CSCI 780 - Spring 2026
Distributed System Security

Syllabus

General Course Information

Instructor Stephen Herwig Office Hours:
Mon 11:00 - 12:00
Wed 11:00 - 12:00
Fri 11:00 - 12:00
ISC 3
Room #2391
Time/Place MWF 10:00am - 10:50am
ISC 3
Room #2347

Roadmap

Key:
Paper reading
Student presenter
Textbook reading
Sample code
Coding project
TLS and PKI Week 1
Wed 1/21
Introductions.
Fri 1/23
Ch 1. Setting Up Your Go Environment
Ch 2. Predeclared Types And Declarations
The Most Dangerous Code in the World: Validating SSL Certificates in Non-Browser Software
TLS and PKI Week 2
Mon 1/26
Ch 3. Composite Types
Ch 4. Blocks, Shadows, And Control Structures

No class (snow)

Wed 1/38
CRLite: A Scalable System for Pushing All TLS Revocations to All Browsers
Fri 1/30
Does Certificate Transparency Break the Web? Measuring Adoption and Error Rate

Add/drop deadline

DNS Week 3
Mon 2/2
p1: sget (Due: Mon 2/23 @11:59pm)
Ch 5. Functions
A Longitudinal, End-to-End View of the DNSSEC Ecosystem
Parsing Command-line Options
Simple TCP Client and Server
Wed 2/4
Ch 6. Pointers
Oblivious DNS over HTTPS (ODoH): A Practical Privacy Enhancement to DNS
Simple TLS Client and Server
Fri 2/6
RebirthDay Attack: Reviving DNS Cache Poisoning with the Birthday Paradox
Anonymous Communication / VPNs / Tor Week 4
Mon 2/9
Ch 7. Types, Methods, and Interfaces
The Dining Cryptographers Problem: Unconditional Sender and Recipient Untraceability
Wed 2/11
Tor: The Second-Generation Onion Router
Fri 2/13
OpenVPN is Open to VPN Fingerprinting
Group Messaging Week 5
Mon 2/16
Ch 8. Generics
The Double Ratchet Algorithm
Wed 2/18
SoK: Secure Messaging
Fri 2/20
On Ends-to-Ends Encryption: Asynchronous Group Messaging with Strong Security Guarantees
Email Week 6
Mon 2/23
Ch 9. Errors
End-to-End Measurements of Email Spoofing Attacks
Wed 2/25
A Longitudinal and Comprehensive Study of the DANE Ecosystem in Email
Fri 2/27
Composition Kills: A Case Study of Email Sender Authentication
Malware / Botnets Week 7
Mon 3/2
Ch 10. Modules, Package, and Imports
Understanding Linux Malware
Wed 3/4
Understanding the Mirai Botnet
Fri 3/6
Spring Break (No Class) Week 8
No class this week (March 7 - 15).
Cryptographic Attacks Week 9
Mon 3/16
Ch 11. Go Tooling

No class

Wed 3/18
Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices
Fri 3/20
RADIUS/UDP Considered Harmful
Authorization Week 10
Mon 3/23
Ch 12. Concurrency in Go
Privacy Pass: Bypassing Internet Challenges Anonymously
Wed 3/25
Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud
Fri 3/27
WAVE: A Decentralized Authorization Framework with Transitive Delegation
Remote/Cloud Storage Week 11
Mon 3/30
Ch 13. The Standard Library
Practical Techniques for Searches on Encrypted Data
Wed 4/1
DupLESS: Server-Aided Encryption for Deduplicated Storage
Fri 4/3
The File That Contained the Keys Has Been Removed: An Empirical Analysis of Secret Leaks in Cloud Buckets and Responsible Disclosure Outcomes
Private Information Retrieval Week 12
Mon 4/6
Ch 13. The Standard Library
Private Information Retrieval
Wed 4/8
Usable PIR
Fri 4/10
CONIKS: Bringing Key Transparency to End Users
Differential Privacy Week 13
Mon 4/13
Robust De-anonymization of Large Sparse Datasets
Wed 4/15
RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response
Fri 4/17
Differentially Private Password Frequency Lists
Trustworthy Computing Week 14
Mon 4/20
Shielding Applications from an Untrusted Cloud with Haven
Wed 4/22
VC3: Trustworthy Data Analytics in the Cloud Using SGX
Fri 4/24
Ryoan: A Distributed Sandbox for Untrusted Computation on Secret Data
Blockchain Week 15
Mon 4/27
Bitcoin: A Peer-to-Peer Electronic Cash System
Wed 4/29
SoK: Research Perspectives and Challenges for Bitcoin and Cryptocurrencies
Fri 5/1
Ethereum Whitepaper
Final Exam Week Week 16
Thu 5/7
We DO NOT have an exam in this class. However, if we did, our exam time would be Thursday 5/7 from 2-5pm. In lieu of an exam, we will meet so that each team can present a brief presentation of their semester's research project.

Deadline (@11:59pm): A member of your team must email me your research project report.