<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	>

<channel>
	<title>UR CSC290B</title>
	<atom:link href="http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog</link>
	<description>Introduction to Computer Security</description>
	<pubDate>Wed, 29 Apr 2009 02:03:16 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.7</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>April Slides</title>
		<link>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/04/28/april-slides/</link>
		<comments>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/04/28/april-slides/#comments</comments>
		<pubDate>Wed, 29 Apr 2009 02:03:16 +0000</pubDate>
		<dc:creator>lbukys</dc:creator>
		
		<category><![CDATA[Announcements]]></category>

		<guid isPermaLink="false">http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/?p=136</guid>
		<description><![CDATA[All April slides have been uploaded.  I also added an optional reading related to Computer Forensics.
]]></description>
			<content:encoded><![CDATA[<p>All <a href="http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/lectures-readings/#14">April slides</a> have been uploaded.  I also added an optional reading related to Computer Forensics.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/04/28/april-slides/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Key readings</title>
		<link>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/04/01/key-readings/</link>
		<comments>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/04/01/key-readings/#comments</comments>
		<pubDate>Wed, 01 Apr 2009 15:20:07 +0000</pubDate>
		<dc:creator>lbukys</dc:creator>
		
		<category><![CDATA[Discussion]]></category>

		<guid isPermaLink="false">http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/?p=128</guid>
		<description><![CDATA[Before Thursday&#8217;s class, do ]]></description>
			<content:encoded><![CDATA[<p>Before Thursday&#8217;s class, do <a href=http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/lectures-readings/#13">the reading</a>.  Notable features:</p>
<ul>
<li>Textbook chapter is an overview, reading carefully before discussion will definitely help</li>
<li>Amazon Web Services article is a great example of a simple flaw &#8212; canonicalizing a string (by sorting pieces of it) before hashing it leads to easy production of multiple strings that lead to the same hashed &#8220;signature&#8221;.  We&#8217;ll discuss in class why string canonicalization happens in some protocols.</li>
<li>Optional reading on HMAC construction gives more detail about the weaknesses that this design avoids &#8212; in particular &#8220;extension attacks&#8221;.  The most trivial one to demonstrate is that if you defined a keyed MAC as hash(key||message), then anyone can figure out the the keyed MAC of any longer message without knowing the key.</li>
</ul>
<p>Also, some short answers to the class discussion related to HMAC:</p>
<ul>
<li>Goal of HMAC is to add a keying feature to any MAC (hash) function.  This construction doesn&#8217;t require specification of any additional encryption algorithm.  So it&#8217;s all as simple and fast as the base MAC function.</li>
<li>Keying with a separate encryption function works OK too.  It&#8217;s just more complex to specify and to run.
<ul>
<li>Encrypting before hashing is definitely slow.</li>
<li>Encrypting after hashing is fine, though you have to specify behavior with regard to block sizes of hash and encryption functions.  Doesn&#8217;t particularly accommodate variable-length key material (unless you hash that first too).</li>
<li>The total algorithm description requires describing both the hash function and the encryption function and any other details about connecting them.  It&#8217;s just messier than describing &#8220;HMAC-xxx&#8221; (where xxx is MD5, SHA1, SHA2, etc) which is both succinct and complete and simple to code for any MAC function.</li>
</ul>
</li>
</ul>
]]></content:encoded>
			<wfw:commentRss>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/04/01/key-readings/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Readings for today&#8217;s basic cryptography lecture</title>
		<link>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/03/19/readings-for-todays-basic-cryptography-lecture/</link>
		<comments>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/03/19/readings-for-todays-basic-cryptography-lecture/#comments</comments>
		<pubDate>Thu, 19 Mar 2009 21:35:05 +0000</pubDate>
		<dc:creator>lbukys</dc:creator>
		
		<category><![CDATA[Announcements]]></category>

		<guid isPermaLink="false">http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/?p=123</guid>
		<description><![CDATA[I posted lecture notes and readings.
Readings include one chapter in the text, and one interesting (optional) paper on an only-recently-broken cipher that had been sent to Thomas Jefferson.
]]></description>
			<content:encoded><![CDATA[<p>I posted <a href="http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/lectures-readings/#12">lecture notes and readings</a>.<br />
Readings include one chapter in the text, and one interesting (optional) paper on an only-recently-broken cipher that had been sent to Thomas Jefferson.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/03/19/readings-for-todays-basic-cryptography-lecture/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Fun for Spring Break</title>
		<link>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/03/05/fun-for-spring-break/</link>
		<comments>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/03/05/fun-for-spring-break/#comments</comments>
		<pubDate>Thu, 05 Mar 2009 22:10:37 +0000</pubDate>
		<dc:creator>lbukys</dc:creator>
		
