Cryptography and System Security Winter 2025
ECE 409

Notes.  It has been removed for the  prerequisite:  must have completed the following: ECE358 - Computer Networks (0.50)

This course will provide introduction to  cryptography and system security. It covers  basic concepts in cryptography and system security,   types of attacks, trust and threat models,  pseudorandomness, computational security,  symmetric-key  cryptography,  public-key cryptography,   attacks on cryptographic operations,   network security protocols,   wireless system security and privacy,  applications in IoT systems,   special topics on  privacy preserving  AI,   quantum key  distribution and post-quantum cryptography.  

Chapter 1. Introduction  to Cryptography  and System Security 

1. Cryptography and cryptanalysis
2. Basic protections: encryption and authentication
3. Classification of cryptosystems
4. Basic  concepts of secure systems.

Chapter 2. Security Metrics

1.  Types of attacks,  trust and threat model
2. Shannon's perfect secrecy
3. Computational security and one-way functions
4. Pseudo-randomness and pseudorandom generator (PRG)

Chapter 3. Symmetric-key Cryptographic Systems

1.  Arithmetics of binary finite fields
2. LFSR  based  PRG and correlation attacks
3. Stream ciphers:  A5/1,  Grain 2,  and lightweight WG
4. Block ciphers:  DES,   AES,  encryption modes, and CPA/CCA secure
5. Secure hash functions: SHA1, SHA2 and SHA3
6. MAC and forgery attack
7. Authenticate encryption:  GCM,   NIST LWC  (Ascon)
8. Time-memory trade-off attacks and attacks by AI

Chapter 4.  Public-key Cryptographic Systems

1. Arithmetic operations
2. Security of public-key cryptography (factorization, DL, LWE)
3. Practical public-key systems (DH, RSA, DSA, ECC)
4. Fully homomorphic encryption (FHE)
5. Hash chain and Merkle tree based authentication
6. Fault side-channel attacks

Chapter 5. Network Security Protocols

1. Implementing secure systems:  PKI  and  X.509 certificates
2. Establish protected communication:    the man-in-the-middle (MITM) attacks, mutual entity authentication, authenticated key  agreement (AKA), and cipher suite negotiation
3. Internet Key Exchange (IKE) and  IPsec
4. TLS/SSL
5. Hop-by-hop versus end-to-end protections and VPN
6. Attacks on TLS

Chapter 6. Wireless System Security

1.  Protect wireless links
2. Cellular solutions:  AKA for 4G-LTE/5G  and   air link protections
3. IEEE 802.11 (WiFi)  solutions:  flawed WEP   and   WPA2 (beyond)
4. 5G security architecture for IoT security and privacy
5. Attacks:  forgery attacks on 4G-LTE/5G and WiFi;  relay attacks on RFID

Chapter 7.  Special Topics: Privacy,  Quantum  and Post-quantum Cryptography

1. Privacy preserving machine learning: secret sharing; securing federate learning
2. Basic concepts for quantum cryptography
3. Quantum key distribution
4. Post-quantum cryptography

Note: Any prices provided in course outlines are best estimates based on recent online prices and do not include shipping or taxes. Prices may vary between retailers.

Text book:

There is no required textbook. But substantial course materials are taken from the following book and its supplemental materials:

  L.D. Chen and G. Gong,  Communication System Security,  CRC, 2012 (CG12).  E-book is accessible from UW library, and reserved (ECE 409 001). 

Supplemental Materials for the above book will be on UW-LEARN.  

The following reference books will be helpful for your reading. 

1. R. Anderson, Security Engineering A Guide to Building Dependable Distributed Systems, Wiley, 2014 (Anderson14).  Some contents of this book are available at http://www.cl.cam.ac.uk/~rja14/book.html
2. J. Katz and Y. Lindell,  Introduction to Modern Cryptography,  the 2nd edition, Chapman and Hall/CRC, 2014 (KL14), or the 3rd edition, 2020.
3. W. Stallings, Cryptography and Network Security: Principles and Practice. The latest is 7th Edition by  Pearson, 2016.

Other Resources

1. Matthew Green on cryptography engineering, https://blog.cryptographyengineering.com/useful-cryptography-resources/
2. Schneier on Security, http://www.schneier.com/blog/. A blog covering current computer security and privacy issues.

Course project can be individual or 2-person group.  

