Winter
2013/14

Electronic Identity
[32259] SE  (2 SWS, Dipl. 3 SP / Ba. 3 SP),
Fr 9:15-10:45 RUD25, 3'113
Instructor: Dr. Wolf Müller
 

Computer Science Department
Systems Architecture Group

• Seminar, Praktische Informatik
• 2h each week, 2 SWS
• Students will present a selection of papers that will help you understand which threats exist, judge their significance and learn methods to defend your system against hackers. In addition you will explore the mathematical underpinnings of today's most common security tools and protocols.

Credits:

  In order to obtain credits for this seminar, participants are expected to:

• Is possible for Bachelor, Diplom (degree of difficulty)
• This seminar can be combined with "VL IT-Sicherheit Grundlagen" "Modul mit Seminar (BSEM)" zur Studienordnung Bachelor Informatik (Mono-Bachelor) [link]
• Dipl. 3 SP / Ba. 3 SP
• Attend regularly (at least 90%).
• Read each paper before the seminar, to be adequately prepared for discussion.
• Research an assigned subject; present major findings (45 min presentation; 30 min discussion).
• Presentations will be evaluated by two members of the audience at the end of each class (Bewertungskriterien-Seminarvortrag.pdf).
• Presenters summarize their in a term paper (German or English).
• Presentations may be given in German or English. All documents are in English (exceptions may be granted).

Prerequisites:

• This seminar is suitable for students of all technical science disciplines who have previously completed courses PI 1,2 or equivalent.

Wiki:

• In addition to the seminar home page (this page), there is a WIKI for dynamically added content, e.g. contributions by students: https://sarwiki.informatik.hu-berlin.de/W2013-EI.

Topics

• ---Private or Anonymous Communication: Tools, Building blocks & Limits---
• Survay "Was ist noch sicher" [html][BSI pdf, TLS pdf]
• ECC elliptic curve cryptograpy [pdf][pdf][pdf]
• TOR the onion router [pdf][Attack: pdf][Datagram: pdf]
• JAP "Revocable Anonymity" [http][pdf]
• openPGP [RFC][Handbook GNUpg pdf]
• TrueCrypt [http]
• Zerocoin [http]
• ---Authentication: Techniques and Tokens---
• HASH-basierte Signaturen [https]
• Mozilla Persona [http][persona.org]
• oAuth2 [oauth.net/2 ]
• W3C Web Cryptography API [http]
• On Breaking SAML: Be Whoever You Want to Be [https]
• OpenID 2.0 [http] and OpenID Connect [http]
• U-Prove (Technology Overview) [https]
• IDEMIX, Identity Mixer [http]
• ---German electronic IDs---
• DE-Mail [https]
• ePASS [ICAO]
• nPA: PACE, EAC [TR-03110]
• Domain-Specific Pseudonymous Signatures for nPA [pdf]
• ... (further topics are possible, also own interesting suggestions are welcome)

Syllabus:

Recent / Incoming:

• Tails -The Amnesic Incognito Live System [https]
• Email 3.0 [http]
• TOR Hardware:SpOnionPi [Spiegel]
• Verschlüsselungssoftware TrueCrypt: Ein Zweifel weniger [heise]
• NFC-Smartphones als sichere Chipkartenleser [http]
• Browser Fingerprinting [Golem][Diplomarbeit]
• fahrCard (zukünftiges eTicket der BVG) [faq]
• Startschuss für das elektronische Ticket in der Hauptstadtregion [pdf]
• (((eTicket Deutschland Einfach grenzenlos – grenzenlos einfach [pdf]
• Heise:TR: "Jetzt funkt's an der Kasse" [http]
• eSign:
  http://heise.de/-1736387 , http://heise.de/-1751434
  http://www.bundesdruckerei.de/de/199-sign-me 
  https://www.chipkartenleser-shop.de/shop/cert_bdr
   

Further Readings (Research@SAR & Books):

• BeID-Lab
• Security and Identity Management
• Claudia Eckert. IT-Sicherheit
• Ross Anderson. Security Engineering: A Guide to Building Dependable Distributed Systems.
• Bruce Schneier. Applied Cryptography: Protocols, Algorithms, and Source Code in C, Second Edition.