Synopsis:- Seminar, Praktische Informatik
- 2h each week, 2 SWS
- Students will present a selection of papers that will help you understand which threats exist, judge their significance and learn methods to defend your system against hackers. In addition you will explore the mathematical underpinnings of today's most common security tools and protocols.
Credits: In order to obtain credits for this seminar, participants are expected to: - Is possible for Bachelor.
- This seminar can be combined with "VL IT-Sicherheit Grundlagen" "Modul mit Seminar (BSEM)" zur Studienordnung Bachelor Informatik (Mono-Bachelor) [link]
- Attend regularly (at least 80%).
- Read each paper before the seminar, to be adequately prepared for discussion.
- Research an assigned subject; present major findings (30 min presentation; 15 min discussion).
- Presentations will be evaluated by two members of the audience at the end of each class (Bewertungskriterien-Seminarvortrag.pdf).
- Presenters summarize their in a term paper (German or English).
The paper should have 6 .. 10 pages (without counting the references), and should contain, abstract, motivation, related work, presentation of topic, conclusion and references. - Presentations may be given in German or English.
Prerequisites: - This seminar is suitable for students of all technical science disciplines who have previously completed courses "GdP" and "algorithms and data structures" or equivalent.
Topics (19/20 assigned): - ---Post Quantum Cryptography---
- Motivation und Survey (Grover, Shor, Timeline, Recommendations, Challenge) [pdf][NIST][https]
- Quantum Cryptography [pdf:Kapitel 4][pdf] (Julian)
- HASH-based Signatures [https][pdf] (Ren)
- NIST FIPS205 "Stateless Hash-Based Digital Signature Standard" [pdf]
- NIST FIPS204 "Module-Lattice-Based Digital Signature Standard" [pdf]
- NIST FIPS203 "Module-Lattice-Based Key-Encapsulation Mechanism Standard" [pdf] (Mylan)
- Signal ML-KEM Braid [https][https] (Vicco)
---Private or Anonymous Communication: Tools, Building blocks & Limits--- - Password Hashing [html][git][pdf] (Jonas)
- One-TIME-Passwords [RFC6238][RFC4226][https] (Hung)
- TOR the onion router [pdf][Attack: pdf][Datagram: pdf] (Martin)
- OTR Off-the-Record Messaging Protocol (version 3) [https]
- Telegram [html][html][html][pdf] (Maksym)
- Signal [https][https][git] (Tizian)
- Kryptografie mit elliptischen Kurven, ECDSA [pdf] (Khanh)
- Dragonfly Key Exchange [RFC] (Jiho)
- VeraCrypt [https][Probleme] (Mika)
---Authentication: Techniques and Tokens--- - Mozilla Sync 1.5 API (Theory and Praxis) [https][https]
- WebAuthn / FIDO2 / U2F / [W3C][Video][https][Demo] (Maximilian)
- Selective Disclosure for JSON Web Tokens [RFC 9901]
- Direct Anonymous Attestation (DAA) [pdf]
- ---German electronic IDs---
- ePASS [ICAO]
- nPA: PACE, EAC [TR-03110]
---Network--- - WLAN WPA-2 KRACK [https][pdf] (Victoria)
- Bluetooth Pairing / KNOB-Attack [Specification / 4.2 Security, 4.2.2 Pairing] [https] (Oliver)
- TLS 1.3 [blog][RFC] (David)
- TLS Revocation Mechanismen (CRL, OCSP, OCSP-stapling) in Theorie & Praxis [https]
- QUIC: A UDP-Based Multiplexed and Secure Transport [RFC9000][RFC9001 TLS] (Liliia)
- OpenVPN & DCO [pdf][https][https][https]
- WireGuard [pdf] (Levi)
- --- (further topics are possible, also own interesting suggestions are welcome) ---
- Wie sich Betrug und Hype über Telegram-Kanäle verbreiten: Analyse öffentlicher Krypto-Kanäle (Olga)
Syllabus: | Date | Presenters | Topic | Slides | | 13.10.26 | | bootstrap / assignment of topics | [pdf] | | 20.10.26 | (optional) | (optional) consultation (fine tuning of topics) | | | 27.10.26 | all | elevator speeches (3 min) | | 03.11.26
| Julian
Mylan | Quantum Cryptography
NIST FIPS203 ML-KEM | | 10.11.26
| Jonas
Hung | Password Hashing
One-TIME-Passwords | | 17.11.26
| Khanh
Ren | Kryptografie mit elliptischen Kurven, ECDSA
HASH-based Signatures | | 24.11.26
| Victoria
Oliver | WLAN WPA-2 KRACK
Bluetooth Pairing / KNOB-Attack | | 01.12.26
| Maksym
Martin | Telegram
TOR the onion router | | 08.12.26
| Tizian,
Vicco | Signal
Signal ML-KEM Braid | | 15.12.26
| Mika
Olga | VeraCrypt
Wie sich Betrug und Hype über Telegram … | | 05.01.27
| Jiho
Maximilian | Dragonfly Key Exchange
WebAuthn / FIDO2 / U2F | | 12.01.27
| David
Liliia | TLS 1.3
QUIC | | | 19.01.27 | | kein Seminar | OmniSecure | | 26.01.27 | Levi | WireGuard | | | 02.02.27 | | Reserve | | | 09.02.27 | | Prüfungszeitraum / letzte Reserve | |
Recent / Incoming:
- BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses [pdf]
- Bluetooth-Lücke: Tastenanschläge in Android, Linux, iOS und macOS einschleusbar [html]
- Unsiche Implementierung PhotoTAN [https]
- Tails -The Amnesic Incognito Live System [https]
- Email 3.0 [http]
- TOR Hardware:SpOnionPi [Spiegel]
- Verschlüsselungssoftware TrueCrypt: Ein Zweifel weniger [heise]
- NFC-Smartphones als sichere Chipkartenleser [http]
- Browser Fingerprinting [Golem][Diplomarbeit]
Further Readings (Research@SAR & Books): | |
