Course Schedule Winter 2017

This schedule is subject to change. Please check back frequently.

Week	Date	Topic	Readings
Week 1	Jan 3	Intro; Security & Crypto Crash Course I
Week 1	Jan 5	No class (to be rescheduled)
Week 2	Jan 10	Security & Crypto Crash Course II
Week 2	Jan 12	TLS and HTTPS	Assigned: DROWN: Breaking TLS using SSLv2. Aviram, Schinzel, Somorovsky, Heninger, Dankel, Steube, Valenta, Adrian, Halderman, Dukhovni, Käsper, Cohney, Engels, Paar, Shavitt, Openssl. Usenix Security. 2016. Attacks Only Get Better: Password Recovery Attacks Against RC4 in TLS. Garman, Paterson, Van Der Merwe, Holloway. Usenix Security. 2015. Recommended: Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice. Adrian, Bhargavan, Durumeric, Gaudry, Green, Halderman, Heninger, Springall, Thomé, Valenta, Vandersloot, Wustrow, Paul. CCS. 2015. Lucky thirteen: Breaking the TLS and DTLS record protocols. AlFardan, Paterson. Oakland. 2013. The First Few Milliseconds of an HTTPS Connection. Moser. 2009. The Transport Layer Security (TLS) Protocol, Version 1.2. Dierks, Rescorla. 2008.
Week 3	Jan 17	Certificates	Assigned: SoK: SSL and HTTPS: Revisiting past challenges and evaluating certificate trust model enhancements. Clark, Van Oorschot. Oakland. 2013. Keeping Authorities "Honest or Bust" with Decentralized Witness Cosigning. Syta, Tamas, Visher, Wolinsky, Gasser, Gailly, Ford. Oakland. 2016. Recommended: Analysis of the HTTPS Certificate Ecosystem. Durumeric, Kasten, Bailey, Halderman. IMC. 2013. Certified lies: Detecting and defeating government interception attacks against SSL (short paper). Soghoian, Stamm. FC. 2011. CONIKS: Bringing Key Transparency to End Users. Melara, Blankstein, Bonneau, Felten, Freedman. Usenix Security. 2015.
Week 3	Jan 19	No class (to be rescheduled)
Week 4	Jan 24	Secure Messaging	Assigned: SoK: Secure Messaging (extended version). Unger, Dechand, Bonneau, Fahl, Perl, Goldberg, Smith. 2015. Dancing on the Lip of the Volcano: Chosen Ciphertext Attacks on Apple iMessage. Garman, Green, Kaptchuk, Miers, Rushanan. Usenix Security. 2016.
	Jan 26	Isolation	Assigned: Native client: A sandbox for portable, untrusted x86 native code. Yee, Sehr, Dardyk, Chen, Muth, Ormandy, Okasaka, Narula, Fullagar. Oakland. 2009. Capsicum: practical capabilities for UNIX. Watson, Anderson, Laurie, Kennaway. Usenix Security. 2010. Recommended: Safe kernel extensions without run-time checking. Necula, Lee. SOSP. 1996. The Security Architecture of the Chromium Browser. Barth, Jackson, Reis. WWW. 2008.
	Jan 27 3–4:30pm in SS 107	Accountability & Tamper-evidence	Assigned: PeerReview: Practical Accountability for Distributed Systems. Haeberlen, Kouznetsov, Druschel. SOSP. 2007. Efficient Data Structures for Tamper-Evident Logging. Crosby, Wallach. Usenix Security. 2009. Recommended: Accountable Virtual Machines. Haeberlen, Aditya, Rodrigues, Druschel. OSDI. 2010. Verena: End-to-End Integrity Protection for Web Applications. Karapanos, Filios, Popa, Capkun, Berkeley. Oakland. 2016.
Week 5	Jan 31	BFT	Assigned: Practical Byzantine fault tolerance. Castro, Castro, Liskov, Liskov. OSDI. 1999. The Honey Badger of BFT Protocols. Miller, Xia, Croman, Shi, Song. CCS. 2016. Recommended: The Byzantine Generals Problem. Lamport, Shostak, Pease. 1982. The Saddest Moment. Mickens. Usenix ;login:. 2013.
Week 5	Feb 2	Fork Consistency	Assigned: Secure untrusted data repository (SUNDR). Li, Krohn, Mazières, Shasha. OSDI. 2004. SPORC: Group Collaboration using Untrusted Cloud Resources. Feldman, Zeller, Freedman, Felten. OSDI. 2010. Recommended: Beyond one-third faulty replicas in Byzantine fault tolerant systems. Li, Mazières. NSDI. 2007. Depot: Cloud Storage with Minimal Trust. Mahajan, Setty, Lee, Clement, Alvisi, Dahlin, Walfish. OSDI. 2010. Social networking with frientegrity: privacy and integrity with an untrusted provider. Feldman, Blankstein, Freedman, Felten. Usenix Security. 2012.
