Instructor: Poorvi Vora, poorvi@gwu.edu, 706 Philips Hall. Office Hours: noon-3pm, Wednesdays

TA: Prof. Mohammed Obiedat

Text: Douglas Stinson, "Cryptography: Theory and Practice", Third Edition, 2005.

Course Content: Classical ciphers and cryptanalysis, Shannon's perfect secrecy, Feistel ciphers and DES, SPN's and AES, linear and differential cryptanalysis, public-key crypto (RSA, Discrete Log), secure hash.

Prerequisites: Discrete Mathematics, some complexity theory

Grading: For 6331: HWs (50%), Quizzes (25%), Mid-term (25%). For 4331: HWs (35%), Quizzes (25%), Mid-term (15%), Final (25%)
Late HWs are allowed till the HW solution is made available, but will be multiplied by a factor of (1.0 - n*0.1) where n is the number of days the submission is delayed. So, for example, if you submit your HW two days late, your grade on that HW will be multiplied by 0.8.

6331 and 4331 will be graded separately. If you are an undergrad, please consult your adviser before choosing to take 6331; graduate credit for 6331 is not automatic for undergrads, but all those enrolled in 6331 will be graded together.

Course Outline. Course outline modified after class on 10 Jan to reflect change in due date of HW 1 and to correct a couple of other typos in dates.

Planned Schedule

10 January, Lecture 1: Classical Ciphers and their cryptanalysis. Slides All of chapter 1 from the text except sections 1.1.5, 1.1.7, 1.2.3, 1.2.4, 1.2.5 and theorems in section 1.1.3. We will not be covering Hill Ciphers (sections 1.1.5 and 1.2.4) or cryptanalysis of the Vigenere Cipher (section 1.2.3) in this course, but we will cover stream ciphers and their cryptanalysis (sections 1.1.7 and 1.2.5) and the theorems from section 1.1.3 in later lectures. HW 1 assigned: Due on 24 January HW1 modified after class on 10 Jan to reflect change in due date and submission process.

17 January, Holiday: Martin Luther King Jr. Day

24 January, Lecture 2: Definitions: Groups and Rings. Block Ciphers: Substitution-Permutation Networks, Feistel Ciphers. Slides 3.1. 3.2, 3.5-3.7 from text, section 2 from Heys' report. HW 2 assigned: Due 7 February Example input file for the SPN problem. The block is of size 16 bits. The cipher is a four round cipher. Each round consists of a pad with a 16-bit key, an SPN layer of 4 S-boxes, each S-Box with a 4-bit input, and a permutation of all 16 bits. Notice that, in the input file, the cipher key is of size 10 bytes (2 bytes = 16 bits for each XOR, 5 XORS in all), the S-box array is of size 16 (2^4 possible S-box inputs) and the permutation array is also of size 16 (for a permutation of 16 bits). The message is of size 64 bits, and the operation is encryption. References H. M. Heys, Section 2, "A Tutorial on Linear and Differential Cryptanalysis", Technical Report CORR 2001-17, Centre for Applied Cryptographic Research, Department of Combinatorics and Optimization, University of Waterloo, Mar. 2001. (Also appears in Cryptologia, vol. XXVI, no. 3, pp. 189-221, 2002.)

31 January, Lecture 3: AES, DES, Section 3.3, 3.4 from text. References DES Standard AES Standard Animation of AES Encryption

7 February, Lecture 4: Linear Cryptanalysis. Slides. Sections 3 and 4 from Heys' report. References H. M. Heys, Section 2, "A Tutorial on Linear and Differential Cryptanalysis", Technical Report CORR 2001-17, Centre for Applied Cryptographic Research, Department of Combinatorics and Optimization, University of Waterloo, Mar. 2001. (Also appears in Cryptologia, vol. XXVI, no. 3, pp. 189-221, 2002.)

14 February, Lecture 5:Complete Linear Cryptanalysis, Differential Cryptanalysis. HW 3 assigned: Due 4 March

21 February, Holiday, President's Day.

28 February, Lecture 6: Secrecy Definitions.

7 March, Mid-Term on everything up to end of Lecture 6. You may refer to the text-book and your notes during the exam.

14 March Spring Break

21 March, Lecture 7: Complete secrecy.

28 March, Lecture 8: Stream Ciphers, Entropy: Section 1.1.7, 2.4 (no Huffman encodings) from text Efficient Exponentiation; Sections 5.1 and 5.3 from text. See also Fast Exponentiation notes and practice examples. References Coppersmith, Krawczyk, Mansour. "The Shrinking Generator", Crypto '93, LNCS 773, pages 22-39. Springer-Verlag, 1994. Beth and Piper, "The stop-and-go-generator" in Advances in Cryptology: Proceedings of Eurocrypt 84, Lecture Notes in Computer Science, Berlin: SpringerVerlag 1985, vol. 209, pp. 88-92. HW 4 assigned: Due 27 April Only for CS 6331; extra credit for CS 4331

4 April, Lecture 9: GCDs, multiplicative inverses, Euler Totient Functions. GCD RSA Sections 5.2.2 and 5.2.3 (only Thm. 5.4) from text From Text: Theorem 1.1 from section 1.1.3 with a proof not in the text. Section 5.2.1 (pages 163-164). Notes: GCD Basic Euclidean Algorithm Euclidean Algorithm for Inverse Practice problems from CS124: GCD Practice Problems Modular Inverse Practice Problems HW 5 assigned: Due 18 April

11 April, Lecture 10: Complete RSA, GCD, etc.

18 April, Lecture 11: El Gamal, DSA. section 6.1 from text. HW 6 assigned: Due date extended. Now due May 1.

25 April, Lecture 12: Complete El Gamal, DSA. Elliptic Curve Cryptography Certicom Tutorial

27 April WED, Lecture 13: Lecture presented by Kerry McKay. Secure Hash Functions Text, pages 119-131 and 137-139. Merkel-Damgard and MACs. Section 4.3 from text, up to and not including, Theorem 4.6. Algorithm 4.6, a special case of iterative hash functions. Section 4.4.2 from text. Complete SHA-1 from Secure Hash slide set. CS 4331 Final assigned: 27 April Due 9 May

Due May 9, Comprehensive final for 4331. No final for 6331