About this course
Understand and correctly apply the cryptographic primitives that underpin secure communication, authentication, and data protection.
Course format. Thirteen weeks, four contact hours each: a two-hour lecture (concepts and theory) and a two-hour practice session. The course is project-based; teams carry one running project end to end and present it three times, in weeks 5, 8, and 13.
What you will build
Teams implement a secure messaging protocol from scratch using correct cryptographic primitives: AES-GCM for symmetric encryption, ECDH for key exchange, Ed25519 for signing, PBKDF2 for password-based key derivation, and X.509 certificate validation for peer authentication. In the second half of the term the same team attacks a deliberately flawed reference implementation to discover and document implementation pitfalls firsthand.
Expected outcomes
- Implement AES correctly — explaining S-box substitution, ShiftRows, MixColumns, and the key schedule — select the right mode (CBC, CTR, or GCM) for each use case, and enforce AEAD with a verify-before-decrypt discipline across all decryption paths.
- Apply asymmetric cryptography (RSA-OAEP, ECDSA, ECDH, Ed25519) and cryptographic hash functions (SHA-256 Merkle-Damgard, SHA-3 Keccak sponge) to construct authenticated encryption and digital signature pipelines using audited libraries rather than hand-rolled primitives.
- Design key derivation schemes (PBKDF2, bcrypt, Argon2id), key exchange protocols (DHE, ECDHE), and PKI hierarchies (root/intermediate CA, X.509 v3 extensions, OCSP stapling, CRL distribution) that enforce forward secrecy and correct certificate chain validation.
- Manage application secrets across their full lifecycle — dynamic credential issuance with automatic expiry, envelope encryption for IaC-co-located secrets, and zero-plaintext architecture — using secrets management tooling to eliminate long-lived credential exposure.
- Audit cryptographic implementations for nonce reuse, padding oracles, timing side-channels, and JWT/OAuth misconfiguration, and evaluate TLS endpoint configurations and cryptographic choices in system designs against known attack classes.
- Select and integrate audited cryptographic libraries (PyCA, PyCryptodome, OpenSSL) for correct protocol implementation, and use offensive tooling (jwt_tool, Hashcat, Cryptohack) to verify that the chosen constructions resist real-world attacks.
Key topics
- Symmetric & public-key crypto
- Hashing & digital signatures
- Key exchange & PKI
- Protocol design pitfalls
Theoretical foundations
The concepts and results this course rests on.
- Block cipher design: substitution-permutation networks, AES round functions (SubBytes, ShiftRows, MixColumns, AddRoundKey), and the AES-128/192/256 key schedule
- Block cipher modes of operation: IV chaining in CBC, keystream generation in CTR, and the GCM authenticated encryption construction with the GHASH polynomial MAC
- Asymmetric cryptography: RSA trapdoor permutation (Euler's theorem, OAEP padding, CRT speedup), ECC discrete-log hardness, ECDSA signing and verification equations, ECDH shared-secret derivation
- Cryptographic hash functions: Merkle-Damgard strengthening and the SHA-256 compression function; Keccak sponge construction (SHA-3); collision, preimage, and second-preimage resistance; length-extension vulnerability in MD-family hashes
- Digital signature unforgeability: RSA-PSS, ECDSA, and Ed25519 (EdDSA) signing and verification; deterministic nonce derivation; certificate binding and non-repudiation
- Key derivation functions: PBKDF2 (HMAC-based iterative stretching), bcrypt (Blowfish-based cost factor), Argon2id (memory-hard, side-channel resistant); password hashing and key stretching for password-based key derivation
- Diffie-Hellman key exchange: discrete-log hardness in cyclic groups, DHE versus ECDHE ephemeral key generation and erasure, and perfect forward secrecy guarantees
- Public Key Infrastructure: root/intermediate CA hierarchy, X.509 v3 extensions (SAN, EKU, AKI), OCSP stapling, and CRL distribution points; certificate chain validation and trust anchors
- Authenticated encryption with associated data (AEAD): AES-GCM (counter-mode encryption plus GHASH tag), ChaCha20-Poly1305 (stream cipher plus Poly1305 MAC), nonce misuse consequences, and the verify-before-decrypt security requirement
- Application secrets lifecycle: per-request dynamic credential issuance with automatic expiry, envelope encryption for secrets co-located with IaC code, and zero-plaintext architecture for eliminating static long-lived credential exposure
Prerequisites
This is a Year-3 course. It assumes the mandatory CS core: data structures and algorithms, operating systems, computer networks, databases, software engineering, and the core mathematics (linear algebra, probability and statistics, calculus, discrete mathematics). It additionally requires the specific prior courses listed below.
