About this course
Understand and correctly apply the cryptographic primitives that underpin secure communication, authentication, and data protection.
Course format. Thirteen weeks, four contact hours each: a two-hour lecture (concepts and theory) and a two-hour practice session. The course is project-based; teams carry one running project end to end and present it three times, in weeks 5, 8, and 13.
What you will build
Built a rigorous applied-cryptography library in Python from big-integer arithmetic primitives up to authenticated key exchange, with AES-GCM AEAD, RSA-OAEP, ECDH, EdDSA, and a hybrid post-quantum KEM via liboqs, each increment backed by test vectors and a demonstrated attack on a naive variant.
Expected outcomes
- Explain the algebraic foundations of cryptography: groups, rings, finite fields, and modular arithmetic.
- State and apply the hardness assumptions underpinning modern crypto: factoring, discrete log, and CDH/DDH.
- Formalize security definitions such as IND-CPA, IND-CCA, and existential unforgeability, and reason with reduction proofs.
- Construct and analyze symmetric primitives: block ciphers, modes of operation, and authenticated encryption.
- Build public-key schemes including RSA, ElGamal, and elliptic-curve cryptography from their mathematical structure.
- Design hash functions, MACs, and digital signatures, and argue their collision and forgery resistance.
- Implement authenticated key exchange and reason about PKI, certificates, and trust models.
- Identify and exploit common protocol pitfalls: nonce reuse, padding oracles, and timing leaks.
- Apply provable-security reasoning to evaluate whether a construction meets its claimed guarantees.
- Evaluate post-quantum candidates and migration paths against classical schemes.
Key topics
- Symmetric & public-key crypto
- Hashing & digital signatures
- Key exchange & PKI
- Protocol design pitfalls
Theoretical foundations
The concepts and results this course rests on.
- group theory, finite fields, and modular arithmetic
- computational hardness assumptions: factoring, discrete log, CDH and DDH
- one-way functions and trapdoor permutations
- IND-CPA and IND-CCA indistinguishability security games
- reductionist security proofs and the random oracle model
- existential unforgeability under chosen-message attack
- lattice problems and post-quantum hardness
Prerequisites
This is a Year-3 course. It assumes the mandatory CS core: data structures and algorithms, operating systems, computer networks, databases, software engineering, and the core mathematics (linear algebra, probability and statistics, calculus, discrete mathematics). It additionally requires the specific prior courses listed below.
Course-specific prerequisites:
- Discrete mathematics and number-theory basics
- Algorithms
- Probability
Weekly schedule 13 weeks · lecture + practice
Foundations
Wk 1
Number theory and algebraic structures
LectureCover modular arithmetic, the Euclidean algorithm, groups, rings, finite fields, and Euler's theorem as the language of cryptography.
PracticeImplement modular exponentiation, GCD, and modular inverse, and benchmark them on large integers.
ProjectSet up the crypto library skeleton and a tested big-integer modular arithmetic core.
Wk 2
Hardness assumptions and security definitions
LectureIntroduce one-way functions, the factoring and discrete-log problems, CDH/DDH, and formal indistinguishability-based security definitions.
PracticeBuild a discrete-log toy solver and measure how runtime scales to motivate the hardness assumption.
ProjectAdd a primitives interface and a security-definition test harness to the library.
Symmetric cryptography
Wk 3
Block ciphers and modes of operation
LectureAnalyze pseudorandom permutations, the AES structure, and CBC, CTR, and GCM modes with their security properties.
PracticeWrap a vetted AES implementation, implement CTR and CBC modes, and write known-answer tests.
ProjectIntegrate AES with multiple modes into the library with passing test vectors.
Wk 4
Authenticated encryption and MACs
LectureDefine IND-CCA security, present HMAC and GMAC, and explain encrypt-then-MAC and AEAD constructions.
PracticeImplement HMAC and an encrypt-then-MAC AEAD wrapper, then attack a deliberately broken MAC-then-encrypt variant.
