CPSC 444/544: Real-World Cryptography
2025 Spring
- Instructor: Fan Zhang
- Time and location TBD
Course Description
Growing privacy and security concerns motivate the development of trustworthy systems—computer systems whose security, privacy, and availability are based on well-defined assumptions rather than trust in their operators. This course will study the design principles in real-world trustworthy systems, focusing on their cryptographic techniques. Topics include secure networking and messaging, attested execution, credentials and authentication, and payments. We will also cover decentralization, a powerful emerging paradigm of trustworthy systems.
Prerequisites
This course is aimed at PhD and MS students and advanced undergraduates. It is highly recommended for students to be familiar with concepts of computer security (e.g., from CPSC 413 and/or CPSC 467).
Grading
Coursework includes homework and written responses to reading assignments. Graduate students will present at the end of the semester.
- For undergraduate students: Reading response/paper critiques (30%), problem sets and labs (70%)
- For graduate students: Reading response/paper critiques (20%), problem sets and labs (60%), presentation (30%)
Schedule
Go to this Google doc.
We will study the following key techniques used to design trustworthy systems.
- Secure transport: One of the most basic building blocks is secure transport — transferring network packets between Alice and Bob, with Eve fiddling in the middle. We will start by reviewing the cryptography behind TLS (Transport Layer Security, the protocol that encrypts the Internet) and delve into security challenges in the wild (such as handshake attacks, unreliable CAs, and massive network surveillance) and how to tackle them using more cryptography (such as certificate transparency, anonymity network).
- Secure messaging: Somewhat counterintuitively, plain TLS may not be suitable for messaging, especially under the threat of massive surveillance. We will study new tools behind “end-to-end encrypted messaging systems” such as the Signal app.
- Attestation execution: While TLS protects the link, the next question is how to protect the endpoints. How can Alice verify that the server is running the code as advertised (e.g., that it runs ChatGPT4o instead of a cheaper version)? We will study TEEs (trusted execution environments) that can enable such verifiability.
- Identity and credentials: With TLS, Alice can verify that she is talking with the right website, but how can a website verify that it’s communicating with the right user? After all, users are not machines and cannot store long secrets in their heads.
- Decentralized computation: As an exciting emerging technology, Internet-scale consensus algorithms (aka blockchains) allow users to engage in finance activities (e.g., transactions and exchanges) without trusting an intermediary. We briefly discuss the cryptography behind these decentralized systems.
There are many other topics of interest that we don’t have time to cover (secure voting, for instance), which would make good topics for the presentations at the end of the semester.