		<category><![CDATA[Announcements]]></category>

		<guid isPermaLink="false">http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/?p=117</guid>
		<description><![CDATA[During spring break, read the assigned Web Security Handbook reading.  Do not memorize the tables, just skim them, to be aware of the variety of browser behaviors.
When you get back, there will be:

Quiz on the reading
Modest written assignment to refresh you on all of concepts to date
Midterm one week later

Therefore you may want to [...]]]></description>
			<content:encoded><![CDATA[<p>During spring break, read the assigned <a href="http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/lectures-readings/#10">Web Security Handbook</a> reading.  <i>Do not</i> memorize the tables, just skim them, to be aware of the variety of browser behaviors.</p>
<p>When you get back, there will be:</p>
<ul>
<li>Quiz on the reading</li>
<li>Modest written assignment to refresh you on all of concepts to date</li>
<li>Midterm one week later</li>
</ul>
<p>Therefore you may want to also take with you some lecture notes or any assigned readings you might have skipped or glossed over.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/03/05/fun-for-spring-break/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Today&#8217;s lecture notes posted &#038; updated</title>
		<link>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/02/26/109/</link>
		<comments>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/02/26/109/#comments</comments>
		<pubDate>Thu, 26 Feb 2009 22:17:29 +0000</pubDate>
		<dc:creator>lbukys</dc:creator>
		
		<category><![CDATA[Discussion]]></category>

		<guid isPermaLink="false">http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/?p=109</guid>
		<description><![CDATA[Revised lecture notes are posted, including a cleaner example of carrying strings correctly all the way from PHP to a MySQL query using a stored procedure.
]]></description>
			<content:encoded><![CDATA[<p><a href="http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/lectures-readings/#10">Revised lecture notes</a> are posted, including a cleaner example of carrying strings correctly all the way from PHP to a MySQL query using a stored procedure.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/02/26/109/feed/</wfw:commentRss>
		</item>
		<item>
		<title>DC3 Challenge</title>
		<link>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/02/11/dc3-challenge/</link>
		<comments>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/02/11/dc3-challenge/#comments</comments>
		<pubDate>Wed, 11 Feb 2009 14:28:48 +0000</pubDate>
		<dc:creator>lbukys</dc:creator>
		
		<category><![CDATA[Announcements]]></category>

		<guid isPermaLink="false">http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/?p=98</guid>
		<description><![CDATA[The annual digital forensics DC3 challenge has opened its registration and will begin sending out challenge packets this weekend.  I will take advantage of their creativity and assign some homework or projects from among their challenge problems.  (For representative samples of problems and solutions, visit the DC3 site, click on Archives/2008 Challenge, Challenge [...]]]></description>
			<content:encoded><![CDATA[<p>The <a href="http://dc3.mil/challenge/">annual digital forensics DC3 challenge</a> has opened its registration and will begin sending out challenge packets this weekend.  I will take advantage of their creativity and assign some homework or projects from among their challenge problems.  (For representative samples of problems and solutions, visit the DC3 site, click on Archives/2008 Challenge, Challenge Results, View&#8230;)</p>
<p>Teams are limited to 4 persons maximum, so I will split the class into two or more teams.  Contributions to the course and grades will remain individual by default, but if you find colleagues possibly interested in continuing to work on it through November, being on the same team would be handy as you go for the glory.  Take a look at the sample problems from previous years and consider whether you have any preferences regarding teams.  We&#8217;ll settle the team structure in class on Thursday.</p>
<p><b>Update 1:</b> Too bad the dc3.mil website is down as are its DNS servers.  When it&#8217;s back up I&#8217;ll have you register yourselves as individuals or groups.</p>
<p><b>Update 2:</b> The dc3.mil website is back up.  I plan to register this afternoon.  I plan to keep working on the forensics problems through November (in my copious spare time) and submit something, however partial, by November.  If you think you are likely to be interested in working on these problems after the course is over, let me know <b>today</b> and I will add you to my team.  If you will merely do whatever you need for the course and are unlikely to pursue this for the personal satisfaction, form up some separate teams.  Assignments and grading for the course will not depend on team boundaries.  Team boundaries just influence the degree of possible future shared glory.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/02/11/dc3-challenge/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Go to the William Wulf lecture on Thursday</title>
		<link>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/02/04/go-to-the-william-wulf-lecture-on-thursday/</link>
		<comments>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/02/04/go-to-the-william-wulf-lecture-on-thursday/#comments</comments>
		<pubDate>Wed, 04 Feb 2009 13:02:02 +0000</pubDate>
		<dc:creator>lbukys</dc:creator>
		