ProjectAdd authenticated encryption with associated data and negative-test the broken variant.
Wk 5
Hash functions and the random oracle modelPresentation
LectureCover collision, preimage, and second-preimage resistance, Merkle-Damgard and sponge constructions, and the random oracle heuristic.
PracticeTeam presentation: each team defends its project specification, threat model, and chosen security definitions before the class.
ProjectFreeze the project specification document approved at the milestone review.
Public-key cryptography
Wk 6
RSA: construction and attacks
LectureDerive RSA from Euler's theorem, prove correctness, and survey attacks: small exponents, common modulus, and padding oracles.
PracticeImplement textbook RSA, then exploit it with a Bleichenbacher-style padding oracle on a vulnerable endpoint.
ProjectAdd OAEP-padded RSA encryption and a regression test that the padding oracle is closed.
Wk 7
Discrete-log systems and ElGamal
LecturePresent cyclic groups, ElGamal encryption, the DDH assumption, and semantic security reductions.
PracticeImplement ElGamal over a safe prime group and verify the homomorphic property experimentally.
ProjectIntegrate ElGamal encryption with parameter validation into the library.
Wk 8
Elliptic-curve cryptographyPresentation
LectureIntroduce the group law on elliptic curves, ECDH, and the elliptic-curve discrete-log problem and its efficiency advantages.
PracticeTeam presentation: interim demo of the working crypto library with a live encryption and decryption walkthrough.
ProjectAdd an ECDH key-agreement module and present the interim build.
Signatures and integrity
Wk 9
Digital signatures and unforgeability
LectureDefine existential unforgeability under chosen-message attack and analyze RSA-PSS, ECDSA, and EdDSA.
PracticeImplement ECDSA signing and verification and demonstrate the catastrophic nonce-reuse key-recovery attack.
ProjectAdd EdDSA signatures and a deterministic-nonce safeguard to the library.
Key exchange and PKI
Wk 10
Authenticated key exchange and PKI
LectureCover Diffie-Hellman, man-in-the-middle threats, certificates, chains of trust, and forward secrecy.
PracticeBuild an authenticated Diffie-Hellman handshake and a minimal certificate verifier with chain validation.
ProjectAdd a handshake protocol and certificate-chain verification to the library.
Protocols and pitfalls
Wk 11
Protocol design and common pitfalls
LectureAnalyze replay, reflection, downgrade, and timing attacks, and the principles of robust protocol design.
PracticeRun a constant-time review, fix a timing leak in the project, and verify with statistical timing measurement.
ProjectHarden the protocol layer against replay and timing side channels.
Advanced topics
Wk 12
Provable security and post-quantum cryptography
LectureWalk through full reduction proofs and survey lattice-based and post-quantum standards and migration strategy.
PracticeIntegrate a post-quantum KEM via liboqs and design a hybrid classical-plus-PQ key exchange.
ProjectAdd a hybrid post-quantum key-exchange option to the library.
Capstone
Wk 13
Final integration and defensePresentation
LectureReview the full cryptographic stack, security arguments, and threat coverage across the project.
PracticeTeam presentation: final demonstration with oral defense of design choices, security proofs, and known limitations.
ProjectDeliver the complete, tested cryptographic library with documentation and security rationale.
AI tools in this course.
Students lean on AI coding assistants to scaffold and refactor the teaching crypto library, turning math from the lectures into tested Python: prompting for big-integer routines, AES modes, or an ECDH module, then asking the assistant to explain why a draft is not constant-time. They generate Wycheproof-style test vectors and edge cases with AI, and use it to write the attack scripts that break naive variants such as the textbook-RSA padding oracle or a nonce-reuse ECDSA bug. AI is also used to read reduction proofs critically and to compare an implementation against the PyCryptodome and pyca reference, but every AI-suggested primitive is checked against official test vectors before it enters the library, since a plausible-looking but wrong crypto construction is the central risk the course teaches students to catch.