Week 6	Feb 6 10:30am–12pm in SS 401 (note different room)	Property-preserving (revealing?) Encryption I	Assigned: CryptDB: Protecting Confidentiality with Encrypted Query Processing. Popa, Redfield, Zeldovich, Balakrishnan. SOSP. Building web applications on top of encrypted data using Mylar. Helfer, Valdez, Popa, Stark, Zeldovich, Kaashoek, Balakrishnan. NSDI. 2014. Recommended: Encrypted BigQuery Client. Google. 2016. SQL Server 2016 Always Encrypted (Database Engine). Microsoft. 2016.
	Feb 7	Property-preserving (revealing?) Encryption II	Assigned: Inference Attacks on Property-Preserving Encrypted Databases. Naveed, Kamara, Wright. CCS. 2015. Breaking Web Applications Built On Top of Encrypted Data. Grubbs, Mcpherson, Naveed, Ristenpart, Shmatikov. CCS. 2016. Recommended: Guidelines for Using the CryptDB System Securely. Popa, Zeldovich, Balakrishnan. 2015. Rebuttal to the CryptDB attack. Attacking Encrypted Database Systems. Kamara. 2015. Rebuttal to the rebuttal of the CryptDB attack. Response to "Breaking web applications built on top of encrypted data" (CCS 2016) by P. Grubbs, R. McPherson, M. Naveed, T. Ristenpart and V. Shmatikov. Helfer, Valdez, Popa, Stark, Zeldovich, Kaashoek, Balakrishnan. 2016. Rebuttal to the Mylar attack. Mylar: The Guide for the Perplexed. Grubbs, Mcpherson, Naveed, Ristenpart, Shmatikov. 2016. Rebuttal to the rebuttal of the Mylar attack. Leakage-Abuse Attacks Against Searchable Encryption. Cash, Grubbs, Ristenpart, Perry. CCS. 2015. What Else is Revealed by Order-Revealing Encryption?. Durak, Dubuisson, Cash. CCS. 2016.
	Feb 9	Trusted Computing	Assigned: A secure and reliable bootstrap architecture. Arbaugh, Farber, Smith. Oakland. 1997. Bootstrapping trust in commodity computers. Parno, McCune, Perrig. Oakland. 2010. Recommended: Reflections on trusting trust. Thompson. Communications of the ACM. 1984. The ten page introduction to trusted computing. Martin, Others. Computing Laboratory, Oxford University Oxford. 2008. TrInc: Small Trusted Hardware for Large Distributed Systems. Levin, Douceur, Lorch, Moscibroda. NSDI. 2009. Logical attestation: an authorization architecture for trustworthy computing. Sirer, de Bruijn, Reynolds, Shieh, Walsh, Williams, Schneider. SOSP. 2011.
Week 7	Feb 14	Trusted Execution Environments I	Assigned: Shielding applications from an untrusted cloud with haven. Baumann, Peinado, Hunt. SOSP. 2014. VC3: Trustworthy Data Analytics in the Cloud using SGX. Schuster, Costa, Gkantsidis, Peinado, Mainar-ruiz, Russinovich. Oakland. 2015. Recommended: Intel SGX Explained. Costan, Devadas. 2015. OpenSGX: An Open Platform for SGX Research. Jain, Desai, Kim, Shih, Lee, Choi, Shin, Kim, Kang, Han. NDSS. 2016.
Week 7	Feb 16	Side Channels I	Assigned: Cross-Tenant Side-Channel Attacks in PaaS Clouds. Juels, Ristenpart, Reiter. CCS. 2014. CacheBleed: A Timing Attack on OpenSSL Constant Time RSA. Yarom, Genkin, Heninger. CHES. 2016. Recommended: A note on the confinement problem. Lampson. CACM. 1973. Hey, you, get off of my cloud: exploring information leakage in third-party compute clouds. Ristenpart, Tromer, Shacham, Savage. CCS. 2009. When Good Randomness Goes Bad: Virtual Machine Reset Vulnerabilities and Hedging Deployed Cryptography. Ristenpart, Yilek. NDSS. 2010. Cross-VM side channels and their use to extract private keys. Zhang, Juels, Reiter, Ristenpart. CCS. 2012. Scheduler-based Defenses against Cross-VM. Varadarajan, Ristenpart, Swift. Usenix Security. 2014. Seriously, get off my cloud! Cross-VM RSA Key Recovery in a Public Cloud. Sinan İnci, Gülmezoğlu, Irazoqui, Eisenbarth, Sunar. 2015.
