Syllabus

Date
Papers
Intro
Apr 1 Reflections on Trusting Trust by K. Thompson
Enforcement mechanism: capabilities, IFC, SFI
Apr 3 Capsicum: Practical Capabilities for UNIX by Watson et. al
Apr 8 Protecting Users by Confining JavaScript with COWL by D. Stefan et al.
Apr 10 No class
Apr 15 1 RockSalt: Better, Faster, Stronger SFI for the x86 by G. Morrisett et al.
Static and symbolic analysis
Apr 17 AEG: Automatic Exploit Generation by T. Avgerinos et al. (lead by Stewart Grant and Shu-Ting Wang)
Apr 22 How to Build Static Checking SystemsUsing Orders of Magnitude Less Code by F. Brown et al. (lead by Jeffrey Wang)
Memory safety
Apr 25 2 The Meaning of Memory Safety by A. A. Amorim et al. (lead: Matthew Kolosick)
Apr 29 No class
May 1 Memory-safe Execution of C on a Java VM by M Grimmer et al. (lead: Alexander Harold Polus)
Low-level security
May 6 Hacking Blind by A. Bittau et al.
May 8 SoK: Shining Light on Shadow Stacks by N. Burrows et al.
Side channels
May 13 Spectre Attacks: Exploiting Speculative Execution by P. Kocher et al. (lead: Archit Mishra)
May 15 Lucky Thirteen: Breaking the TLS and DTLS Record Protocols by N. J. AlFardan and K. G. Paterson.
Crypto
May 20 Implementing and Proving the TLS 1.3 Record Layer by A. Delignat-Lavaud et al. (lead by Vivek Arte)
May 22 The first collision for full SHA-1 by M. Stevens et al. (Mark Shultz)
Verified operating systems
May 27 No class
May 29 seL4: Formal Verificaiton of an OS Kernel by G. Klein et al. (Shraddha Barke)
Jun 3 Hyperkernel: Push-Button Verification of an OS Kernel by L. Nelson et al. (lead by Stewart Grant and Shu-Ting Wang)
Looking back
Jun 5 Some thoughts on security after ten years of qmail 1.0 by D. J. Bernstein
Thirty Years Later: Lessons from the Multics Security Evaluation by P. A. Karger and R. R. Schell

Additional reading:


  1. Form project groups. 

  2. Submit project proposal.