		<category><![CDATA[Announcements]]></category>

		<guid isPermaLink="false">http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/?p=94</guid>
		<description><![CDATA[I am cancelling Thursday&#8217;s lecture.  I suggest you attend the William Wulf &#8220;Responsible Technological Democracy&#8221; talk.
Stay tuned to the blog for updates on homework assignments and additional readings before next Tuesday.
]]></description>
			<content:encoded><![CDATA[<p>I am cancelling Thursday&#8217;s lecture.  I suggest you attend the <a href="http://www.rochester.edu/calendar/?event&#038;id=473153">William Wulf &#8220;Responsible Technological Democracy&#8221; talk</a>.</p>
<p>Stay tuned to the blog for updates on homework assignments and additional readings before next Tuesday.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/02/04/go-to-the-william-wulf-lecture-on-thursday/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Confinement Readings</title>
		<link>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/01/29/confinement-readings/</link>
		<comments>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/01/29/confinement-readings/#comments</comments>
		<pubDate>Thu, 29 Jan 2009 22:15:59 +0000</pubDate>
		<dc:creator>lbukys</dc:creator>
		
		<category><![CDATA[Discussion]]></category>

		<guid isPermaLink="false">http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/?p=87</guid>
		<description><![CDATA[There are lots of readings on today&#8217;s topic, &#8220;Confinement.&#8221;  There will be at least one quiz question on each of the non-optional readings.  They are all interesting, though, so enjoy it.
]]></description>
			<content:encoded><![CDATA[<p>There are <a href="http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/lectures-readings/#05">lots of readings</a> on today&#8217;s topic, &#8220;Confinement.&#8221;  There will be at least one quiz question on each of the non-optional readings.  They are all interesting, though, so enjoy it.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/01/29/confinement-readings/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Assignment 0.1: accounts and readers</title>
		<link>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/01/14/assignment-0-1/</link>
		<comments>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/01/14/assignment-0-1/#comments</comments>
		<pubDate>Thu, 15 Jan 2009 03:04:29 +0000</pubDate>
		<dc:creator>lbukys</dc:creator>
		
		<category><![CDATA[Assignments]]></category>

		<guid isPermaLink="false">http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/?p=51</guid>
		<description><![CDATA[Due Date: Friday, January 16, 5PM

Browse the CSC290B blog, find this assignment, and post a comment that includes:

your name
what RSS reader you plan to use
a list of the programming languages with which you are at least somewhat familiar
a list of the most advanced courses you have taken in programming languages, operating systems, and networks
any other [...]]]></description>
			<content:encoded><![CDATA[<p><strong>Due Date: Friday, January 16, 5PM</strong></p>
<ul>
<li>Browse the <a href="http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/">CSC290B blog</a>, find this assignment, and post a comment that includes:
<ol>
<li>your name</li>
<li>what RSS reader you plan to use</li>
<li>a list of the programming languages with which you are at least somewhat familiar</li>
<li>a list of the most advanced courses you have taken in programming languages, operating systems, and networks</li>
<li>any other possibly-relevant background you may have</li>
</ol>
</li>
<li>Visit Marty Guenther in room 735 to establish or renew your CSUG account. Login to your CSUG account and send an email to <a href="mailto:csc290b@cs.rochester.edu">csc290b@cs.rochester.edu</a> stating where you would like private emails sent (i.e. to your CSUG account or some other email account).</li>
<li>Check the <a href="http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/lectures-readings/">Lectures &amp; Readings</a> link for the first reading assignment.  The first textbook chapter is available online, but you&#8217;ll need to find a paper copy of the text for subsequent chapters.</li>
</ul>
]]></content:encoded>
			<wfw:commentRss>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/01/14/assignment-0-1/feed/</wfw:commentRss>
		</item>
		<item>
		<title>What to expect</title>
		<link>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/01/14/what-to-expect/</link>
		<comments>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/01/14/what-to-expect/#comments</comments>
		<pubDate>Thu, 15 Jan 2009 02:24:55 +0000</pubDate>
		<dc:creator>lbukys</dc:creator>
		
		<category><![CDATA[Announcements]]></category>

		<guid isPermaLink="false">http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/?p=39</guid>
		<description><![CDATA[Tentative Syllabus
If there is some topic of keen interest to you, speak up soon!

