Computer Security (CIS-3240) Home Page

This is the home page for Peter Chapin's Computer Security course notes for the Fall 2025 semester. Here you will find electronic versions of class handouts, homework assignments, lecture slides, and links to other references of interest. If you are a student taking Computer Security, you should bookmark this page.

Lectures will be via Zoom.

The course syllabus gives an overview of the course and its content, lists course resources, and describes the grading policy and related issues.
The texts are in a curated playlist in the O'Reilly Collection. Use your VSC credentials to access it.
The homework submission area and grade book are on Canvas. All other course resources are here.
My page on GPG is a short overview of the basics of GPG.
I've prepared some general information on submitting assignments.
My home page contains other resources of potential interest.

Lecture Topics

The lectures for this course will be taught via Zoom.

2025-08-25. Introduction to the course and overview of some basic concepts in computer security.
2025-08-27. Discussed general concepts of symmetric encryption. Demonstrated the hexdump and count utilities and the substitution cipher program.
2025-09-01. No class (vacation).
2025-09-03. Demonstrated the hexdump and count utilities and the substitution cipher program. Introduced Feistel ciphers and DES.
2025-09-08. Discussed the AES. Introduced the One-Time Pad.
2025-09-10. Discussed the "three gnomes." Introduced block cipher modes. Discussed ECB mode, CBC mode, CFB, and CTR mode.
2025-09-15. Discussed cryptographic hash functions.
2025-09-17. Introduced public key cryptography.
2025-09-22. Continued discussion of public key cryptography. Discussed certificate chains. Demonstrated GPG.
2025-09-24. Discussed random number generation.
2025-09-29. Introduced security protocols via the timestamp protocol.
2025-10-01>. Discussed a voting protocol and introduced a progression of digital cash protocols.
2025-10-06. No class (Vacation).
2025-10-08. No class (Vacation).
2025-10-13. Introduced TLS.
2025-10-15. Continued discussing TLS by reviewing the TLS RFC.
2025-10-20. Discussed the Kerberos authentication protocol.
2025-10-22. Introduced host-based security and issues in access control (access control matrix, ACLs, capabilities, groups/roles).
2025-10-27. Introduced DAC vs. MAC. Discussed multi-level security.
2025-10-29. Introduced distributed access control, trust management, and the RT trust management system.
2025-11-03. Discussed Linux kernel security features.
2025-11-05. Discussed basic firewall configurations. Discussed CVEs and CWEs.
2025-11-10. Discussed buffer overflow vulnerabilities.
2025-11-12. Discussed secure information flow in software.
2025-11-17. ???
2025-11-19. ???
2025-11-24. No class (Vacation).
2025-11-26. No class (Vacation).
2025-12-01. Discussed the final homework assignment and the extra credit assignments (TLS and IPsec).

Slides

Introduction.
Symmetric Cryptography
Data Encryption Standard (DES)
The Three Gnomes
Encryption Modes
Cryptographic Hashes
Public Key Cryptography
Random Numbers
Transport Layer Security
Host Security
RT Trust Management System
Firewalls
Buffer Overflow. The attack code described in the slides is also available.
Secure Information Flow

Homework

Homework #1 Basic Security Concepts (DocBook source). Due: 2025-09-05
Homework #2 Block Ciphers (DocBook source). Due: 2025-09-19
Homework #3 Hashes and Public Key Cryptography (DocBook source). Due: 2025-10-17
Homework #4 Access Control. (DocBook source). Due: 2025-11-14
Homework #5 Security Protocols. (DocBook source). Due: 2025-12-19

The following assignments are extra credit (up to 10 pts each)

Homework #TLS. (DocBook source). Due: 2025-12-19 (if you choose)
Homework #IPsec. Due: 2025-12-19 (if you choose)

Resources/Articles

General References and Utilities

RFC Index. Here you can look up any RFC or browse the RFC index itself.
Notes on hexadecimal (hex) representation of binary values.
The ASCII table on Wikipedia.
This hexdump utility is sometimes useful for looking at the raw data contained in a file (Windows executable).
A program which counts characters in a file to explore that file's statistics (Windows executable), and a program that does a simple substitution cipher (Windows executable).
A plain (ASCII) text file that is nice to use for experimentation is RFC-2616 (for the HTTP protocol).
How to do some basic operations with the gpg program. Here is a page describing how to do symmetric encryption with GPG.