Course-specific prerequisites:
- Discrete mathematics and number-theory basics
- Algorithms
- Probability
Weekly schedule 13 weeks · lecture + practice
Symmetric cryptography
Wk 1
Symmetric encryption and AES internals
LectureAES block cipher structure: SubBytes (S-box substitution), ShiftRows, MixColumns, AddRoundKey, and the key schedule for AES-128/192/256; confusion, diffusion, and why AES replaced DES.
PracticeUse Python cryptography (PyCA) to encrypt and decrypt with raw AES, inspect round outputs, and verify against FIPS 197 known-answer test vectors.
ProjectSet up the project repo and a PyCA-based AES module with passing NIST test vectors as the backbone of the secure messaging protocol.
Wk 2
Block cipher modes: CBC, CTR, and GCM
LectureCBC (IV chaining, PKCS#7 padding, bit-flipping and padding-oracle vulnerabilities), CTR (keystream XOR, nonce-reuse catastrophe), and GCM (authenticated encryption with GHASH polynomial MAC and tag verification).
PracticeImplement CBC and CTR modes from scratch over PyCryptodome's AES primitive; mount a bit-flipping attack on a CBC ciphertext and observe how GCM's tag prevents the same manipulation.
ProjectAdd CBC and CTR wrappers with IV management and begin the AES-GCM integration for the messaging protocol's symmetric channel.
Wk 3
Cryptographic hash functions: SHA-256 and SHA-3
LectureMerkle-Damgard construction and the SHA-256 compression function; Keccak sponge construction and SHA-3; collision, preimage, and second-preimage resistance; length-extension attacks on MD-family hash functions.
PracticeExplore the SHA-256 compression function and Keccak sponge absorption and squeezing in SageMath; mount a length-extension attack on a naive hash-then-truncate MAC construction.
ProjectAdd SHA-256 and SHA-3 hashing plus HMAC to the messaging library with test vectors from NIST CAVP.
Asymmetric cryptography
Wk 4
RSA, ECC, ECDSA, and ECDH
LectureRSA: Euler's theorem, trapdoor permutation, OAEP padding, and small-exponent pitfalls. ECC: group law on Weierstrass curves, discrete-log hardness, ECDSA signing and verification, ECDH shared-secret derivation.
PracticeUse OpenPGP.js in a Node.js environment to generate RSA-4096 and Curve25519 keypairs, inspect key parameters, and perform sign and verify operations; compare key sizes and performance.
ProjectAdd RSA-OAEP encryption and Ed25519 signature modules; generate long-term keypairs to be used for peer authentication in the protocol.
Wk 5
Digital signatures and non-repudiationPresentation
LectureRSA-PSS, ECDSA, and Ed25519: signing and verification procedures, deterministic nonce derivation in Ed25519, certificate binding, and non-repudiation guarantees.
PracticeTeam presentation — specification defense: each team presents the secure messaging protocol design, threat model, and cryptographic primitive choices for peer review.
ProjectFreeze the protocol specification document incorporating feedback from the milestone review.
Signatures, KDFs, and PKI
Wk 6
Digital signatures in practice: Ed25519, ECDSA, and GnuPG
LectureEd25519 (EdDSA): twisted Edwards curves, deterministic nonce derivation from the private key, batch verification; ECDSA nonce-reuse key-recovery attack; PGP trust model and web of trust versus CA hierarchies.
PracticeUse GnuPG to generate Ed25519 keypairs, sign and verify documents, export and import certificates, and verify a PGP trust chain; demonstrate the catastrophic nonce-reuse attack on ECDSA.
ProjectHarden the Ed25519 module with deterministic nonces; integrate GnuPG-compatible key export for interoperability testing.
Wk 7
Key derivation functions and password security
LecturePBKDF2 (HMAC-based iterative stretching, iteration count tuning), bcrypt (Blowfish-based cost factor), Argon2id (memory-hard, side-channel resistant, OWASP recommended defaults); password-based key wrap and session-key derivation.
PracticeCrack PBKDF2-SHA1 and low-cost bcrypt hashes with Hashcat; benchmark Argon2id memory and time parameters against measured GPU cracking speeds to motivate correct cost-factor selection.
ProjectImplement PBKDF2-based password-to-session-key derivation for the protocol's authentication bootstrap path.
