\documentclass[dvipsnames,14pt,t]{beamer}

\usepackage{../slides}

\usepackage{../graphics}

\usepackage{../langs}

\setmonofont[Scale=.88]{Consolas}

\newfontfamily{\consolas}{Consolas}

\hfuzz=220pt 

% beamer stuff 

\renewcommand{\slidecaption}{SEN 02, King's College London}

%Bank vs Voting

%http://www.parliament.vic.gov.au/images/stories/committees/emc/2010_Election/submissions/13_VTeague_EMC_Inquiry_No.6.pdf

% first cyber attack

%http://investigations.nbcnews.com/_news/2013/03/18/17314818-cyberattack-on-florida-election-is-first-known-case-in-us-experts-say

\newcommand{\bl}[1]{\textcolor{blue}{#1}}  

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{%

  \begin{tabular}{@ {}c@ {}}

  \\

  \LARGE Security Engineering (2)\\[-3mm] 

  \end{tabular}}\bigskip\bigskip\bigskip

\normalsize

  \begin{center}

  \begin{tabular}{ll}

  Email:  & christian.urban at kcl.ac.uk\\

  Office: & S1.27 (1st floor Strand Building)\\

  Slides: & KEATS (also homework is there)\\

  \end{tabular}

  \end{center}

\end{frame}

 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\begin{tabular}{c}This Course is about\\[-2mm]  ``Satan's Computer''\end{tabular}}

Ross Anderson and Roger Needham wrote:\bigskip

\begin{bubble}[10cm]

\small

``In effect, our task is to program a computer which gives 

answers which are subtly and maliciously wrong at the most 

inconvenient possible moment\ldots{} we hope that the lessons 

learned from programming Satan's computer may be helpful 

in tackling the more common problem of programming Murphy's.''

\end{bubble}\\[30mm]

\only<2>{

\begin{textblock}{11}(3.5,12)

\begin{tabular}{c}

\includegraphics[scale=0.12]{../pics/ariane.jpg}\\[-2mm]

\footnotesize Murphy's computer

\end{tabular}

\begin{tabular}{c}

\includegraphics[scale=0.15]{../pics/mobile.jpg}\;

\includegraphics[scale=0.06]{../pics/pinsentry.jpg}\\[-2mm]

\footnotesize Satan's computers

\end{tabular}

\end{textblock}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Defence in Depth}

\begin{center}\small

\pcode{urbanc:$6$3WWbKfr1$4vblknvGr6FcDeF92R5xFn3mskfdnEn...:...}

\end{center}

\begin{itemize}

\item hashes help when password databases are leaked

\item salts help with protecting against dictionary attacks

  and help people who have the same password on different sites\medskip

\item but they do not protect against a focused attack against a single 

  password and also do not make poorly chosen passwords any better

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Subtle Points}

\begin{itemize}

\item in our web-application the salt needed to remain secret;

  in password files the salt is public\bigskip

\item the NYT has the ``resource'' unlocked at first

  and locks it depending on the cookie data

\item our ``web-application'' has the resource locked at first,

  and unlocks it depending on the cookie data

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{How to Salt?}

\begin{center}\tt\small

\begin{tabular}{lcl}

1salt & $\Rightarrow$ & 8189effef4d4f7411f4153b13ff72546dd682c69\\

2salt & $\Rightarrow$ & 1528375d5ceb7d71597053e6877cc570067a738f\\

3salt & $\Rightarrow$ & d646e213d4f87e3971d9dd6d9f435840eb6a1c06\\

4salt & $\Rightarrow$ & 5b9e85269e4461de0238a6bf463ed3f25778cbba\\

\end{tabular}

\end{center}

\begin{itemize}

\item in Unix systems: \texttt{hash(salt + password)}, or even

\texttt{hash$^{\texttt{1500}}$(salt + password)}\smallskip\pause

\item Bruce Schneier in cases messages are long: \\

instead of \texttt{m $\mapsto$ hash(m)},\\ use \texttt{m $\mapsto$ hash(hash(m) + m)}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\Large\begin{tabular}{c}User-Tracking Without Cookies\end{tabular}}

Can you track a user {\bf without}:

\begin{itemize}

\item Cookies

\item JavaScript

\item LocalStorage/SessionStorage/GlobalStorage

\item Flash, Java or other plugins

\item Your IP address or user agent string

\item Any methods employed by Panopticlick\\

\mbox{}\hfill $\rightarrow$ \textcolor{blue}{\url{https://panopticlick.eff.org/}}

\end{itemize}

Even when you disabled cookies entirely, have JavaScript turned off and use a VPN 

service, and also \ldots

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}

\frametitle{Verizon}

\mbox{}\\[-23mm]\mbox{} 

\begin{center}

\includegraphics[scale=0.21]{../pics/verizon.png}

\end{center}

\vfill\footnotesize

\url{http://webpolicy.org/2014/10/24/how-verizons-advertising-header-works}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Web-Protocol}

\only<1->{

\begin{textblock}{1}(2,2)

  \begin{tikzpicture}[scale=1.3]

  \draw[white] (0,0) node (X) {\includegraphics[scale=0.12]{../pics/firefox.jpg}};

  \end{tikzpicture}

\end{textblock}}

\only<1->{

\begin{textblock}{1}(11,2)

  \begin{tikzpicture}[scale=1.3]

  \draw[white] (0,0) node (X) {\includegraphics[scale=0.15]{../pics/servers.png}};