Cryptography

A Feistel cipher is a generalized structure used by many block encryption algorithms, including DES.
The Data Encryption Standard (DES) is an older algorithm that is no longer considered secure due to its small (56-bit) key size.
The NIST FIPS 46-3 document describing DES (withdrawn).
Is DES closed? This document describes why we care.
The Meet in the Middle Attack is why double encrypting isn't worth the effort.
Blowfish is an example of a cipher that uses the Feistel network.
The Advanced Encryption Standard (AES) is a newer encryption standard that is widely used.
The NIST FIPS 197 document describing AES.
An example showing one round of the AES computation (including the initial AddRoundKey step). The program MixColumns (Windows executable) does the column mixing step of AES. It is semi-interactive.
A brief overview of some symmetric encryption algorithms.
An example of the One-Time Pad with comments about its use.
This program does a simple bitwise XOR of the plaintext against a password (Windows executable). This method is easy to break, but has a tantalizing similarity to the One-Time Pad.
A nice page about block cipher modes on Wikipedia. The page includes some excellent diagrams.
A Wikipedia page describing the SHA family of secure hash algorithms.
A Wikipedia page describing in detail the specifics of the SHA-1 algorithm (with pseudocode).
A Wikipedia page describing the HMAC algorithm (RFC-2104)
NIST specification for Galois Counter Mode (GCM).
RANDOM.ORG is a website that generates true random numbers using atmospheric noise. It also contains a lot of information about randomness.
Recommendation for Random Number Generation Using Deterministic Random Bit Generators from NIST.
Some notes about cryptography. These notes summarize some main points made during the lecture.

Security Protocols

Security Protocol Notation (SPN).
Time stamp protocol described and analyzed.
Voting protocol described and analyzed.
Some digital cash protocols.
Needham-Schroeder Protocol. This Wikipedia article describes both the broken version and the fixed version.
The original paper on Bitcoin.
The Bitcoin website allows you to buy/sell Bitcoin and read information about the system.
Do you want to run a Bitcoin full node?
Ethereum is a competing cryptocurrency that has been generalized to support arbitrary application data.
SQRL is an authentication protocol that might be interesting to discuss and analyze.

Network Security

RFC-8446 describes the TLS protocol, version 1.3.
A document that summarizes the Kerberos v4 protocol.
A few notes on IPsec.
IPsec Evaluation. This document by Ferguson and Schneier is critical of the original IPsec design.

Host Security

The SetACL tool provides a powerful way to script ACL actions on Windows systems. Helge Klein also wrote a nice primer on how access control works in Windows.
This article describes the basics of file ACLs on macOS (which uses a different system than POSIX ACLs).
An overview of Linux kernel security features.
The Linux manual page on capabilities.
A few comments about Linux security modules.
The SELinux GitHub site has good documentation about SELinux. There is also a SELinux Wiki (out of date?).
How to install SELinux on Ubuntu 22.04. Be aware that snaps will not work after installing SELinux (even in permissive mode) because snaps rely on AppArmor, which must first be disabled to install SELinux.
My notes on SELinux.
This short tutorial provides some insight into how to use SELinux.
Common Vulnerabilities and Exposures (CVE) website. CVEs are specific vulnerabilities in publicly released software.
Common Weakness Enumeration (CWE) website. CWEs are vulnerability types. Many pieces of software might suffer from the same vulnerability type.
The home page for John the Ripper, a well-known password cracking tool. Hashcat is a newer password cracking tool that can take advantage of GPU acceleration.