Student project
Teams build a small but rigorous applied-cryptography library from arithmetic primitives up to authenticated protocols. Each increment is backed by a security argument, test vectors, and at least one demonstrated attack on a naive variant. The capstone is a coherent, documented library defended with provable-security reasoning.
Requirements
- Build a working system, not a set of disconnected exercises.
- Be original: a new system that solves a real problem, not a re-implementation of a tutorial or course demo.
- Show real depth: real data, real users or realistic load, and engineering trade-offs that are measured rather than assumed.
- Carry one running project from specification to a deployed, defensible result across the whole term.
- Work in a team of three or four and defend the design at each of the three presentations (weeks 5, 8, and 13).
Example projects
Secure messaging primitiveEncrypted file vaultMini certificate authorityPassword-authenticated key exchange toolHybrid post-quantum channelSignature-based update verifierThreshold signature demoConstant-time crypto toolkit
Assessment & grading
Grading is project-based, with no written exam. Teams of three or four present one running project three times.
| Component | What it covers | Weight |
|---|---|---|
| Project · Specification | Presentation 1 (week 5): problem, objectives, and architecture | 20% |
| Project · Interim | Presentation 2 (week 8): the working system demonstrated live | 30% |
| Project · Final | Presentation 3 (week 13): end-to-end demo with oral defense | 50% |
Tools & platforms
- Python: implementation language for the teaching library
- PyCryptodome: vetted primitives for comparison and wrapping
- OpenSSL: reference implementation and certificate tooling
- SageMath: number-theory and elliptic-curve experimentation
- cryptography (pyca): modern high-level crypto APIs
- liboqs: post-quantum KEM and signature implementations
- Hashcat: hash-cracking to motivate strength requirements
- dudect: constant-time leakage testing for timing attacks
- GMP: high-performance big-integer arithmetic
- pytest: test-vector and regression test harness
Free online courses
Existing free, video-based courses this course can build on, for self-study or as a teaching basis.
- CourseraCryptography I
- YouTubeIntroduction to Cryptography
In Hebrew · בעברית
- אוניברסיטת בר-אילן, YouTubeקריפטוגרפיה - סדרת הרצאות של פרופ' יהודה לינדל (הרצאה 1)
- אוניברסיטת בר-אילן, YouTubeקריפטוגרפיה - הרצאה 3 - פרופ' יהודה לינדל
- אוניברסיטת תל אביב, חמישי בקמפוסקריפטוגרפיה, לא רק הצפנה
Primary literature
Seminal works to read for graduate-level depth.
- PaperNew Directions in Cryptography
- PaperA Method for Obtaining Digital Signatures and Public-Key Cryptosystems
- PaperProbabilistic Encryption
- PaperRandom Oracles Are Practical: A Paradigm for Designing Efficient Protocols
- PaperFIPS 197: Advanced Encryption Standard (AES)
- PaperCurve25519: New Diffie-Hellman Speed Records
References
Books and resources link to an online or publisher page.
- TextbookIntroduction to Modern Cryptography
- TextbookA Graduate Course in Applied Cryptography
- TextbookHandbook of Applied Cryptography
- TextbookCryptography Engineering: Design Principles and Practical Applications
- TextbookThe Joy of Cryptography
- DocumentationFIPS 186-5: Digital Signature Standard (DSS)
- DocumentationSP 800-56A Rev. 3: Pair-Wise Key-Establishment Using Discrete Logarithm Cryptography
- TextbookSerious Cryptography, 2nd Edition
Role in each concentration
| Concentration | Role |
|---|---|
| Intelligent Software Systems | Elective |
| Networking & Cyber Security | Core · Semester 1 |
| AI & Robotics | Elective |
| AI and Quantum Computing for Finance | Elective |
| Immersive Systems & Game Development | Elective |
| Defense Technologies & Autonomous Systems | Core · Semester 1 |