Generative AI

Generative artificial intelligence (GenAI) trained using large language models (LLM) or other methods to produce text, images, music, or code, like Chat GPT, DALL-E, or GitHub CoPilot, may be used for assignments in this class with proper documentation, citation, and acknowledgement. Recommendations for how to cite GenAI in student work at the University of Waterloo may be found through the Library: https://subjectguides.uwaterloo.ca/chatgpt_generative_ai. Please be aware that generative AI is known to falsify references to other work and may fabricate facts and inaccurately express ideas. GenAI generates content based on the input of other human authors and may therefore contain inaccuracies or reflect biases. 

In addition, you should be aware that the legal/copyright status of generative AI inputs and outputs is unclear. Exercise caution when using large portions of content from AI sources, especially images. More information is available from the Copyright Advisory Committee: https://uwaterloo.ca/copyright-at-waterloo/teaching/generative-artificial-intelligence 

You are accountable for the content and accuracy of all work you submit in this class, including any supported by generative AI. 

Faculty of Engineering Guiding Practices

Territorial Acknowledgement: The University of Waterloo acknowledges that much of our work takes place on the traditional territory of the Neutral, Anishinaabeg and Haudenosaunee peoples. Our main campus is situated on the Haldimand Tract, the land granted to the Six Nations that includes six miles on each side of the Grand River. Our active work toward reconciliation takes place across our campuses through research, learning, teaching, and community building, and is centralized within the Office of Indigenous Relations. 

Inclusive Teaching-Learning Spaces: The University of Waterloo values the diverse and intersectional identities of its students, faculty, and staff. The University regards equity and diversity as an integral part of academic excellence and is committed to accessibility for all. We consider our classrooms, online learning, and community spaces to be places where we all will be treated with respect, dignity, and consideration. We welcome individuals of all ages, backgrounds, beliefs, ethnicities, genders, gender identities, gender expressions, national origins, religious affiliations, sexual orientations, ability – and other visible and nonvisible differences. We are all expected to contribute to a respectful, welcoming, and inclusive teaching- learning environment. Any member of the campus community who has experienced discrimination at the University is encouraged to seek guidance from the Office of Equity, Diversity, Inclusion & Anti-racism (EDI-R) via email at equity@uwaterloo.ca. Sexual Violence Prevention & Response Office (SVPRO), supports students at UWaterloo who have experienced, or have been impacted by, sexual violence and gender-based violence. This includes those who experienced harm, those who are supporting others who experienced harm. SVPRO can be contacted at svpro@uwaterloo.ca

Religious & Spiritual Observances: The University of Waterloo has a duty to accommodate religious and spiritual observances under the Ontario Human Rights Code. Please inform the instructor at the beginning of term if special accommodation needs to be made for religious observances that are not otherwise accounted for in the scheduling of classes and assignments. Consult with your instructor(s) within two weeks of the announcement of the due date for which accommodation is being sought. 

Respectful Communication and Pronouns: Communications with Instructor(s) and teaching assistants (TAs) should be through recommended channels for the course (e.g., email, LEARN, Piazza, Teams, etc.) Please use your UWaterloo email address. Include an academic signature with your full name, program, student ID. We encourage you to include your pronouns to facilitate respectful communication (e.g., he/him; she/her; they/them). You can update your chosen/preferred name at WatIAM. You can update your pronouns in Quest. 

Mental Health and Wellbeing Resources: If you are facing challenges impacting one or more courses, contact your academic advisor, Associate Chair Undergraduate, or the Director of your academic program. Mental health is a serious issue for everyone and can affect your ability to do your best work. We encourage you to seek out mental health and wellbeing support when needed. The Faculty of Engineering Wellness Program has programming and resources for undergraduate students. For counselling (individual or group) reach out to Campus Wellness and Counselling Services. Counselling Services is an inclusive, non-judgmental, and confidential space for anyone to seek support. They offer confidential counselling for a variety of areas including anxiety, stress management, depression, grief, substance use, sexuality, relationship issues, and much more. 

Intellectual Property: Be aware that this course contains the intellectual property of their instructor, TA, and/or the University of Waterloo. Intellectual property includes items such as:

• Lecture content, spoken and written (and any audio/video recording thereof).
• Lecture handouts, presentations, and other materials prepared for the course (e.g., PowerPoint slides).
• Questions or solution sets from various types of assessments (e.g., assignments, quizzes, tests, final exams); and
• Work protected by copyright (e.g., any work authored by the instructor or TA or used by the instructor or TA with permission of the copyright owner).

