Applied Cryptography

Week 1: Motivation and basic concepts. Examples for cyber attacks, attacker models, security objectives. History of Cryptography. Symmetric and asymmetric ciphers, digital signature schemes, cryptographic hash functions. Construction examples and parameter sizes.

Exercise:  operation and properties of cryptographic building blocks.

Week 2: Block encryption modes, MAC functions, PKCS formatting for public key algorithms.
 
Week 3: Random number generation, attacks against PRNG-s, secure PRNG constructions. Key exchange protocols: attacker model and main design principles, illustrative examples (Needham-Schroeder, Wide Mouth Frog, Diffie-Hellman, ...). Manual and automated security verification of key exchange protocols.

Exercise: usage of cryptographic libraries (eg. OpenSSL).

Week 4: Introduction to Public Key Infrastructures (PKI): certificate, certification authority (CA), trust, key pair management, verification of digital signatures.

Week 5: Digital vs. electronic signature: digital signature, authentication with public key cryptography; legal background of electronic signatures, related laws in the EU and in the US, qualified electronic signature; requirements for electronic signatures, the process of creating and verifying electronic signatures, certificate revocation, electronic signature archive formats.

Exercise: establishment of a certification authority.

Week 6: PKI and secure communications on the web. Security of and trust in CAs. Audit frameworks. Practical examples for security issues in CAs. Business models for PKI.

Week 7: Secure communcation protocols: TLS/SSL (operation and analysis).

Exercise: attacks of communication and key exchange protocols.

Week 8: Security in wireless networks: WiFi security protocols  (WEP, WPA, WPA2) (operation and analysis).

Week 9: Other topics: cryptography in resource constrained environments (embedded systems, RFID systems). Privacy protection with cryptographic solutions: anonim communication systems and private authentication protocols.

Exercise: measuring privacy in anonymous communication systems.

Week 10: Password based authentication: cryptographic protection of passwords in applications, and password based key derivation. Two factor authentication, one-time passwords. Authentication and authorization in practice (Kerberos, OAuth, OpenID, SAML).

Week 11: Applications: Disk encryption and secure electronic mail (PGP and SMIME).

Exercise: use of PGP and SMIME in practice.

Week 12: Client side encryption in the Tresorit cloud based data storage system.

Week 13: DRM and secure file sharing in the Tresorit system.

Exercise: Tresorit setup for a virtual business environment

Week 14: Summary and outlook to other application areas of cryptography.