AIMS AND CONTENT

AIMS AND LEARNING OUTCOMES

The course aims to develop a security-oriented mindset by providing students with a solid foundation in computer security. Upon completion of the course, students will be able to:

• explain the fundamental objectives, concepts, and principles of computer security;
• identify assets and security objectives, adversaries, threats, vulnerabilities, attack surfaces, risks, and appropriate countermeasures;
• select appropriate cryptographic primitives and protocols to achieve specific security objectives;
• distinguish between centralized, federated, and decentralized digital identity models;
• select appropriate authentication and access-control mechanisms;
• analyze common security vulnerabilities affecting software, systems, networks, web applications, blockchains, and smart contracts;
• critically evaluate the security properties of cryptographic mechanisms, protocols, computer systems, and applications;
• apply security principles and techniques when analyzing and designing computer systems.

TEACHING METHODS

The course adopts an interactive teaching approach that combines theoretical explanations with questions, short formative quizzes, discussion of security case studies, and guided exercises. Selected topics are complemented by hands-on activities.

Students who hold valid certificates relating to Specific Learning Difficulties (SLD), disabilities or other educational needs are invited to contact the lecturer and the school’s disability liaison officer at the start of the course to agree on any teaching arrangements which, whilst respecting the course objectives, take into account individual learning styles.

The contact details for the university’s disability liaison officer are available at the following link: https://unige.it/commissioni/comitatoperlinclusionedeglistudenticondisabilita.

SYLLABUS/CONTENT

1. Introduction to Computer Security

• Overview of Computer Security Concepts and Foundations. 
• User Identification and Authentication. 
• Access Control: access control matrix model; Discretionary Access Control (DAC); Mandatory Access Control (MAC), including Bell–LaPadula and Biba models; Role-Based Access Control (RBAC); Attribute-Based Access Control (ABAC). 
• Threat Modeling: identifying assets and security objectives; adversaries; threats; vulnerabilities; risk; countermeasures; and threat-modeling approaches. 
• Security Principles: least privilege; separation of privilege; mediated access; defense in depth; use fail-safe defaults; economy of mechanism; open design; etc.

       2. Introduction to Cryptography

• What is cryptography?
• Cryptography vs. steganography.
• Kerckhoffs's Principle.
• Fundamental goals of cryptography.
• Security Model: attack models, adversarial goals, levels of security. 
• Semantic security vs. ciphertext indistinguishability. 

      3. Symmetric Cryptography

• Substitution Ciphers: Caesar cipher, ROT13, Vigenère cipher.
• Transposition Ciphers: transposition ciphers;
• Rotor-Based Ciphers: the Enigma machine.
• Stream Ciphers: One-Time Pad and perfect secrecy; malleability of One-Time Pads and bit-flipping attacks.
• Block Ciphers: DES, 2 DES, 3DES, AES.
• Block-Cipher Modes of Operation: ECB, CBC, CTR.
• Message Authentication Codes (MACs) and hash functions.
• Authenticated Encryption: combining encryption and MAC, AEAD, AES-GCM.
• Key Management; the key-distribution problem;
• Needham–Schroeder protocol and Kerberos.

     4.Public-Key Cryptography

• Introduction to public-key cryptography. 
• Mathematical Background: modular arithmetic, modular inverse, cyclic groups, prime factorization, Euler's function ϕ. 
• Discrete logarithm problem. 
• Diffie–Hellman (DH) key agreement. 
• RSA algorithm and signature.
• Hybrid encryption. 
• Elliptic-Curve Cryptography: the Elliptic-Curve Discrete Logarithm Problem (ECDLP); Diffie–Hellman key agreement over elliptic curves; Elliptic Curve Digital Signature Algorithm (ECDSA). 
• Public Keys and the Trust Problem: digital certificates and Public Key Infrastructure. 
• Alternative Decentralized Solutions: the Web of Trust model, public-key-based identifiers, DIDs and DID documents.

     5.Security and privacy Protocols

• Security goals, trust assumptions, and attacker models. 
• Case Studies: Authenticated Diffie–Hellman, Schnorr's identification protocol, Sigma protocols, Oblivious Transfer (OT), Yao's garbled circuits, and introduction to zk-SNARKs.

     6.Blockchain Security

• The core components of blockchain, cryptographic foundations, including hash functions, Merkle trees, and digital signatures, and blockchain security.

     7.Web Security

• Web Security Fundamentals: Web 2.0 vs. Web 3.0 architecture; browser and server security model; Same-Origin Policy (SOP); cookies; authentication and session management. 
• Web Attacks and Defenses: Broken Access Control, CSRF; Cross-Site Scripting (stored, reflected, and DOM-based XSS); clickjacking; SQL injection and phishing attacks. 
• Side-Channel attacks: Spectre side-channel attack.
• Digital Identity Models: centralized identity; federated identity; decentralized identity / Self-Sovereign Identity (SSI). 
• User Authentication: Multi-Factor Authentication (MFA), including SMS-based 2FA and TOTP; phishing-resistant authentication using FIDO2 security keys and passkeys.

       8.Network Security

• Networking Protocols : ARP, DHCP, IP, TCP, DNS, BGP. 
• Network Attacks: ARP spoofing/cache poisoning; DHCP attacks; IP spoofing; TCP attacks; DNS attacks; BGP hijacking; DoS/DDoS. 
• Network Defenses and Secure Communication: Firewalls, NIDS, TLS, VPNs, IPsec

      9.Software Security

• Memory Safety: C memory layout; essential x86 concepts (registers, assembly basics, stack frames, and function calls); buffer overflows (stack smashing and heap-based overflows); memory-safe programming. 
• Smart Contract Security: reentrancy; arithmetic overflow/underflow; force-feeding; accessing private data; access-control vulnerabilities; insecure randomness vulnerabilities; unsafe delegate calls; denial-of-service

RECOMMENDED READING/BIBLIOGRAPHY

Dan Boneh and Victor Shoup. A Graduate Course in Applied Cryptography. Available online at: https://toc.cryptobook.us/

TEACHERS AND EXAM BOARD

Exam Board

RAFFAELE BOLLA (President)

LESSONS

LESSONS START

https://easyacademy.unige.it/portalestudenti/index.php?view=easycourse&_lang=it&include=corso

Class schedule

The timetable for this course is available here: Portale EasyAcademy

EXAMS

EXAM DESCRIPTION

The examination consists of a written test covering the topics presented during the course. The test includes questions and exercises designed to assess theoretical understanding and the ability to analyze security problems and identify appropriate solutions. Students may be asked, for example, to analyze an attack scenario or security protocol, assess the security properties of a cryptographic mechanism, identify vulnerabilities, or select and justify appropriate countermeasures.

FURTHER INFORMATION

Students with valid certifications for Specific Learning Disorders (SLD) may request accommodations for exams at least 7 days prior to the exam date by filling out the “accommodation request form” (available via online services at https://modulionline.unige.it/richiesta-adattamenti# no-back), which will be automatically forwarded by the system to the instructor in charge of the course and to the faculty liaison for students with disabilities and SLDs in their School/Department.

The student will receive a copy of their request.