Overview
Robust Programming, Secure Coding, Vulnerabilities
Design Principles
OS Protection, ACLs, Capabilities, Confinement
Classical Cryptography
Public-key Cryptography
Identity &#38; Authentication
Firewalls, SSL, IPSec
Incident Handling
Forensics
Access Control Models
Models of Confidentiality &#38; Integrity

Communication

Read the blog http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/

Use a RSS reader such as Google Reader or Bloglines or any other RSS reader
Subscribe to both [...]]]></description>
			<content:encoded><![CDATA[<h3>Tentative Syllabus</h3>
<p>If there is some topic of keen interest to you, speak up soon!</p>
<ul>
<li>Overview</li>
<li>Robust Programming, Secure Coding, Vulnerabilities</li>
<li>Design Principles</li>
<li>OS Protection, ACLs, Capabilities, Confinement</li>
<li>Classical Cryptography</li>
<li>Public-key Cryptography</li>
<li>Identity &amp; Authentication</li>
<li>Firewalls, SSL, IPSec</li>
<li>Incident Handling</li>
<li>Forensics</li>
<li>Access Control Models</li>
<li>Models of Confidentiality &amp; Integrity</li>
</ul>
<h3>Communication</h3>
<ul>
<li>Read the blog http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/
<ul>
<li>Use a RSS reader such as <a href="http://www.google.com/reader">Google Reader</a> or <a href="http://www.bloglines.com/">Bloglines</a> or <a href="http://dir.yahoo.com/Computers_and_Internet/Data_Formats/XML__eXtensible_Markup_Language_/RSS/RSS_Readers_and_Aggregators/">any other RSS reader</a></li>
<li>Subscribe to both articles and comments:
<ul>
<li>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/feed/</li>
<li>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/comments/feed/</li>
</ul>
</li>
</ul>
</li>
<li>Ask public questions (useful to entire class) by posting comments to the blog.</li>
<li>Ask private questions by email to <a href="mailto://csc290b@cs.rochester.edu">CSC290B@cs.rochester.edu</a> which will reach both the instructor and the TA.</li>
</ul>
<h3>Grading</h3>
<ul>
<li>10% Quizes - frequent, short, based on required readings, some pre-lecture, some post-lecture</li>
<li>5% Class participation-based discretionary adjustment</li>
<li>5% Involuntary Servitude - you can volunteer or be volunteered - occasional, quick followup post-lecture investigations, resulting in slides and brief presentations, or blog articles; expect to do 2 or 3 during the semester</li>
<li>30% Programming Assignments - not equally weighted</li>
<li>10% Project - written report [topics to be determined], possibly some modest implementation component</li>
<li>20% Midterm exam</li>
<li>20% Final exam</li>
</ul>
<h3>Programming</h3>
<ul>
<li>You will be required to write some modest programs with a variety of languages (e.g. C/C++, Java, scripting languages such as Perl, Python, or PHP, special-purpose languages such as SQL), runtime libraries (e.g. OpenSSL), and programming environments (e.g. Linux, Apache CGI, etc).  You must be comfortable with programming even with unfamiliar tools and finding what you need to get the assignments done.</li>
<li>Some assignments will include evaluating each other&#8217;s code and assessing it for security vulnerabilities.  Clear write-ups documenting security problems (or suspected weaknesses) with course infrastructure (e.g. this website, or assignment turn-in procedures) would be welcome and worth bonus points toward grades.  Actually exploiting weaknesses would not be welcome.  Deliberate disruptions of course or department systems would be grounds for academic disciplinary action.</li>
<li>Assignments will be individual and code should not be shared or viewed without prior arrangement with the instructor.</li>
<li>The US Department of Defense Cyber Crime Center sponsors an annual competition in digital forensics, the DC3 Challenge.  Registration is in February, the exercises are announced in March, and solutions are not due until November.  In March I may decide to assign one or more of these challenge problems as programming assignments.  Perhaps members of the class will become interested enough to form teams and compete for the whole year.  See the <a href="http://www.dc3.mil/challenge/">DC3 challenge</a> web site for a description of prior-year challenge problems and contestant solutions.</li>
</ul>
]]></content:encoded>
			<wfw:commentRss>http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/2009/01/14/what-to-expect/feed/</wfw:commentRss>
		</item>
	</channel>
</rss>