Week 8	Feb 21	Side Channels II	Assigned: Controlled-channel attacks: Deterministic side channels for untrusted operating systems. Xu, Cui, Peinado. Oakland. 2015. On Subnormal Floating Point and Abnormal Timing. Andrysco, Kohlbrenner, Mowery, Jhala, Lerner, Shacham. Oakland. 2015. Recommended: RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis. Genkin, Shamir, Tromer. CRYPTO. 2014. Get Your Hands Off My Laptop: Attacks on PCs. Genkin, Pipman, Tromer. Journal of Cryptographic Engineering. 2014. Stealing Keys from PCs using a Radio: Cheap Electromagnetic Attacks on Windowed Exponentiation (extended version). Genkin, Pachmanov, Tromer. CHES. 2015.
Week 8	Feb 23	Trusted Execution Environments II	Assigned: Observing and Preventing Leakage in MapReduce. Ohrimenko, Costa, Gkantsidis. CCS. 2015. Oblivious Multi-Party Machine Learning on Trusted Processors. Ohrimenko, Schuster, Fournet, Nowozin, Vaswani, Costa, Ohrimenko, Schuster, Nowozin, Vaswani, Costa. Usenix Security. 2016. Recommended: Orthogonal Security with Cipherbase. Arasu, Blanas, Eguro, Kaushik, Kossmann, Ramamurthy, Venkatesan. CIDR. 2013. Oblivious Query Processing. Arasu, Kaushik. ICDT. 2014.
Week 9	Feb 28	Verifiable Computation I	Assigned: Verifying computations without reexecuting them: from theoretical possibility to near practicality. Walfish, Blumberg. ECCC. 2013. Pinocchio: Nearly practical verifiable computation. Parno, Howell, Gentry, Raykova. Oakland. 2013. Recommended: Making argument systems for outsourced computation practical (sometimes). Setty, McPherson, Blumberg, Walfish. NDSS. 2012. Taking proof-based verified computation a few steps closer to practicality. Setty, Vu, Panpalia, Braun. Usenix Security. 2012. Resolving the conflict between generality and plausibility in verified computation. Setty, Braun, Vu, Blumberg, Parno, Walfish. EuroSys. 2013.
Week 9	Mar 2	Verifiable Computation II	Assigned: Verifying computations with state. Braun, Feldman, Ren, Setty, Blumberg, Walfish. SOSP. 2013. Succinct Non-Interactive Zero Knowledge for a von Neumann Architecture. Ben-sasson, Chiesa, Tromer. Usenix Security. 2014. Recommended: Verifiable computation with massively parallel interactive proofs. Thaler, Roberts. HotCloud. 2012. Geppetto: Versatile Verifiable Computation. Costello, Fournet, Howell, Kohlweiss, Kreuter, Naehrig, Parno, Zahur. Oakland. 2015.
Week 10	Mar 7	Cryptocurrencies I	Assigned: SoK: Research Perspectives and Challenges for Bitcoin and Cryptocurrencies. Bonneau, Miller, Clark, Narayanan, Kroll, Felten, Foundation. Oakland. 2015. Zerocash: Decentralized Anonymous Payments from Bitcoin. Ben-sasson, Chiesa, Garman, Green, Miers, Tromer. Oakland. 2014. Recommended: Bitcoin: A Peer-to-Peer Electronic Cash System. Nakamoto. 2008. TumbleBit: An Untrusted Bitcoin-Compatible Anonymous Payment Hub. Heilman, Alshenibr, Baldimtsi, Scafuro, Goldberg. NDSS. 2017. Ethereum: a secure decentralised generalised transaction ledger. Wood. Ethereum Project. 2014. Hawk: The Blockchain Model of Cryptography and Privacy-Preserving Smart Contracts. Kosba, Miller, Shi, Wen, Papamanthou. Oakland. 2016.
Week 10	Mar 9	Cryptocurrencies II	Assigned: Bitcoin-NG: A Scalable Blockchain Protocol. Eyal, Gencer, Sirer, van Renesse. NSDI. 2016. Enhancing Bitcoin Security and Performance with Strong Consistency via Collective Signing. Kokoris-Kogias, Jovanovic, Gailly, Khoffi, Gasser, Ford. USENIX Security. 2016. Recommended: Bitcoin over tor isn't a good idea. Biryukov, Pustogarov. Oakland. 2015. Eclipse Attacks on Bitcoin's Peer-to-Peer Network. Heilman, Kendler, Zohar, Goldberg. Usenix Security. 2015. Teechan: Payment Channels Using Trusted Execution Environments. Lind, Eyal, Pietzuch, Sirer. Draft. 2016.

Unfortunately, some articles require a paid subscription to a journal or digital library. These articles are linked via the UChicago library proxy, and you must authenticate with your CNetID to view them.