  \end{tikzpicture}

\end{textblock}}

\only<1->{

\begin{textblock}{1}(5,2.5)

  \begin{tikzpicture}[scale=1.3]

  \draw[white] (0,0) node (X) {};

  \draw[white] (3,0) node (Y) {};

  \draw[red, ->, line width = 2mm] (X) -- (Y);

  \node [inner sep=5pt,label=above:\textcolor{black}{\small GET static.jpg}] at ($ (X)!.5!(Y) $) {};

  \end{tikzpicture}

\end{textblock}}

\only<2->{

\begin{textblock}{1}(5,6)

  \begin{tikzpicture}[scale=1.3]

  \draw[white] (0,0) node (X) {};

  \draw[white] (3,0) node (Y) {};

  \draw[red, <-, line width = 2mm] (X) -- (Y);

  \node [inner sep=5pt,label=below:\textcolor{black}{\small ETag: 7b33de1}] at ($ (X)!.5!(Y) $) {};

   \node [inner sep=5pt,label=above:{\includegraphics[scale=0.15]{../pics/tvtestscreen.jpg}}] at ($ (X)!.5!(Y) $) {};

  \end{tikzpicture}

\end{textblock}}

\only<3->{

\begin{textblock}{1}(4.2,11)

  \begin{tikzpicture}[scale=1.3]

  \draw[white] (0,0) node (X) {};

  \draw[white] (3,0) node (Y) {};

  \draw[red, ->, line width = 2mm] (X) -- (Y);

  \node [inner sep=5pt,label=above:\textcolor{black}{\small GET static.jpg ETag: 7b33de1}] at ($ (X)!.5!(Y) $) {};

  \end{tikzpicture}

\end{textblock}}

\only<4->{

\begin{textblock}{1}(4.2,13.9)

  \begin{tikzpicture}[scale=1.3]

  \draw[white] (0,0) node (X) {};

  \draw[white] (3,0) node (Y) {};

  \draw[red, <-, line width = 2mm] (X) -- (Y);

  \node [inner sep=5pt,label=below:\textcolor{black}{\small HTTP/1.1 304 (Not Modified)}] at ($ (X)!.5!(Y) $) {};

  \end{tikzpicture}

\end{textblock}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Today's Lecture}

\begin{center}

\begin{tabular}{ccc}

\large online banking  & \hspace{3mm}\large{}vs\hspace{3mm} & \large e-voting\\

\textcolor{gray}{solved} & & \textcolor{gray}{unsolved}\\

\end{tabular}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{E-Voting}

\begin{bubble}[9cm]

``Any electronic voting system should provide at least the same

security, privacy and transparency as the system it replaces.''

\end{bubble}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{Voting as Security Problem}

What are the security requirements of a voting system?\bigskip

\begin{itemize}

\item<2->Integrity 

\item<3->Ballot Secrecy

\item<5->Voter Authentication

\item<6->Enfranchisement

\item<7->Availability

\end{itemize}

\only<2>{

\begin{textblock}{5.5}(8,5)

\begin{bubble}[5cm]\small

\begin{center}

\begin{minipage}{4.5cm}

\begin{itemize}

\item The outcome matches with the voters' intend.

\item There might be gigantic sums at stake and need to be defended against.

\end{itemize}

\end{minipage}

\end{center}

\end{bubble}

\end{textblock}}

\only<4>{

\begin{textblock}{5.5}(8,5)

\begin{bubble}[5cm]\small

\begin{center}

\begin{minipage}{4.5cm}

\begin{itemize}

\item Nobody can find out how you voted.

\item (Stronger) Even if you try, you cannot prove how you voted.

\end{itemize}

\end{minipage}

\end{center}

\end{bubble}

\end{textblock}}

\only<5>{

\begin{textblock}{5.5}(8,5)

\begin{bubble}[5cm]\small

\begin{center}

\begin{minipage}{4.5cm}

\begin{itemize}

\item Only authorised voters can vote up to the permitted number of votes.

\end{itemize}

\end{minipage}

\end{center}

\end{bubble}

\end{textblock}}

\only<6>{

\begin{textblock}{5.5}(8,5)

\begin{bubble}[5cm]\small

\begin{center}

\begin{minipage}{4.5cm}

\begin{itemize}

\item Authorised voters should have the opportunity to vote.

\end{itemize}

\end{minipage}

\end{center}

\end{bubble}

\end{textblock}}

\only<7>{

\begin{textblock}{5.5}(8,5)

\begin{bubble}[5cm]\small

\begin{center}

\begin{minipage}{4.5cm}

\begin{itemize}

\item The voting system should accept all authorised votes and produce results in a timely manner.

\end{itemize}

\end{minipage}

\end{center}

\end{bubble}

\end{textblock}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{Problems with Voting}

\begin{center}\large

\begin{tabular}{rcl}

Integrity & vs. & Ballot Secrecy\bigskip\\

Authentication & vs. &Enfranchisement   

\end{tabular}

\end{center}\bigskip\bigskip\pause

Further constraints:

\begin{itemize}

\item costs

\item accessibility

\item convenience

\item intelligibility 

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{Traditional Ballot Boxes}

\begin{center}

\includegraphics[scale=2.5]{../pics/ballotbox.jpg}

\end{center}\pause\bigskip

mechanical, but they need a ``protocol''

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}

\frametitle{Motives for E-Voting}

\begin{itemize}

\item 76\% of pensioners in the UK vote, but only 44\% of the under-25s\bigskip

\item convenience\bigskip

\item speed 

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%