CS 341: Cryptography

Rich Graves's visit: sniffing, spoofing, passwords, etc.

8:30AM Wednesday, Feb 23.

Rich's recommended readings

A small amount of reading material might help get things going: A four-page article from 1979, and 23 PowerPoint slides from DEFCON 16.

  1. Robert Morris and Ken Thompson, "Password Security: A Case History," Encryption Computing, 1978 and Communications of the ACM, 1979.

    http://wolfram.schneider.org/bsd/7thEdManVol2/password/password.pdf (best copy I found online)
    http://people.carleton.edu/~rgraves/password.pdf (my mostly successful attempt to render the original troff)

    Comments: Original publication of the original UNIX password encryption scheme, with rationale. Concepts such as salting remain highly relevant today. Might be a logical continuation of the DES work earlier in the course.

  2. Kurt Grutzmacher, "Nail the Coffin Shut: NTLM is Dead," Presented at DEFCON 16, 2008.

    PDF slides: https://www.defcon.org/images/defcon-16/dc16-presentations/defcon-16-grutzmacher.pdf. Downloading is slow, but audio/video of the presentation is at: https://media.defcon.org/dc-16/video/Defcon16-Kurt_Grutzmacher-Nail_the_Coffin_Shut-Slides_Only.m4v

    Comments: You can stop reading at the slide titled "NTLM Over..." which is #24 in the PDF, and #28 in the video. This is the shortest, most clear, practically-minded presentation of NTLM that I know of.

Also...

Install Wireshark on your laptop, spend a little time getting to know how to use it, and bring your laptop to class on Wednesday.