Course materials and the intellectual property contained therein are used to enhance a student’s educational experience. However, sharing this intellectual property without the intellectual property owner’s permission is a violation of intellectual property rights. For this reason, it is necessary to ask the instructor, TA and/or the University of Waterloo for permission before uploading and sharing the intellectual property of others online (e.g., to an online repository).

Permission from an instructor, TA or the University is also necessary before sharing the intellectual property of others from completed courses with students taking the same/similar courses in subsequent terms/years. In many cases, instructors might be happy to allow distribution of certain materials. However, doing so without expressed permission is considered a violation of intellectual property rights and academic integrity.

Please alert the instructor if you become aware of intellectual property belonging to others (past or present) circulating, either through the student body or online.

Continuity Plan - Fair Contingencies for Unforeseen Circumstances (e.g., resurgence of COVID-19): In the event of emergencies or highly unusual circumstances, the instructor will collaborate with the Department/Faculty to find reasonable and fair solutions that respect rights and workloads of students, staff, and faculty. This may include modifying content delivery, course topics and/or assessments and/or weight and/or deadlines with due and fair notice to students. Substantial changes after the first week of classes require the approval of the Associate Dean, Undergraduate Studies.

Declaring absences: [undergraduate students and/or courses only]  Regardless of the process used to declare an absence, students are responsible for reaching out to their instructors as soon as possible. The course instructor will determine how missed course components are accommodated. Self-declared absences (for COVID-19 and short-term absences up to 2 days) must be submitted through Quest. Absences requiring documentation (e.g., Verification of Illness Form, bereavement, etc.) are to be uploaded by completing the form on the VIF System. The UWaterloo Verification of Illness form, completed by a health professional, is the only acceptable documentation for an absence due to illness. Do not send documentation to your advisor, course instructor, teaching assistant, or lab coordinator. Submission through the VIF System, once approved, will notify your instructors of your absence. 

Rescheduling Co-op Interviews: Follow the co-op process for rescheduling co-op interviews for conflicts to graded assignments (e.g., midterms, tests, and final exams). Attendance at co-operative work-term employment interviews is not considered to be a valid reason to miss a test.

Academic integrity: In order to maintain a culture of academic integrity, members of the University of Waterloo community are expected to promote honesty, trust, fairness, respect and responsibility. [Check the Office of Academic Integrity for more information.]

Grievance: A student who believes that a decision affecting some aspect of their university life has been unfair or unreasonable may have grounds for initiating a grievance. Read Policy 70, Student Petitions and Grievances, Section 4. When in doubt, please be certain to contact the department’s administrative assistant who will provide further assistance.

Discipline: A student is expected to know what constitutes academic integrity to avoid committing an academic offence, and to take responsibility for their actions. [Check the Office of Academic Integrity for more information.] A student who is unsure whether an action constitutes an offence, or who needs help in learning how to avoid offences (e.g., plagiarism, cheating) or about “rules” for group work/collaboration should seek guidance from the course instructor, academic advisor, or the undergraduate associate dean. For information on categories of offences and types of penalties, students should refer to Policy 71, Student Discipline. For typical penalties, check Guidelines for the Assessment of Penalties.

Appeals: A decision made or penalty imposed under Policy 70, Student Petitions and Grievances (other than a petition) or Policy 71, Student Discipline may be appealed if there is a ground. A student who believes they have a ground for an appeal should refer to Policy 72, Student Appeals.

Note for students with disabilities: AccessAbility Services, located in Needles Hall, Room 1401, collaborates with all academic departments to arrange appropriate accommodations for students with disabilities without compromising the academic integrity of the curriculum. If you require academic accommodations to lessen the impact of your disability, please register with AccessAbility Services at the beginning of each academic term.

Turnitin.com: Text matching software (Turnitin®) may be used to screen assignments in this course. Turnitin® is used to verify that all materials and sources in assignments are documented. Students' submissions are stored on a U.S. server, therefore students must be given an alternative (e.g., scaffolded assignment or annotated bibliography), if they are concerned about their privacy and/or security. Students will be given due notice, in the first week of the term and/or at the time assignment details are provided, about arrangements and alternatives for the use of Turnitin in this course.

It is the responsibility of the student to notify the instructor if they, in the first week of term or at the time assignment details are provided, wish to submit alternate assignment.