Archive for the ‘Announcements’ Category.

April Slides

All April slides have been uploaded. I also added an optional reading related to Computer Forensics.

Readings for today’s basic cryptography lecture

I posted lecture notes and readings.
Readings include one chapter in the text, and one interesting (optional) paper on an only-recently-broken cipher that had been sent to Thomas Jefferson.

Fun for Spring Break

During spring break, read the assigned Web Security Handbook reading. Do not memorize the tables, just skim them, to be aware of the variety of browser behaviors.

When you get back, there will be:

  • Quiz on the reading
  • Modest written assignment to refresh you on all of concepts to date
  • Midterm one week later

Therefore you may want to also take with you some lecture notes or any assigned readings you might have skipped or glossed over.

DC3 Challenge

The annual digital forensics DC3 challenge has opened its registration and will begin sending out challenge packets this weekend. I will take advantage of their creativity and assign some homework or projects from among their challenge problems. (For representative samples of problems and solutions, visit the DC3 site, click on Archives/2008 Challenge, Challenge Results, View…)

Teams are limited to 4 persons maximum, so I will split the class into two or more teams. Contributions to the course and grades will remain individual by default, but if you find colleagues possibly interested in continuing to work on it through November, being on the same team would be handy as you go for the glory. Take a look at the sample problems from previous years and consider whether you have any preferences regarding teams. We’ll settle the team structure in class on Thursday.

Update 1: Too bad the dc3.mil website is down as are its DNS servers. When it’s back up I’ll have you register yourselves as individuals or groups.

Update 2: The dc3.mil website is back up. I plan to register this afternoon. I plan to keep working on the forensics problems through November (in my copious spare time) and submit something, however partial, by November. If you think you are likely to be interested in working on these problems after the course is over, let me know today and I will add you to my team. If you will merely do whatever you need for the course and are unlikely to pursue this for the personal satisfaction, form up some separate teams. Assignments and grading for the course will not depend on team boundaries. Team boundaries just influence the degree of possible future shared glory.

Go to the William Wulf lecture on Thursday

I am cancelling Thursday’s lecture. I suggest you attend the William Wulf “Responsible Technological Democracy” talk.

Stay tuned to the blog for updates on homework assignments and additional readings before next Tuesday.

What to expect

Tentative Syllabus

If there is some topic of keen interest to you, speak up soon!

  • Overview
  • Robust Programming, Secure Coding, Vulnerabilities
  • Design Principles
  • OS Protection, ACLs, Capabilities, Confinement
  • Classical Cryptography
  • Public-key Cryptography
  • Identity & Authentication
  • Firewalls, SSL, IPSec
  • Incident Handling
  • Forensics
  • Access Control Models
  • Models of Confidentiality & Integrity

Communication

  • Read the blog http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/
    • Use a RSS reader such as Google Reader or Bloglines or any other RSS reader
    • Subscribe to both articles and comments:
      • http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/feed/
      • http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/comments/feed/
  • Ask public questions (useful to entire class) by posting comments to the blog.
  • Ask private questions by email to CSC290B@cs.rochester.edu which will reach both the instructor and the TA.

Grading

  • 10% Quizes - frequent, short, based on required readings, some pre-lecture, some post-lecture
  • 5% Class participation-based discretionary adjustment
  • 5% Involuntary Servitude - you can volunteer or be volunteered - occasional, quick followup post-lecture investigations, resulting in slides and brief presentations, or blog articles; expect to do 2 or 3 during the semester
  • 30% Programming Assignments - not equally weighted
  • 10% Project - written report [topics to be determined], possibly some modest implementation component
  • 20% Midterm exam
  • 20% Final exam

Programming

  • You will be required to write some modest programs with a variety of languages (e.g. C/C++, Java, scripting languages such as Perl, Python, or PHP, special-purpose languages such as SQL), runtime libraries (e.g. OpenSSL), and programming environments (e.g. Linux, Apache CGI, etc).  You must be comfortable with programming even with unfamiliar tools and finding what you need to get the assignments done.
  • Some assignments will include evaluating each other’s code and assessing it for security vulnerabilities. Clear write-ups documenting security problems (or suspected weaknesses) with course infrastructure (e.g. this website, or assignment turn-in procedures) would be welcome and worth bonus points toward grades. Actually exploiting weaknesses would not be welcome. Deliberate disruptions of course or department systems would be grounds for academic disciplinary action.
  • Assignments will be individual and code should not be shared or viewed without prior arrangement with the instructor.
  • The US Department of Defense Cyber Crime Center sponsors an annual competition in digital forensics, the DC3 Challenge. Registration is in February, the exercises are announced in March, and solutions are not due until November. In March I may decide to assign one or more of these challenge problems as programming assignments. Perhaps members of the class will become interested enough to form teams and compete for the whole year. See the DC3 challenge web site for a description of prior-year challenge problems and contestant solutions.