Computer Security lecture notes Copyright © 2004 Mark Dermot Ryan
The University of Birmingham
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License,

Student-led seminars

Students will probably be asked to work in teams of three. Your presentation and its handout will be assessed.

Seminars should aim to

Supervision arrangements

  1. [Optional] Arrange a preliminary short meeting with your supervisor to get orientation about the topic and suggestions of references.  If you already have good ideas and knowledge of your topic, you don't need to have this meeting.

  2. Arrange a meeting with your supervisor three weeks before your presentation. By the time of this meeting, you should have
    1. decided how you are dividing the work between members of your group
    2. started the reading and research
    3. planned your presentation and drafted your handout at a high level.

  3. Arrange a meeting with your supervisor one week before your presentation. By this time, you should have everything in near-final form. Your supervisor can help you with minor adjustments.
Please look at the main page to see which supervisor has been allocated to your group. You can arrange your meetings at the lectures or by email:
Mark Ryan <M.D.Ryan at cs.bham.ac.uk>
Stefano Cattani <S.Cattani at cs.bham.ac.uk>

Assessment (50% on the seminar, 50% exam)

The 50% based on the seminar will be judged according to these criteria:

Some suggested topics and references

The topics that the instructors have particular interest in are near the top, so you are encouraged to pick one of those. The references/links given are certainly not complete or adequate! You need to do your own literature search. At the bottom of the list of topics, there are some interesting ones for which I haven't had the time to write a description or find a few links.

Sources of information

It's vital to get good sources on which to base your presentation. Obviously, there is a lot of information on the web, and if you select carefully then the web is a very valuable resource. But it's vital to select carefully, because there is a huge amount of rubbish, misunderstandings and poor explanations out there. Look at the author's name and the web site's name, as well as the content, to form your judgment. You should also use books. In a fast-moving area like computer security, books cannot be relied on for current practice and standards. But they can be more relied on for a sound theoretical basis, than the web. More selection has been done for you, by book authors and publishers, than by amateurs who write well-intended but ill-informed web pages.
  1. Steganography and digital watermarking are about techniques used to hide messages inside a file whose apparent purpose is something else. For example, one can hide a message in the least significant bit of each 24-bit pixel of an image file, without having an appreciable effect on the quality of the image. This is useful for digitally watermarking an image, to later claim ownership. To be effective, steganography should be
    Places to start your search include the information hiding homepage and the book Information hiding techniques for steganography and digital watermarking.

  2. Spyware and Trojan horses.
    Spyware is apparently useful software whose real purpose is to spy on your activities and report back to its master, who may hit you with targeted junk popups or worse. Example: Aureate.
  3. Zero Knowledge proofs are used to prove something without giving out any information: the prover can convince the verifier that he knows some secret without revealing anything about the secret and without enabling the verifier to replicate the proof to someone else. Among othe uses, Zero Knowledge techniques can be used for user identification purposes.

  4. Digital cash.
    The principal means to do transactions on the web today is by credit card. The idea of digital cash is to create a digital version of "real" money, that preserves anonymity, cannot be spent more than once and that is hard to forge.
    http://www.wisdom.weizmann.ac.il/~naor/PAPERS/untrace_abs.html
    http://www.cs.berkeley.edu/~daw/cs276/l25.ps
    http://citeseer.nj.nec.com/chaum89untraceable.html (to get the paper, click on one of the links at the top right corner)

  5. Electronic voting.
    It would be desirable to make use of new tecnologies to have new and more efficient voting methods and more and more governements are interested in this. But any electronic protocol for voting must support the typical requrements of a voting system, e.g. secrecy of votes, only authorised voters can vote and they can vote only once, etc. Voters should be able to verify that their vote was correctly registered and counted.
    http://www.edemocracy.gov.uk/
    http://www.eucybervote.org/
    http://www.thebell.net/papers/vote-req.pdf
    A critique of an implemented system, and the implementer's response (interesting)

  6. Random number generation is an important topic for cryptography, for generating keys. But most naive ways of generating random numbers are flawed because they are not truly random. PGP/GPG use mouse and keyboard events to help randomise. In your presentation, explain the problems; try to identify how serious they really are; and explain approaches and solutions.