Wk 8
Diffie-Hellman key exchange and PKIPresentation
LectureDiffie-Hellman discrete-log hardness, DHE versus ECDHE ephemeral key pairs, perfect forward secrecy; PKI root/intermediate CA hierarchy; X.509 v3 extensions (SAN, EKU, AKI), OCSP stapling, and CRL distribution points.
PracticeTeam presentation — interim demo: live demonstration of the working AES-GCM symmetric channel, ECDH key exchange, and Ed25519 signing pipeline.
ProjectPresent the interim implementation; add ECDH key agreement and begin X.509 certificate validation for peer authentication.
AEAD, secrets, and attacks
Wk 9
AEAD in depth: AES-GCM and ChaCha20-Poly1305
LectureAES-GCM construction (CTR-mode encryption plus GHASH polynomial MAC), ChaCha20-Poly1305 (stream cipher plus Poly1305 MAC), nonce misuse resistance, verify-before-decrypt as a non-negotiable security invariant, and the consequences of GCM nonce reuse.
PracticeSolve Cryptohack AEAD and AES-GCM challenge sets; exploit a nonce-reuse scenario to recover plaintext and forge a tag; verify that ChaCha20-Poly1305 is the safer choice under nonce misuse.
ProjectAdd ChaCha20-Poly1305 as an alternative AEAD cipher; enforce verify-before-decrypt across all decryption paths in the messaging protocol.
Wk 10
TLS, forward secrecy, and X.509 certificate validation
LectureECDHE key agreement in TLS 1.3, ephemeral key generation and erasure, forward secrecy guarantees; X.509 certificate chain validation, OCSP stapling, and CRL distribution points; configuring a minimal internal CA and certificate transparency monitoring.
PracticeUse OpenSSL to configure a TLS 1.3 endpoint with ECDHE, generate and sign X.509 certificates with a local CA, validate chains, and test OCSP stapling responses.
ProjectIntegrate full X.509 certificate chain validation for peer authentication and add ECDHE forward secrecy to the messaging protocol handshake.
Wk 11
Application secrets lifecycle and zero-plaintext architecture
LectureDynamic credential issuance with per-request secrets and automatic expiry; envelope encryption for secrets co-located with IaC code; zero-plaintext architecture and static-credential elimination; transit encryption as a service.
PracticeDeploy a HashiCorp Vault development instance; use the transit secrets engine for envelope encryption and the dynamic secrets engine for per-request credentials; revoke credentials on demand and observe audit logs.
ProjectReplace hard-coded test keys in the CI pipeline with Vault-issued dynamic credentials; demonstrate credential revocation and automatic expiry.
Wk 12
Implementation pitfalls and protocol attacks
LectureCommon implementation attacks: CBC padding oracle, AES-GCM nonce reuse, timing side-channels in comparison functions, JWT algorithm confusion (RS256 to HS256), and the "none" algorithm bypass; downgrade attacks and protocol negotiation pitfalls.
PracticeUse jwt_tool to exploit algorithm confusion and the none-algorithm bypass on a deliberately vulnerable JWT endpoint; audit the token configuration and patch the vulnerability.
ProjectBuild the deliberately flawed reference implementation seeded with a padding oracle, a nonce-reuse bug, and a JWT misconfiguration; write the attack scripts that discover each pitfall.
Capstone
Wk 13
Final integration and defensePresentation
LectureCourse synthesis: full cryptographic stack review, connecting primitives to the protocol threat model, and security argument structure from AES-GCM AEAD through ECDH key exchange to X.509 peer authentication.
PracticeTeam presentation — final demo: end-to-end demonstration of the secure messaging protocol, live attack on the flawed reference implementation, and oral defense of all design choices and known limitations.
ProjectDeliver the complete tested secure messaging protocol with documentation, security rationale, and attack demonstration write-up.
AI tools in this course.
Students lean on AI coding assistants to scaffold and refactor the teaching crypto library, turning math from the lectures into tested Python: prompting for big-integer routines, AES modes, or an ECDH module, then asking the assistant to explain why a draft is not constant-time. They generate Wycheproof-style test vectors and edge cases with AI, and use it to write the attack scripts that break naive variants such as the textbook-RSA padding oracle or a nonce-reuse ECDSA bug. AI is also used to read reduction proofs critically and to compare an implementation against the PyCryptodome and PyCA reference, but every AI-suggested primitive is checked against official test vectors before it enters the library, since a plausible-looking but wrong crypto construction is the central risk the course teaches students to catch.
