Cryptography and Computer Security for Undergraduates Paul De Palma Gonzaga University Gonzaga University Charles Frank Northern Kentucky University Northern Kentucky University Suzanne Gladfelter Penn State York Joshua Holden Rose-Hulman Institute of Technology

Inspiration “We stand today on the brink of a revolution in cryptography” “We stand today on the brink of a revolution in cryptography” Diffie & Hellman, 1976 Diffie & Hellman, 1976 “If all the personal computers in the world…were put to work on a single PGP-encrypted message, it would still take an estimated 12 million times the age of the universe, on average, to break a single message.” “If all the personal computers in the world…were put to work on a single PGP-encrypted message, it would still take an estimated 12 million times the age of the universe, on average, to break a single message.” William Crowell, Deputy Directory of the NSA, 1997 William Crowell, Deputy Directory of the NSA, 1997

Then Why Are Systems Vulnerable? Shortage of security personnel Shortage of security personnel From the NSA Website: From the NSA Website: “The National Plan for Information Systems Protection … highlights the acute shortage in the subset of trained information systems security personnel.” Cryptographic algorithms are embedded in real systems of staggering complexity. Cryptographic algorithms are embedded in real systems of staggering complexity.

The Federal Government’s Response NSA has established Centers of Academic Excellence in Information Assurance Education NSA has established Centers of Academic Excellence in Information Assurance Education Students in universities so designated are eligible for scholarships Students in universities so designated are eligible for scholarships The Cyber Security Research and Development Act (2002) provides $216 million to support training in computer security The Cyber Security Research and Development Act (2002) provides $216 million to support training in computer security

Computing Curricula 2001’s Response: The Context “Computing is a broad field that extends well beyond the boundaries of computer science” “Computing is a broad field that extends well beyond the boundaries of computer science” CC 2001 CC 2001 Chomsky once observed that the maturity of a discipline is inversely proportional to its size. Chomsky once observed that the maturity of a discipline is inversely proportional to its size. “I was so much older then, I’m younger than that now.” “I was so much older then, I’m younger than that now.”

NC3: Network Security (core component, Net-Centric Computing) NC3: Network Security (core component, Net-Centric Computing) OS7: Security and protection (elective component, Operating Systems) OS7: Security and protection (elective component, Operating Systems) AL9: Cryptographic algorithms (elective component, Algorithms and AL9: Cryptographic algorithms (elective component, Algorithms andComplexity) CS312: Cryptography (an advanced course, Algorithms and Complexity) CS312: Cryptography (an advanced course, Algorithms and Complexity) Security and Cryptographic Issues Appear Four Times in CC2001

CS312 Cryptography Topics Historical overview of cryptography Historical overview of cryptography Private-key cryptography and the key-exchange problem Private-key cryptography and the key-exchange problem Public-key cryptography Public-key cryptography Digital signatures Digital signatures Security protocols Security protocols Applications (zero-knowledge proofs, authentication, and so on) Applications (zero-knowledge proofs, authentication, and so on)

Initial Problems CS students have not studied number theory CS students have not studied number theory Mathematics students have not studied CS Mathematics students have not studied CS Turf battles between departments of mathematics and computer science Turf battles between departments of mathematics and computer science

More Significantly Cryptography without a significant consideration of complex systems is misleading Cryptography without a significant consideration of complex systems is misleading Most texts present crypto as if it were applied mathematics Most texts present crypto as if it were applied mathematics Crypto has a lively social context Crypto has a lively social context Battles over exporting strong crypto Battles over exporting strong crypto The Clipper Chip The Clipper Chip

In Sum Crypto is necessary for the CS curriculum Crypto is necessary for the CS curriculum Crypto will be hard for many CS majors Crypto will be hard for many CS majors Crypto enters an already crowded curriculum Crypto enters an already crowded curriculum Crypto must be placed in a systems context Crypto must be placed in a systems context Crypto materials: Crypto materials: