Computer Security (CIS-3240) Home Page

This is the home page for Peter Chapin's Computer Security course notes for the Fall 2025 semester. Here you will find electronic versions of class handouts, homework assignments, lecture slides, and links to other references of interest. If you are a student taking Computer Security, you should bookmark this page.

Lectures will be via Zoom.

The course syllabus gives an overview of the course and its content, lists course resources, and describes the grading policy and related issues.
The texts are in a curated playlist in the O'Reilly Collection. Use your VSC credentials to access it.
The homework submission area and grade book are on Canvas. All other course resources are here.
My page on GPG is a short overview of the basics of GPG.
I've prepared some general information on submitting assignments.
My home page contains other resources of potential interest.

Lecture Topics

The lectures for this course will be taught via Zoom.

2025-08-25. Introduction to the course and overview of some basic concepts in computer security.
2025-08-27. Discussed general concepts of symmetric encryption. Demonstrated the hexdump and count utilities and the substitution cipher program.
2025-09-01. No class (vacation).
2025-09-03. Demonstrated the hexdump and count utilities and the substitution cipher program. Introduced Feistel ciphers and DES.
2025-09-08. Discussed the AES. Introduced the One-Time Pad.
2025-09-10. Discussed the "three gnomes." Introduced block cipher modes. Discussed ECB mode, CBC mode, CFB, and CTR mode.
2025-09-15. Discussed cryptographic hash functions.
2025-09-17. Introduced public key cryptography.
2025-09-22. Continued discussion of public key cryptography. Discussed certificate chains. Demonstrated GPG.
2025-09-24. Discussed random number generation.
2025-09-29. Introduced security protocols via the timestamp protocol.
2025-10-01>. Discussed a voting protocol and introduced a progression of digital cash protocols.
2025-10-06. No class (Vacation).
2025-10-08. No class (Vacation).
2025-10-13. Introduced TLS.
2025-10-15. Continued discussing TLS by reviewing the TLS RFC.
2025-10-20. Discussed the Kerberos authentication protocol.
2025-10-22. Introduced host-based security and issues in access control (access control matrix, ACLs, capabilities, groups/roles).
2025-10-27. Introduced DAC vs. MAC. Discussed multi-level security.

Slides

Homework

Homework #1 Basic Security Concepts (DocBook source). Due: 2025-09-05
Homework #2 Block Ciphers (DocBook source). Due: 2025-09-19
Homework #3 Hashes and Public Key Cryptography (DocBook source). Due: 2025-10-17

Resources/Articles

General References and Utilities

RFC Index. Here you can look up any RFC or browse the RFC index itself.
Notes on hexadecimal (hex) representation of binary values.
The ASCII table on Wikipedia.
This hexdump utility is sometimes useful for looking at the raw data contained in a file (Windows executable).
A program which counts characters in a file to explore that file's statistics (Windows executable), and a program that does a simple substitution cipher (Windows executable).
A plain (ASCII) text file that is nice to use for experimentation is RFC-2616 (for the HTTP protocol).

Cryptography

A Feistel cipher is a generalized structure used by many block encryption algorithms, including DES.
The Data Encryption Standard (DES) is an older algorithm that is no longer considered secure due to its small (56-bit) key size.
The NIST FIPS 46-3 document describing DES (withdrawn).
Is DES closed? This document describes why we care.
The Meet in the Middle Attack is why double encrypting isn't worth the effort.
Blowfish is an example of a cipher that uses the Feistel network.
The Advanced Encryption Standard (AES) is a newer encryption standard that is widely used.
The NIST FIPS 197 document describing AES.
An example showing one round of the AES computation (including the initial AddRoundKey step). The program MixColumns (Windows executable) does the column mixing step of AES. It is semi-interactive.
A brief overview of some symmetric encryption algorithms.
An example of the One-Time Pad with comments about its use.
This program does a simple bitwise XOR of the plaintext against a password (Windows executable). This method is easy to break, but has a tantalizing similarity to the One-Time Pad.
A nice page about block cipher modes on Wikipedia. The page includes some excellent diagrams.
A Wikipedia page describing the SHA family of secure hash algorithms.
A Wikipedia page describing in detail the specifics of the SHA-1 algorithm (with pseudocode).
A Wikipedia page describing the HMAC algorithm (RFC-2104)
NIST specification for Galois Counter Mode (GCM).
RANDOM.ORG is a website that generates true random numbers using atmospheric noise. It also contains a lot of information about randomness.
Recommendation for Random Number Generation Using Deterministic Random Bit Generators from NIST.
Some notes about cryptography. These notes summarize some main points made during the lecture.

Security Protocols

Security Protocol Notation (SPN).
Time stamp protocol described and analyzed.
Voting protocol described and analyzed.
Some digital cash protocols.
Needham-Schroeder Protocol. This Wikipedia article describes both the broken version and the fixed version.
The original paper on Bitcoin.
The Bitcoin website allows you to buy/sell Bitcoin and read information about the system.
Do you want to run a Bitcoin full node?
Ethereum is a competing cryptocurrency that has been generalized to support arbitrary application data.
SQRL is an authentication protocol that might be interesting to discuss and analyze.

Network Security

RFC-8446 describes the TLS protocol, version 1.3.
A document that summarizes the Kerberos v4 protocol.
A few notes on IPsec.
IPsec Evaluation. This document by Ferguson and Schneier is critical of the original IPsec design.

Host Security

The SetACL tool provides a powerful way to script ACL actions on Windows systems. Helge Klein also wrote a nice primer on how access control works in Windows.
This article describes the basics of file ACLs on macOS (which uses a different system than POSIX ACLs).