MW 7:00pm - 8:15pm; MH 234 (MacQuarrie Hall) - Click here for SJSU campus maps

First lecture: Wed., Aug. 26 1998
Last lecture: Wed., Dec. 9 1998

No lecture on Labor Day: Mon., Sep. 7 1998
No lecture during Thanksgiving break: Wed., Nov. 25 1998

Last day to add/drop classes: Wed. Sep. 23 1998

Duncan Hall 209; +1 (408) 924-5286

This course offers an introduction to topics in computer and network security. The basics of the theory behind cryptography are covered. The course teaches how to use cryptography in support of security services. It explains the types of security services needed in distributed systems and computer networks and finally discusses selected practical aspects of and current public issues in computer security and cryptography.

The course is intended for graduate students who are interested in learning the basic concepts, principles, and mechanisms that will allow them to identify, understand, analyze, and perhaps solve security problems in computer and distributed systems.

• Charles Pfleeger, Security in Computing, Second Edition, Prentice Hall, Englewood Cliffs, NJ. 1997.

• Warwick Ford, Computer Communications Security: Principles, Standard Protocols and Techniques, Prentice Hall, Englewood Cliffs, NJ. 1994.
• William Stallings, Network and Internetwork Security - Principles and Practice. Prentice Hall, Englewood Cliffs, NJ. 1995.
• Charlie Kaufman, Radia Perlman, and Mike Speciner, Network Security - Private Communication in a Public World, Prentice Hall, Engelwood Cliffs, NJ. 1995.
• Edward Amoroso, Fundamentals of Computer Security Technology, Prentice Hall, Engelwood Cliffs, NJ. 1994.
• Dorothy Denning, Cryptography and Data Security, Addison Wesley Publishing Company, Inc. 1982.
• Bruce Schneier, Applied Cryptography, Second Edition, Wiley. 1995.
• Douglas Stinson, Cryptography - Theory and Practice, CRC Press Inc. 1995.
• Richard Smith, Internet Cryptography, Addison Wesley Publishing Company, Inc. 1997.
• David Icove, Karl Seger, and William VonStorch, Computer Crime: A Crimefighter's Handbook. O'Reilly & Associates. 1995.
• Marshall Abrams, Sushil Jajodia, and Harold Podell(eds.), Information security: an integrated collection of essays. IEEE Computer Society Press. 1995.
• Simson Garfinkel and Eugene Spafford, Practical UNIX & Internet Security, Second Edition, O'Reilly and Associates, Inc., Sebastopol, CA. 1996.
• William Cheswick and Steven Bellovin, Firewalls and Internet Security: Repelling the Wily Hacker, Addison-Wesley. 1994.
• William Stallings, Practical Cryptography for Data Internetworks, IEEE Computer Society Press. 1996.
• David Kahn, The Codebreakers, Scribner. 1996.
• Clifford Stoll, The Cuckoo's Egg: Tracing a Spy Through the Maze of Computer Espionage, Doubleday. 1989.

cs286-2@subfour.eng.sun.com

Please use the mailing list for posting questions and answers that are of general interest to everybody. The instructor will send class announcements about homework, exams, etc. to this list, so it is important that you check your e-mail frequently, or you may miss an important announcement.

All written and programming assignments are due at the beginning of class on the due date stated on the homework (unless otherwise noted). Assignments will be graded as quickly as possible - usually within three class periods.

Assignments can be submitted hand written or type set. They must be legible and carry the student's name and ID number on each submitted page. If pages are stapled, name and ID on the first page are sufficient. All electronic submissions (program source code, make files, scribe notes, etc.) must have name and ID in a comment block at the beginning of each file.

Any assignment that cannot be read will score zero points. For example, variables, factors, and exponents must be distinguishable. A reasonable standard of English expression and grammar is also required. The same rules apply to exams.

Although this is not a software engineering course, programs must exhibit high standards of programming style, structure, layout, and documentation. Efficient algorithms and appropriate data structures should be used. It must be evident how the code was tested, either through documentation of code testing, or through the inclusion of test programs or self-checking code. Comments in the code should be helpful and enlightening. This is especially important if a submitted program does not run. Note that correct programs may lose points for failing to live up to the outlined programming standards.

See Handouts for an example assignment and solution.

Presentations must be kept under 10 minutes, ideally even shorter. Students should restrict their presentations to explain the core concept of the chosen paper and its implications. 10 minutes are enough time for that.

