Math 691 Spring 2001, MW 12-1:30 DRL 4C8

Topics in Mathematical Foundations of Computer Security

Professor Andre Scedrov

About This Course

Course grade will be based on student presentations and active student participation in the course.

Topics

• Rohit Chadha: Contract Signing Protocols
  References:
  • N. Asokan, V. Shoup, and M. Waidner. Asynchronous protocols for optimistic fair exchange, Research Report RZ 2976 (#93022), IBM Research, November 1997.

  • V. Shmatikov and J.C. Mitchell. Analysis of a Fair Exchange Protocol, Seventh Annual Symposium on Network and Distributed System Security (NDSS 2000), San Diego, 2000, pages 119-128.

  • J. Garay, M. Jakobsson, P. MacKenzie. Abuse-free Optimistic Contract Signing, In: CRYPTO'99, Santa Barbara, August, 1999.

  • V. Shmatikov and J.C. Mitchell. Analysis of Abuse-Free Contract Signing, Financial Cryptography 2000.

• Darren Glass: A Public-Key Cryptosystem using Braid Groups
  References:
  • Ki Hyoung Ko, Sang Jin Lee, Jung Hee Cheon, Jae Woo Han, Ju-sung Kang, and Choonsik Park. New Public-key Cryptosystem using Braid Groups, CRYPTO 2000.

  • Jim Hughes. The LeftSSS attack on Ko-Lee-Cheon-Han-Kang-Park Key Agreement Protocol in B45, CRYPTO 2000 rump session.

  • Iris Anshel, Michael Anshel, and Dorian Goldfeld. An Algebraic Method for Public-Key Cryptography, Mathematical Research Letters 6 (1999) 287-291.

  • Priit Karu and Jonne Loikkanen. Practical comparison of Fast Public-key Cryptosystems, Manuscript, 2001.

• Andre Scedrov: Multiset Rewriting and the Analysis of Bounded Security Protocols
  References:
  • I. Cervesato, N.A. Durgin, P.D. Lincoln, J.C. Mitchell, and A. Scedrov. A meta-notation for protocol analysis. In: P. Syverson, ed., "12-th IEEE Computer Security Foundations Workshop, Mordano, Italy, June, 1999", IEEE Computer Society Press, 1999, pp. 55-69.

  • N.A. Durgin, P.D. Lincoln, J.C. Mitchell, and A. Scedrov. Undecidability of bounded security protocols. In: "Workshop on Formal Methods and Security Protocols (FMSP'99)", The 1999 Federated Logic Conference (FLoC'99), Trento, Italy, July, 1999, revised version, 11 pp.

  • I. Cervesato, N.A. Durgin, P.D. Lincoln, J.C. Mitchell, and A. Scedrov. Relating strands and multiset rewriting for security protocol analysis. In: P. Syverson, ed., "13-th IEEE Computer Security Foundations Workshop, Cambridge, England, July, 2000", IEEE Computer Society Press, 2000, pp. 35-51. Revised version.

• Andrew Kresch: Elliptic Curves in Cryptography
  References:
  • I.F. Blake et. al., Elliptic Curves in Cryptography, London Mathematical Society lecture note series 265, Cambridge University Press, Cambridge, 1999.

  • Links to Elliptic Curves in Cryptology.

• Aaron D. Jaggard: Remotely Keyed Encryption
  References:
  • Matt Blaze. High-Bandwidth Encryption with Low-Bandwidth Smartcards, Cambridge Workshop on Fast Software Encryption, February 1996. Introduction of the concept of Remotely Keyed Encryption.

  • Stefan Lucks. On the Security of Remotely Keyed Encryption, Fast Software Encryption 1997. RKES satisfying some specified security requirements (weaker than those we looked at in class).

  • Matt Blaze, Joan Feigenbaum, and Moni Naor. A Formal Treatment of Remotely-Keyed Encryption, Eurocrypt 98. The primary source for the in-class presentation. Statement of stronger security requirements and discussion of a length increasing and a length preserving RKES which satisfy these.

  • Stefan Lucks. Accelerated Remotely Keyed Encryption, Fast Softward Encryption 1999. Description of a secure length preserving RKES requiring less on-card work than the RKES of Blaze, et al.

  • Oded Goldreich. The Foundations of Cryptography.

• Catherine A. Meadows, Naval Research Laboratory: Open Issues in Formal Methods for Cryptographic Protocol Analysis
  The history of the application of formal methods to cryptographic protocol analysis spans nearly twenty years, and recently has been showing signs of new maturity and consolidation. A number of specialized tools have been developed, and others have effectively demonstrated that existing general-purpose tools can also be applied to these problems with good results. However, with this better understanding of the field comes new problems that strain against the limits of the existing tools. In this paper we will outline some of these new problem areas, and describe what new research needs to be done to to meet the challenges posed. In particular, we will discuss our own research work in applying these techniques to the formalization and analysis of problems related to denial of service in computer networks.

• Sylvan S. Pinsky, National Security Agency: Noninterference Equations for Nondeterministic Systems
  Noninterference was introduced by Goguen and Meseguer in 1982 to provide a foundation for the specification and analysis of security policies based on the intuitive concept that a security domain u is noninterfering with domain v if no action performed by u can influence subsequent outputs seen by v. This talk will provide a historical background on noninterference and describe how the equivalence of deterministic and nondeterministic finite state automata from classical computer science simplifies the analysis of noninterference. I will discuss how to reduce the satisfiability of noninterference to the solution of a finite set of equations. I will use the structure of labelled transition systems, which are the basis for state machines and process algebras, to explicitly model the relationship between states, actions, and outputs. The output constraint equations are developed by constructing a predicate for nondeterministic systems and expressing noninterference as an invariance property of the predicate. The finiteness of the equations comes from a closure property of the predicate and the use of finite state machines.

