Foundations of Computer Security
[COURSECODE] Autumn 2025
Overview
Overview text
Content
Course Information
- Staff
- Instructor: Anwar Hithnawi
- TAs: TODO
- E-mail: ahithnawi@cs.toronto.edu
- Time & Location:
- Lecture: Time: Mon 9:00-11:00 am. Room BA1180
- Discussion: Time: Wed 10:00-11. Room: BA1130
- Office Hours: By appointment. Use this link to book an appointment. TODO: Check link
Important Links
- Course Website: https://pps-lab.com/teaching/comsec
- Quercus (announcements): TODO
All course materials, including the schedule, lecture slides, and readings, will be available on the course website.
Prerequisites
TODO check this text
A general background in computer systems and cryptography is required. There is no required textbook for this course. For a refresher on security concepts, you can consult the Berkeley Introduction to Security Textbook and for cryptography, see A Graduate Course in Applied Cryptography.
Course Evaluation
- Homework (10%)
- Four homework assignments, weighted equally
- Completed individually
- No credit for late submissions unless an extension is granted
- Graded via MarkUs
- Projects (20%)
- Two projects:
- Project 1 (10%)
- Project 2 (10%)
- Can be completed individually or in groups of 2
- No credit for late submissions unless an extension is granted
- Graded via MarkUs
- Two projects:
- Midterm Exam (30%)
- Final Exam (40%)
Late Policy
TODO Check
Paper reviews: No reviews are accepted once the class has started. You may skip reviews for two papers without penalty.
Project proposal and final report: If your project proposal or final report is submitted late, 20% will be deducted from the grade for each day it is overdue.
Policy on the Use of Artificial Intelligence
Large-language model-based tools (e.g., ChatGPT) can be very helpful, and you are encouraged to leverage them. However, please do not use them in any way that trivializes the assignments or bypasses the course's learning objectives. If you have doubts about permissible usage, please check with the instructor first.
Course Deadlines
Homework / Project / Exam | Announced | Due |
---|---|---|
Homework 1 | Sep 8 | Sep 22 |
Project 1 | Sep 15 | Sep 29 |
Homework 2 | Sep 29 | Oct 6 |
Midterm | - | Oct 20 |
Homework 3 | Oct 27 | Nov 10 |
Homework 4 | Nov 10 | Nov 24 |
Project 2 | Nov 3 | Nov 24 |
Project 1: Secure Messaging System
Project 2: Vulnerability Detection Tool
Schedule and Readings
The schedule may be adjusted as the semester progresses; any changes will be announced in class and on Quercus. TODO check
(2h lecture per week; Mon 9-11 am; Room: BA 1180, 1h Discussion Wed 10-11 Room: BA 1130. Fall term – no class during UofT Reading Week in mid‑October)
# | Week | Core Lecture Topics | Tutorials (Wed 10-11 that week) | Readings |
---|---|---|---|---|
1 | Sep 8 | Security principles & threat modeling - CIA goals, design principles, attacker thinking. | Tutorial: Math foundations for cryptography HW #1 out | |
2 | Sep 15 | Symmetric crypto foundations - PRGs, block ciphers, modes. | Project 1 announced. Project 1 design check and help session | |
3 | Sep 22 | Integrity & authentication - Hashes, MACs, AE. | Tutorial: Intro to computer networks(1) HW #1 due; solution discussion | |
4 | Sep 29 | Public-key crypto & PKI - DH, RSA, signatures, certs. | Tutorial: Intro to computer networks (2) HW #2 out; Project 1 due | |
5 | Oct 6 | Secure transport & messaging - TLS, Signal, HTTPS pitfalls. | Tutorial: Intro to operating systems HW #2 due | |
6 | Oct 13 | Holiday | Ethics Module | |
7 | Oct 20 | Memory-safety & control-flow attacks - Buffer/heap overflows, ROP | Midterm | |
8 | Oct 27 | Reading Week | Reading Week HW #3 out | |
9 | Nov 3 | Defences & isolation - ASLR, DEP, CFI; sandboxing, containers | Project 2 lab announced | |
10 | Nov 10 | Operating-system security - AuthN/Z, reference monitor, privilege separation. Network security I - Threats, spoofing, TCP hijack, DNS, firewalls/IDS. | HW #3 due; HW #4 out | |
11 | Nov 17 | Web security I - Browser model, SOP, XSS, CSRF. | Project 2 lab help session | - |
12 | Nov 24 | Web security II & privacy - SQLi, session bugs, Tor, malware survey. | Project 2 due; HW #4 due | |
13 | Dec 1 | Advanced topics & wrap-up - ZK proofs, MPC, differential privacy |