The papers are chosen to supplement the course material, therefore exam questions can cover this material. This assignment offers students the opportunity to study a topic in the course in more depth. It requires understanding the material and exercising critical thinking in exploring its consequences. Furthermore, presentation and defense of results through Q&A are valuable skills to learn in graduate school.

Papers and the associated presentation times will be randomly assigned to students. Students may exchange their presentation dates (incl. paper, of course) with other students, for reasons such as scheduling conflicts or special interest in certain papers. Please inform the instructor of any such exchanges ahead of time.

To make the scribe notes available in a timely fashion, they are due at 5pm, two days after the recorded lecture, i.e., lecture notes for Monday lectures are due the same week Wednesday 5pm, lecture notes for Wednesday lectures are due the same week Friday 5pm. Again, the order will be randomly assigned.

Students must propose their own project. To do that, a student must write up a project proposal and turn it in to the instructor for approval at or before the day the midterm is given. The proposal must contain a description of the project and a list of exact deliverables. It is not acceptable to propose a project that is re-used, i.e., is not newly created from scratch for this course.

Here is a list of possible projects:

• Multiplayer mental poker
• Secure file transfer via DES, session key generation, distribution, and verification à la PEM
• Byte-stream security - secure sockets library using DES encryption and Needham-Schroeder authentication
• Encrypting Telnet Proxy: SSL ecnryption and session key distribution on one side, supported by telnet authentication option of RFC 1416
• Secure talk implementation: DES encrypted communication between clients via a trusted server
• Internet Firewalls: comparison of available internet firewall products plus an evaluation of security of a portion of the campus network using Satan
• Security on top of Sockets: plug-in replacement for socket communication, providing secure communication using IDEA and Diffie-Hellman key exchange
• Survey and library of probabilistic methods for primality testing
• Analysis of Java security: from compiler through byte code verifier to run-time system
• Secure DNS client implementation: modification of DNS client library to conform to Eastlake-Kaufman DNS security specs
• Analysis of network security for a public safety department
• High-level language for expressing access control requirements for Web pages

Extra credit is not counted directly towards grades. It will count in the student's favor in borderline cases. It is not wise to skip regular assignments and do the extra credit instead. Failure to turn in extra credit assignments will never count against the student's grade. Such assignments are provided to give students an opportunity to work on additional, interesting and often very challenging problems.

Midterm - Monday, October 19 1998, in class
(covering all material up to Midterm)

Final examination - Monday, December 14, 7:45pm-10:00pm, MH 234
(covering all material, unless explicitly excluded.)

No early or late exams will be given. Exams are closed book. There will be no makeup exams. If an exam is missed, it will score zero points.

Hints on how to study for exams will be provided closer to the exam dates.

20% Homework and programming assignments

10% Paper presentation and Q&A, scribe notes

20% Course project

20% Midterm grade and quizzes

30% Final examination grade

My grading system is designed to be a fair evaluation of the degree of success that students have obtained in demonstrating their mastery of the material covered. I will maintain high standards in grading, simply because good students deserve to receive higher marks than average.

If a delay is foreseeable because of very compelling reasons, it is wise to contact the instructor well before the assignment deadline is missed.

If the instructor accepts a late assignment, it will be penalized (10\% per day). No assignments are accepted more than one week after the due date. They are counted as if they were not turned in.

Assignments may be discussed with classmates or with the instructor to get a critique of ideas and better understanding of the concepts behind assignments. Students are encouraged to consult the library or online resources as necessary. It is OK to seek help while debugging a program once it is written. Students are encouraged to collaborate in preparations for paper presentations and the writing of scribe notes. However, credit will only go to the presenter/submitter.

At the same time, all other homework, programming assignments, and exam work submitted for credit must be the student's own work. In particular, the solutions, ideas, and words submitted must not be shared with classmates. Homework solutions must be written by each student. Homework solutions may neither be read nor copied by other students. Programs must be created, typed, and documented by each student. Programs must be solely their creation. It is recommended to save all handwritten notes and printouts generated until the end of the semester. This is a protective precaution for the authors of work in the event of plagiarism or loss of submitted work. Any missing output should be reported to the instructor immediately.

Plagiarism and cheating are very serious offenses and will not be tolerated. Any unproper collaboration is considered cheating and will be dealt with according to University policies. Also refer to p. 430 in the SJSU Course Catalog 1998-2000. The instructor is available to clarify these rules.

• Consult the course Web pages.
• Consult instructor postings from mailing list.
• Students are encouraged to post questions and answers to other students' questions via the mailing list.
• If none of the above helps: send e-mail to the instructor.
• If none of the above helps: ask during class or talk to the instructor during office hours.