1. Administrative Staff

Professor Jeannette Wing, x8-3068, WeH 8219, wing@cs.cmu.edu
Heather Marko (secretary), x8-2568, WeH 8120, heatherm@cs.cmu.edu

Heather will keep extra copies of handouts.

2. Schedule

Date	Lecture	Topic	Homework,Project
9/14	1	Cryptography: introduction, symmetric-key cryptography	HW 1 out
9/21	2	Public-key cryptography, digital signatures, applications of PKC
9/28	3	Authentication: introduction, protocols, design principles	HW 1 due, HW 2 out
10/5	4	Logics and models for reasoning about authentication
10/9	5 (F)	Limitations of cryptography (guest lecturer: Prof. Rudich)
10/12	6	No Class (mid-semester break), hand in homework to my office	HW 2 due, HW 3 out
10/19	7	Tools for reasoning about authentication
10/26	7	Electronic commerce: introduction, protocols
11/2	8	Electronic voting, electronic auctions	HW 3 due, HW 4 out,and Project proposal due
11/9	9	Digital watermarking. Legal and ethical issues.	Project final approval
11/16	10 (1-3)	Systems-level issues. Infrastructure issues.	HW 4 due
11/23	11	Language issues: SFI, PCC, Java. Policy issues. Research challenges.
11/30	12	Project presentations	Project orals and demos
12/2	W		Project written reports due

The class meets 1:00-3:20 p.m. on Mondays in WeH 4601. Bring a sweater! There are two irregularities in the schedule. First, since we meet so few times I scheduled a Friday class for the week before the University’s mid-semester break. We are fortunate to have a guest lecturer, Prof. Steven Rudich, to speak to us that day. Second, we meet till only 3:00 on November 16^th.

3. Textbooks

The required textbook for the course is

• Handbook of Applied Cryptography, Alfred J. Menezes, Paul C. van Oorschot, and Scott A. Vanstone, CRC Press, Boca Raton, FL, 1997.

Other textbooks which you may find useful for background or supplementary information are

• Applied Cryptography, 2^nd Edition, Bruce Schneier, John Wiley, New York, 1996.
• Cryptography: Theory and Practice, Douglas R. Stinson, CRC Press, Boca Raton, FL, 1995.
• Cryptography and Data Security, Dorothy Denning, Addison-Wesley, Reading, MA, 1982.
• Network Security, Charlie Kaufman, Radia Perlman, and Mike Speciner, Prentice-Hall, Upper Saddle River, NJ, 1995.
4. Course Communication

URL http://www.cs.cmu.edu/afs/cs/academic/class/15827-f98/www/index.html (pending)
E-mail cs-827@cs.cmu.edu(reaches all students, Heather Marko, and me)
Bboard cmu.cs.class.cs827

Please feel free to send me e-mail, call me, or stop by my office at any time. I welcome questions, comments, and criticism of all kinds.

5. Grading

Students taking this class for credit are responsible for attending and participating in class (10%), doing all four homeworks (40%), helping to grade and devise model solutions (10%, see Homeworks below), and doing a term project (35%) that has written, oral, and (possible) demonstration components. The remaining 5% of the grade is credit subject to the instructor’s discretion.

Students auditing this class are responsible for attending and participating, are encouraged (but not required) to do a project, and do not have to do the homeworks.

Attendance is mandatory for all, especially since we meet only once a week.

6. Homeworks

You will get two or three weeks to do each homework (see the schedule on p. 1). You may discuss homework problems and solutions with each other but you must hand in individually written assignments. You must indicate the names of those with whom you worked on what you hand in.

Since there is no TA I will be asking you to help me and each other out with grading. For each assignment I will ask for a group of volunteers to help grade and come up with a model solution set. First I will look over all the homeworks and then I will work with the volunteers to come up with good solutions (there may be more than one) to the questions, perhaps using (with permission) a student’s answer. The volunteers will also help me grade all the homeworks. The reason I’m involving students in the grading process is not only to help me but to ensure that everyone has as much feedback as possible on their homeworks in a timely manner. Each student must volunteer to help grade and come up with a model solution set at least once during the term.

If your answer does get chosen to be on any of the model solutions, you will get extra credit.

7. Project

You may choose to work on the term project by yourself on in a group. My preference is that you work in groups of at least two and no more than four. (I can also imagine two groups teaming up to create a larger demonstration system—that would be fine too but I leave all coordination and organization to you.) The larger the group the more ambitious the project I expect. The project grade will depend on the nature of the project, how well it is done, and how large your group is. Here are some examples of the kinds of projects you may choose to do:

• Design and build an electronic storefront that sells some service or product of your choosing. Demonstrate its use with "real" customers and merchants.
• Design and build a secure electronic voting system for an election scheme and organization of your choosing. Demonstrate its use by holding a "real" election.
• Learn how to use a generic formal reasoning tool like PVS or a specific one like the NRL Protocol Analyzer and demonstrate its use by applying it to two or more protocols we studied in class (but not one on which the tool has been applied already).
• Comb the literature for an advanced set of research papers on a topic we covered in class (like elliptic curve cryptography, differential cryptanalysis, key escrow, some aspect of digital watermarking, or trust management) but did not go into great depth. Write a critique or survey paper based on the work reported in the papers.
• Identify a previously unknown security bug in a protocol published in the literature or proposed by a standards committee. Prove that it is a bug and explain what needs to be done to correct it. Prove that your fix is correct.

You or your group should feel free to come up with your own ideas for a project. You (or your group) must submit a project proposal that gets my final approval. The project has two, possibly three, components: written, oral, and demonstration. You should aim to have your written document meet the standards of a workshop or conference submission. I plan to bundle all documents into a technical report for the course. Only well-written documents will be included in this technical report. The oral component will be short. Depending on how many projects there are, the last day of class will be devoted to short oral presentations. If your project has a demonstration component (e.g., running a secure election or explaining the application of a tool), you should plan to include it in your oral presentation. If there are a lot of projects then I might have to structure the last day as a poster session or schedule additional class time.

Here are dates relevant to the project:

November 2    Project proposals due.
November 4    Project proposal feedback, with possible iteration.
November 9    Final project approval.
November 30  Oral and demo of project in class.
December 2    Written component of project due. Yes, this is a Wednesday.

You may choose to do your project proposal and get final approval from me much earlier than November 2—as early as you wish—in case you want to get a head start on your project and not leave it for the end of the term.

8. Policy on Lateness

Homeworks must be handed in by 5:00 p.m. of the due date. Any homework handed in late will get marked down by the equivalent of one letter grade for each day it is late. If I’m not in my office, you may hand your homework to my secretary.

It is especially critical that you get me the written component part of your project by 5:00 p.m. December 2 because I will be taking them with me to read on an extended overseas trip, leaving the next day. Under no circumstances will I accept any late projects because of my tight travel schedule in early December. Thank you in advance for your understanding!

Back to Lectures

Heather L. Marko
Last Modified: September 1998