Student project
Teams implement a secure messaging protocol from scratch using correct cryptographic primitives: AES-GCM for symmetric encryption, ECDH for key exchange, Ed25519 for signing, PBKDF2 for password-based key derivation, and X.509 certificate validation for peer authentication. In the final weeks each team also attacks a deliberately flawed reference implementation to discover and document implementation pitfalls firsthand. The capstone is a coherent, tested, and documented protocol defended with concrete security arguments at each of the three presentations.
Requirements
- Build a working system, not a set of disconnected exercises.
- Be original: a new system that solves a real problem, not a re-implementation of a tutorial or course demo.
- Show real depth: real data, real users or realistic load, and engineering trade-offs that are measured rather than assumed.
- Carry one running project from specification to a deployed, defensible result across the whole term.
- Work in a team of three or four and defend the design at each of the three presentations (weeks 5, 8, and 13).
Example projects
Secure messaging protocolEncrypted file vaultMini certificate authorityPassword-authenticated key exchange toolSignature-based update verifierEnvelope encryption serviceSecrets rotation pipelineConstant-time crypto toolkit
Assessment & grading
Grading is project-based, with no written exam. Teams of three or four present one running project three times.
| Component | What it covers | Weight |
|---|---|---|
| Project · Specification | Presentation 1 (week 5): problem, objectives, and architecture | 20% |
| Project · Interim | Presentation 2 (week 8): the working system demonstrated live | 30% |
| Project · Final | Presentation 3 (week 13): end-to-end demo with oral defense | 50% |
Tools & platforms
- OpenSSL: TLS endpoint configuration, X.509 certificate generation and chain validation, and OCSP stapling
- Python cryptography (PyCA): high-level, audited Python crypto APIs for AES, ECDH, Ed25519, and X.509
- PyCryptodome: low-level cryptographic primitives for implementing and inspecting block cipher modes
- SageMath: number-theory and elliptic-curve experimentation; hash-function internals and collision experiments
- GnuPG: Ed25519 keypair management, PGP signing and verification, and trust-chain exploration
- jwt_tool: JWT attack toolkit for algorithm confusion, none-algorithm bypass, and token manipulation
- HashiCorp Vault: dynamic credential issuance, transit envelope encryption, and secrets lifecycle management
- Hashcat: GPU-accelerated password cracking to benchmark and motivate KDF cost-factor selection
- Cryptohack: interactive cryptography challenge platform for AEAD, block cipher, and protocol attack labs
- OpenPGP.js: web crypto library for RSA and ECC key operations and encrypted messaging in JavaScript
Free online courses
Existing free, video-based courses this course can build on, for self-study or as a teaching basis.
- CourseraCryptography I
- YouTubeIntroduction to Cryptography
In Hebrew · בעברית
- אוניברסיטת בר-אילן, YouTubeקריפטוגרפיה - סדרת הרצאות של פרופ' יהודה לינדל (הרצאה 1)
- אוניברסיטת בר-אילן, YouTubeקריפטוגרפיה - הרצאה 3 - פרופ' יהודה לינדל
- אוניברסיטת תל אביב, חמישי בקמפוסקריפטוגרפיה, לא רק הצפנה
Primary literature
Seminal works for advanced study.
- PaperNew Directions in Cryptography
- PaperA Method for Obtaining Digital Signatures and Public-Key Cryptosystems
- PaperProbabilistic Encryption
- PaperRandom Oracles Are Practical: A Paradigm for Designing Efficient Protocols
- PaperFIPS 197: Advanced Encryption Standard (AES)
- PaperCurve25519: New Diffie-Hellman Speed Records
References
Books and resources link to an online or publisher page.
- TextbookIntroduction to Modern Cryptography
- TextbookA Graduate Course in Applied Cryptography
- TextbookHandbook of Applied Cryptography
- TextbookCryptography Engineering: Design Principles and Practical Applications
- TextbookThe Joy of Cryptography
- DocumentationFIPS 186-5: Digital Signature Standard (DSS)
- DocumentationSP 800-56A Rev. 3: Pair-Wise Key-Establishment Using Discrete Logarithm Cryptography
- TextbookSerious Cryptography, 2nd Edition
Role in each concentration
| Concentration | Role |
|---|---|
| Intelligent Software Systems | Elective |
| Networking & Cyber Security | Core · Semester 1 |
| AI & Robotics | Elective |
| AI and Quantum Computing for Finance | Elective |
| Immersive Systems & Game Development | Elective |
| Defense Technologies & Autonomous Systems | Core · Semester 1 |