    Preparing your presentation

    You must prepare a handout, and this will be part of the continuous assessment. You should decide whether to do "slides" or to have a essay-type handout and work with the blackboard. Slides have the advantage of being pre-prepared material for your audience to look at, which can help stop them glaring at you! If you do use slides, be careful not to write too much on each slide. Your audience will not be able to read it.


  7. SSL-TLS.
    The SSL protocol is used by browers to communicate with secure servers. It uses certificates and public key encryption.

  8. CSS and DeCSS.
    CSS is the encryption system used on DVD players, and DeCSS program encoding the crack, written by a 16-year old Norwegian programmer called Jon Johansen who wrote DeCSS.
    David Touretzky's DeCSS web page includes a tutorial and other resources.

  9. Human factors. Only half of computer security is about technology. The other half is the human. If  people choose their pet's name for their password, the system will be insecure. If banks don't use public key cryptography to sign their emails, their customers won't know if the emails are genuine or from fraudsters. Why don't they sign their emails? Why doesn't everyone? Why Johnny can't encrypt is an interesting article attempting to explain why people can't/don't want to use PGP. The problems here are the most difficult ones in computer security.

  10. Biometrics. Saviour or niche-market?
    Classify the main approaches and their associated problems.

  11. Programming language security. 
  12. Microsoft passport and other single-signon systems. How do they work? What are the issues and problems?
    Microsoft passport: http:...
    Liberty Alliance alternative single sign-on system. Aimed at corporations rather than individuals, in contrast with MSPP.

  13. Viruses and worms.
    This is a huge topic; you'll need to plan carefully.
  14. Firewalls. 
    Classify main types against network layers: packet firewalls, application firewalls, etc. What languages do large firewall vendors such as Cisco provide, in order to help manage the huge complexity of rule tables?

    The content of your presentation

    Seminars should aim to
    • have reasonable technical content
    • be understood by the audience
    • be accompanied by appropriate handouts (in an open non-proprietary format, such as HTML,  for convenient linkage to the module pages)
    • be interactive


  15. Security of Open-Source Software. 
    Why is OSS (such as the GNU/Linux operating system) much less vulnerable to attacks than MS Windows?
    Linux attacks increasing: http://msn.vnunet.com/News/1133518
    Linux viruses: http://www.claws-and-paws.com/virus/articles/linux_viruses.shtml

  16. Differential cryptanalysis. is an approach to trying to break crypto systems such as DES, which has been quite successful. It is based on comparing the encryptions of two plaintexts which differ only slightly. This topic is quite complicated, but enjoyable if you liked getting to understand the details of the crypto algorithms.

  17. Government control of crypto; the Clipper Chip. A few years ago the US government was bent on controlling crypto so that it could always decrypt messages sent by fraudsters, terrorists, enemy countries, etc. The Clipper chip was an effort at providing the government with escrowed keys. They banned export of crypto systems and software. Have they been defeated, and have they abandoned all their attempts at control? Or have they discovered an RSA exploit?

  18. Holes in popular software.

  19. NESSUS is a very powerful open-source tool designed to identify the presence of known security holes.

  20. DDoS. 

  21. P2P security.
    "Another worm is targeting the Kazaa Peer-to-Peer filesharing network" http://msn.vnunet.com/News/1133129

  22. Vulnerabilities on routers, switches, other hardware.
    Cisco using IIS software on its hardware, had to release firmware patch
    Known bugs with the Linksys cable/DSL routers (Linksys Cable/DSL version 1.42.7 (BEFSR11 / BEFSR41 / BEFSRU31) )
    Have a look here: http://www.governmentsecurity.org/exploits.php

  23. Kerberos.
  24. IPSec.
  25. Buffer overflow attacks.
  26. Intrusion detection systems.
    NIST special publication on Intrusion Detection Systems
  27. SSH.
More ideas

End