• Angelos D. Keromytis: IPsec
  The IPsec protocol suite provides network-layer security for the Internet and has recently been standardized in the IETF. It is beginning to make its way into commercial implementations of desktop, server, and router operating systems. IPsec offers a remarkable flexibility not possible at higher or lower layer abstractions: security can be configured end-to-end, route-to-route, edge-to-edge, or in any other configuration in which network nodes can be identified as appropriate security endpoints. This flexibility however implies some associated complexity, which tends to obscure the usefulness of IPsec in engineering a secure network.

  In this tutorial, we intend to discuss:

  • The IPsec protocols, especially key management (IKE) and its requirements on public key certificate mechanisms and policy.

  • The various modes IPsec may be employed in (VPN, remote access, end-to-end, virtual LANs, etc.)

  • Interaction between IPsec and firewalls.

  • Performance considerations (software and hardware), especially with respect to the new AES algorithm(s).

  • Future developments (DNSSEC support, PKIX, IPSP).

  • Comparison with SSL and Kerberos.

• Frederick Butler: SET: Secure Electronic Transaction
  References:
  • Els Van Herreweghen. Non-Repudiation in SET: Open Issues, In: Proceedings of the Fourth Conference on Financial Cryptography (FC '00), Anguilla, British West Indies, February 2000. International Financial Cryptography Association (IFCA), Lecture Notes in Computer Science, Springer-Verlag,

  • Els Van Herreweghen. Using Digital Signatures as Evidence of Authorizations in Electronic Credit-Card Payments, Research Report 3156, IBM Research, June 1999.

  • Setco. SET Secure Electronic Transaction Specification Book 3: Formal Protocol Definition.

• Michael Levin: One-Way Functions and Pseudorandom Number Generators
  Reference:
  • Oded Goldreich. The Foundations of Cryptography - a book in preparation, 2001.

• Paul Syverson, Naval Research Laboratory: Onion Routing
  Onion Routing is an infrastructure for private communication over a public network. It provides anonymous connections that are strongly resistant to both eavesdropping and traffic analysis. Thus it hides not only the data being sent, but who is talking to whom. Onion Routing's anonymous connections are bidirectional and near real-time, and can be used anywhere a socket connection can be used. Proxy aware applications, such as web browsing and e-mail, require no modification to use Onion Routing, and do so through a series of proxies. Other applications, such as remote login, can also use the system without modification. This talk will begin with an overview of Onion Routing. I will then describe various configurations for accessing the system depending on the needs, policies, and facilities of those connecting. If time permits, I will discuss the security of the system, giving adversary models and definitions of security goals.

• Christopher Burrows: Secure Multi-Party Computation
  References:
  • Oded Goldreich. Working Draft on Secure Multi-Party Computation, 1998. The Foundations of Cryptography.

  • BRICS Course on Secure Multi-Party Computation.

  • ETH Report on Secure Cooperation.

• Scott Stoller, State University of New York at Stony Brook: A Bound on Attacks on Payment Protocols
  Electronic payment protocols are designed to work correctly in the presence of an adversary that can prompt honest principals to engage in an unbounded number of concurrent instances of the protocol. This paper establishes an upper bound on the number of protocol instances needed to attack a large class of protocols, which contains versions of some well-known electronic payment protocols, including SET and 1KP. Such bounds clarify the nature of attacks on and provide a rigorous basis for automated verification of payment protocols. To appear in Proc. IEEE Symposium on Logic in Computer Science 2001.

In the news ...

• FTP Flaw Makes Servers Insecure. April 16, 2001.

• 'Dangerous' Linux worm in the wild. March 23, 2001.

• Microsoft warns of fraudulent digital certificates. March 22, 2001.

• TCP security hole may be more dangerous than first thought. March 13, 2001.

• Sun warns of security hole in Java. February 23, 2001.

• Internet security hole called most serious yet. January 29, 2001.

• U.S. backs Belgians' Rijndael for data scrambling. October 2, 2000.

Selected Sources

• "Handbook of Applied Cryptography" by Menezes, van Oorschot, and Vanstone. CRC Press, 1996. ISBN: 0-8493-8523-7.
• "Cryptography: Theory and Practice" by Stinson. CRC Press, 1996, The Fourth Printing. ISBN: 0-8493-8521-0.
• O. Goldreich. "Modern Cryptography, Probabilistic Proofs and Pseudo-randomness." Springer-Verlag, 1999. ISBN: 3-540-64766-X.
• O. Goldreich. The Foundations of Cryptography.
• B. Schneier. "Applied Cryptography : Protocols, Algorithms, and Source Code in C." John Wiley & Sons, 1995. ISBN: 0471117099.
• Ron Rivest's Cryptography and Security Page at MIT.
• The Cypherpunks Home Page at UC Berkeley.
• Crypto FAQ site at RSA Security.
• J. Clark and J. Jacob. A Survey of Authentication Protocol Literature. Version 1.0, November, 1997.
• R. Kemmerer, C. Meadows, and J. Millen. Three Systems for Cryptographic Protocol Analysis. Journal of Cryptology, Vol. 7, no. 2, 1994.
• J.C. Mitchell, M. Mitchell, and U. Stern. Automated Analysis of Cryptographic Protocols Using Murphi, IEEE Symp. Security and Privacy, Oakland, 1997, pages 141-153.
• J.P. Anderson. Computer Security Technology Planning Study. ESD-TR-73-51, ESD/AFSC, Hanscom AFB, Bedford, MA (Oct. 1972) [NTIS AD-758 206].
• M. Bishop's History of Computer Security Web Site at UC Davis.