• October 1: Make sure to activate your edstem account -- we will be using edstem for most announcemetns as the class start.
  • September 28: The zoom meeting ID is available on canvas. Contact the lecturer/TA if unable to find it.
  • September 28: First-version of homepage is live.

General information

  • Topics: Basic cryptographic primitives (block ciphers, secret- and public-key encryption, authenticated encryption, message authentication, signatures, ...), cryptographic protocols (e.g. TLS), attack vectors (padding-oracle attacks, side-channel attacks, etc). Also, advanced cryptographic techniques (zero-knowledge proofs, multi-party computation,...).
    The class will adopt rigorous security definitions and statements, but mostly replace proofs with attack-driven intuition.
  • Prerequisites: No formal prerequisites, except for basic mathematical proficiency as expected in an undergraduate CS program, as well as a certain affinity to rigorous thinking. Basic programming skills (we will mostly use Python).


Instructor: Stefano Tessaro, tessaro(at)cs(dot)washington(dot)edu

Teaching assistant

  • Ansh Nagda (ansh@cs)
  • Xihu Zhang (xihu@cs)

Weekly schedule

  • Class time and location
    Tue & Thu 6:30-7:50pm (On zoom -- link available via Canvas)
  • Office hours
    ST: Mo 5-6pm or by appointment
    TA Office Hours: Wed 5-6pm


No mandatory textbook. Slides will be made available (password protected).

The following are lecture notes/textbooks on cryptography (all but one free), which (often) adopt a more formal approach than the one from this class.

Interaction / Q&A

We are going to use edstem for class discussion. Instructions will be provided.


  • Homework: There will be 5-6 problem sets distributed over the quarter. Problem sets are generally posted online on Monday, by 11:59pm PST, and are due on Thursday, 11:59pm PST, the following week. Homework will be graded and you are required to hand in your own solution for each homework. (Refer to the "Academic Integrity" paragraph below for further details.) You are allowed 5 late days overall throughout the quarter.
    Homework submissions will be online via Gradescope (instructions will be provided soon).
  • Project: An important component of this class will be a project, to be undertaken by teams of two students. (Exceptions can be made but are not the norm.) The final outcome of the project is a report (we will likely dispense with presentations, due to the projected high number of students). Examples of projects include (but are not limited to):
    • Reading a research paper and/or a cryptographic standard/RFC (either existing, or a current proposal), and writing a summary.
    • Studying a real-world application or implementation of cryptography (either a well-known one, or something specific to your personal experience) and documenting it (or formalizing the underlying threat model).
    • Some cryptography-specific implementation problem.
    • Anything else really, just let your creativity flow.
    A project proposal (0.5-1 pages) describing the planned work and the two members of esach time is due on Monday, November 2nd. Early submissions are welcome and encouraged. The final project is due then on Wednesday, Dec 16, 11:59pm.
  • Final grade: The final grade will be distributed as follows: Homework (60%), project (40%). The lowest homework score will be dropped. Participation (in class and online) will be taken into account for partial bonus credit in borderline cases.
  • Academic Integrity: Homework assignments are meant to be solved individually, whereas collaboration with a team-mate is required for the project component of the class. Please refer to the Allen School's Academic Misconduct webpage for a detailed description of what is allowable and what is not.
  • Religious Accommodation Policy: See here for the current policy.

Schedule and Homework

The following is a tentative schedule, and is intended to give a rough idea about what I hope to cover in the class and in which order. There will be (slight) shifts depending on the pace of the class, and more information will appear on the schedule as lectures are completed. (Initially, contents will be vague for later lectures.)

WeekDate Lecture contents Notes / slides / assignments
0 2020-10-01 Introduction
  • Organizational details.
  • Introduction: What is cryptography?
Introduction to symmetric encryption
  • Historic ciphers
1 2020-10-06 Introduction to symmetric encryption
  • Attack models
  • Breaking monoalphabetic substitution
  • Definition of block ciphers
2020-10-08 Block Ciphers
  • Definition (reminder)
  • ECB mode and its insecurity
  • Pseudorandom Functions
  • The Structure of AES
2 2020-10-13 Modes of operation
  • The structure of AES
  • CTR/CBC modes
  • IND-CPA security for symmetric encryption
  • Stream ciphers: Constructions from block ciphers & ad-hoc designs
2020-10-15 Wrapping Up Encryption
  • Breaking RC4
  • Padding-oracle attacks
3 2020-10-20 Integrity
  • Hash functions: Basic properties (collision resistance, second preimage resistance, etc)
  • The Merkle-Damgård and Sponge constructions
  • Merkle Trees
  • Message-authentication codes (MACs)
  • MAC Constructions: Keying hash functions (HMAC) and CBC
2020-10-22 Authenticated Encryption
  • Plaintext and ciphertext integrity
  • Generic composition: Secure and insecure solutions
  • AEAD and GCM
  • Nonce repetitions, nonce-misuse resistance, picking nonces
4 2020-10-27 Public-key crypto foundations
  • Modular arithmetic
  • Cyclic groups
  • The Discrete Logarithm problem
  • Elliptic curves
2020-10-29 Public-key Cryptography
  • Diffie-Hellman Key-Exchange
  • Hardness of the discrete logarithm problem
5 2020-11-03 Election Day (Class is canceled)
2020-11-05 RSA Encryption
  • Plain RSA
  • PKCS#1 encryption
  • RSA-OAEP and chosen-ciphertext security
  • Basic attacks and factoring
Digital Signatures
  • Functionality
  • RSA & Schnorr signatures
6 2020-11-10 Certificates, PKIs, and authenticated key exchange
  • Certificates and public-key infrastructures
2020-11-12 Authenticated Key Exchange (AKE)
  • Generic constructions: One-sided and two-sided AKE
  • Forward security
  • Diffie-Hellman AKE and TLS 1.3 handshake
  • Attacks against older TLS versions: FREAK and LogJam
7 2020-11-17 Identification protocols
  • Password-based identification: Salting, iteration,
  • Memory-hard functions
  • One-time passwords
  • Challenge-response protocols
2020-11-19 Random-number generation
  • Bad RNGs (Mersenne Twister)
  • RNG security: Pseudorandomness, forward-security, post-comrpomise security
  • Hash-based RNG design
  • RNG attacks
8 2020-11-24 Case study: Secure Messaging
  • The Double-Ratchet Protocol
2020-11-26 Thanksgiving (Class Canceled)
9 2020-12-01 Multi-party computation
  • Two-party computation
  • Oblivious transfer
  • Garbled Circuits and Yao's protocol
2020-12-03 Multi-party computation
  • Garbled Circuits and Yao's protocol
  • Secret sharing and multi-party computation
10 2020-12-08 Zero-knowldge proofs I
2020-12-10 Zero-knowldge proofs II