Winter
2018/19

Electronic Identity
Anmeldung in AGNES !

[3313015] SE  (2 SWS)
Mi 15:15-16:45 RUD 25, 3.113
Instructor: Dr. Wolf Müller

 


Computer Science Department
Systems Architecture Group

 

 
Abstract: The Internet was built without a way to know who and what you are connecting to. This limits what we can do with it and exposes us to growing dangers. If we do nothing, we will face rapidly proliferating episodes of theft and deception that
will cumulatively erode public trust in the Internet. [Kim Cameron, identityblog]


©xkcd
Synopsis:
  • Seminar, Praktische Informatik
  • 2h each week, 2 SWS
  • Students will present a selection of papers that will help you understand which threats exist, judge their significance and learn methods to defend your system against hackers. In addition you will explore the mathematical underpinnings of today's most common security tools and protocols.

Credits:

  In order to obtain credits for this seminar, participants are expected to:

  • Is possible for Bachelor.
  • This seminar can be combined with "VL IT-Sicherheit Grundlagen" "Modul mit Seminar (BSEM)" zur Studienordnung Bachelor Informatik (Mono-Bachelor) [link]
  • Attend regularly (at least 90%).
  • Read each paper before the seminar, to be adequately prepared for discussion.
  • Research an assigned subject; present major findings (30 min presentation; 15 min discussion).
  • Presentations will be evaluated by two members of the audience at the end of each class (Bewertungskriterien-Seminarvortrag.pdf).
  • Presenters summarize their in a term paper (German or English).
  • Presentations may be given in German or English. All documents are in English (exceptions may be granted).

Prerequisites:

  • This seminar is suitable for students of all technical science disciplines who have previously completed courses "GdP" and "algorithms and data structures" or equivalent.

Topics :

  • ---Private or Anonymous Communication: Tools, Building blocks & Limits---
  • Password Hashing [html][pdf] (Christopher)
  • HASH-basierte Signaturen [https] (Benjamin B.)
  • TOR the onion router [pdf][Attack: pdf][Datagram: pdf] (Rick)
  • openPGP [RFC][Handbook GNUpg pdf] (Niklas)
  • OTR Off-the-Record Messaging Protocol (version 3) [https] (Falko)
  • OMEMO (Multi-End Message and Object Encryption) [https][https][https]
  • TLS 1.3 [blog][RFC] (Maximilian)
  • Kryptografie mit elliptischen Kurven, ECDSA [pdf] (Hannes)
  • Dragonfly Key Exchange [RFC] (Quentin)
  • Post Quantum Key Exchange [pdf] (Kevin)
  • VeraCrypt [https][Probleme] (Benjamin E.)
    ---Authentication: Techniques and Tokens---
  • Password Manager (Tom)
    - "Password Managers: Attacks and Defenses" [pdf, page 449]
    - "The Emperor’s New Password Manager: Security Analysis of Web-based Password Managers" [pdf, page 465]
  • Mozilla Sync 1.5 API (Theory and Praxis) [https][https] (Benjamin L.)
  • oAuth2 [oauth.net/2 ] (Aaron)
  • W3C Web Cryptography API [http]
  • WebAuthn / FIDO / U2F / [W3C][Slides][https][pdf] (Piotr)
    ---German electronic IDs---
  • DE-Mail [https]
  • [TR-01201] (Adina)
  • ePASS [ICAO]
  • nPA: PACE, EAC [TR-03110] (Malte)
  • Elektronische Identitäten und Vertrauensdienste im E-Government [TR-03107-1][TR-03107-2]
  • One-TIME-Passwords [RFC6238][RFC4226][https] (Melanie)
    ---Payment---
  • Bitcoin [whitepaper] (Sebastian)
  • Vergleich: Sofortüberweisung, Giropay, Paydirekt [https][https][https] (Pascal)
  • PSD2 Fintech versus klassische Bank [http] (Sergej)
    ---Network---
  • WLAN WPA-2 KRACK [https][pdf] (Jan)
  • SSL/TLS Revocation Mechanismen (CRL, OCSP, OCSP-stapling) in Theorie & Praxis [https]
  • Browser Fingerprinting [Golem][Diplomarbeit] (Patrick)
  • ... (further topics are possible, also own interesting suggestions are welcome)

Syllabus:
 

DatePresentersTopicSlides
17.10.18Dr. Wolf Müllerbootstrap / assignment of topics 
24.10.18partialconsultation (fine tuning of topics) 
31.10.18allElevator Speach 
07.11.18AaronoAuth2
 
[pdf]
14.11.18Christopher
Benjamin B.
Password Hashing
HASH-basierte Signaturen
 
21.11.18Kevin
Jan
Post Quantum Key Exchange
WLAN WPA-2 KRACK
[pdf]
28.11.18Hannes
Quentin
ECC, ECDSA
Dragonfly Key Exchange
 
05.12.18Piotr
Maximilian
WebAuthn
TLS 1.3
 
12.12.18Malte
Benjamin E.
nPA: PACE, EAC
VeraCrypt
 
19.12.18Adina
Niklas
DE-Mail
openPGP
 
09.01.19Falko
Melanie
OTR
OTP
 
16.01.19Pascal
Sergej
Sofortüberweisung, Giropay, Paydirekt
PSD2
 
23.01.19 OMNISECURE 
30.01.19Benjamin L.
Tom
Mozilla Sync
Password Manager
 
06.02.19Rick
Sebastian
TOR
Bitcoin
 
13.02.19 Reserve[pdf]


Recent / Incoming:

Further Readings (Research@SAR & Books):cover

 Links
Cambridge
Ross Anderson's home page
Bruce Schneier
home page
Safe Personal Computing
NIST
Computer Security Resource Center
NIST
Federal Information Standards (FIPS)
CERT
cert.org
BSI
Bundesamt für Sicherheit in der Informationstechnik
Biometrics
Overview (DE)
OS specific
Windows-Security
Linux-Security
e-Learning
CrypTool (DE)

Legal disclaimer.   © 2018 Humboldt-Universität zu Berlin, Computer Science Department, Systems Architecture Group.Contact: sar@informatik.hu-berlin.de .