience.
 1/24/2013: Office hour today is cut short (from 2pm to 2:15pm).
Sorry about the inconvenience.
 1/10/2013:
 To get your user ID and password for accessing protected
area of this web site, please visit the
request access page after the semester starts
and submit the requested information.
(You do not have to be registered for the course to get the password.
You just need to have an USC email address.)
 Watch this area for important announcements.


Prerequisites

CS 102L (Data Structures) or graduate standing. It is assumed that
you know how to write programs in C/C++, and how to debug them and
make them work correctly.


Important
Information about Programming Assignments

All homework assignments are programming assignments to be done in C/C++.
No other programming language will be accepted and your program must
compile and run with a Makefile on nunki.usc.edu. (Sorry, no Java.)
You must be familiar with the Unix development environment
(vi/pico/emacs, cc/gcc or g++/CC, make, etc.)
If you are not familiar with Unix, please read Unix for the Beginning Mage,
a tutorial written by Joe Topjian.
If a student signs up late for this class,
he/she is still required to turn all projects and homeworks
on time or he/she will receive a score of 0 for these assignments.
No exceptions!


