Course evaluation tilkry25

[dbosk]

Course analysis (based on course evaluation)

Changes made since previous course offering

Made the AES presentation mandatory. That meant that students had to do one more optional assignment to get an A. (Students complained last year that it was too easy to get an A.)

Changed INL1Quiz to be unlimited attempts, instead of one attempt with oral presentation if F. Changed it to multiple choice questions to have it autograded instead of manual grading.

Added HAC as course literature, mapping the lectures to the different chapters. Added chapters as FeedbackFruits interactive documents. Then students can discuss and ask questions "in the material".

Added AES standard documentation to support AES implementation. Also as an interactive document.

Added other literature for other topics, e.g. a good research paper illustrating the problems of side channels.

Introduced Mats' lecture series on protocol design. This is the core part of the course, but it was left more implicit in earlier instances. Now we tried to emphasize this part and make it more explicit.

Made the Ciphertext Challenge unlimited attempts too. Previously you had one attempt and then had to orally present to pass.

Added a conclusion lecture that worked as a final Q&A this year.

Compilation of course evaluation results (e.g. course evaluation board, course meeting & free text survey responses)

What worked well in the course, according to free-text answers:

• optional assignments,
• mandatory assignments,
• lectures,
• seminars,
• the cryptanalysis assignment,
• the Cryptopals assignment,
• course material in FeedbackFruits,
• recorded lectures.

What can be developed:

• The scheduling: post time slots earlier, clearer communication about deadlines.
• Mandatory assignments should be graded before optional assignments.
• "The course also felt a bit lackluster and does not distinguish itself from DD2391 enough. Much the same
  content is brought up (crypto, side channels, protocols) and the "slightly more details" and "slightly different
  perspective" does very little to make the content fresh."
• "Ciphertext analysis was also really fun, maybe consider adding a third (optional, harder) ciphertext that gives bonus points :)?"
• Clarify INL1Written: what is expected?
• "The difficulty level varied hugely between the different optional assignments, cryptopals needed a lot of time for A while side channels didn't."
• "Some of the questions on INL1Quiz where a bit unclear and asked about things that weren't really explained during the course"

Course coordinator's reflections on what has worked well and what can be developed in the course

INL1Quiz was delayed due to redevelopment. That is not an issue for next year.

We can schedule presentation time slots with better distribution during the course. And with better predictability.

We got a surprise increase in the number of students this year: from ~50 during the last few years to ~80 this year. But it was worked surprisingly well.

Summary of changes introduced for upcoming course offering (compile briefly)

INL1Quiz will be split (the existing quiz) into parts fitting each lecture. I have already prepared for this when developing the quiz this year. Then they'll take the quiz for a lecture before the lecture, attend the lecture or read the texts (or both), then complement the quiz to 100%. This suggestion was received well in the survey's free-text answers.

Continue the work on the focus on protocol design. I will use the last lecture to go through previous INL1Written problems in detail: good and bad solutions and connect the different parts of solutions back to the different parts of the course. This should help the students see the relevance of the different parts of the course.

This year many didn't realize the need for a block mode for AES in the INL1Written scenario. Summarizing the course and the relationship and relevance between all parts might help with that in the future.

The change of INL1Quiz to be per lecture and the summary of old INL1Written solutions can be used to sync up all the lectures in the course so that what is expected to be covered and what is covered better overlap. (To address the problem of some parts of INL1Quiz not being covered in the lectures.)

INL1 - Brief comment on result

We got 62 P out of the 78 (specified here as registered) or 87 students in Canvas. We could get 5 more as 5 students currently have an F on INL1Quiz.

LAB1 - Brief comment on result

LAB1 grades:
     15 A
      5 B
      1 C
      1 D
     38 E
     20 F

In total 60 passing students, which is in sync with the results of INL1.

The grade distribution has changed since last year.

tilkry24 LAB1 grades:
     11 A
     12 B
      1 C
     16 E
     12 F

This will probably even out a bit once Lab Week has passed so that students can finish more optional assignments to increase their grade.

[dbosk]

Evaluation from TCYSM link meeting (studienämnden)

Much appreciated course in general.

Students like the practical assignments. Good for introducing concepts. The Ciphertexts Challenge is good to do things in practice.

Good that it's flexible to choose optional assignments.

Guest lecture from MUST is appreciated to exemplify applied crypto.

Grading criteria was clear, clearer than last year.

Questions on quiz was better than last year, clearer. But the format wasn't the best.

Overlap with Cybersecurity Overview. Particularly protocol design. ProVerif is also in the Overview course. Also covered in the NSS course.

The seminars don't seem to have a connection to the course. Maybe the seminars fit better in Overview or cybsam? Try to connect things better, particularly the seminars.

The sidechannels assignment is easier than the other assignments. So some are more difficult than others.

[dbosk]

Date: Fri, 2 May 2025 19:52:01 +0200
From: Mathias Magnusson master-cys@datasektionen.se
To: dbosk@kth.se
Subject: Notes for DD2520 at TCYSM Link meeting P3
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=utf-8

Hello Daniel!

Sorry about the delay, but as requested this is the feedback that was
presented during the link meeting for DD2520 in written form.

Positive Aspects

• Overall a very appreciated course.
• Good practical assignments that both introduce new concepts as well as
  give students the opportunity to practice. For example, the cryptanalysis
  exercise is quite easy in theory but hard to implement, so nice to practice.
• System of optional exercises was flexible, giving students choice in
  what areas to put more focus into.
• Operational grading criteria was clearly communicated so it was clear
  what one must do to achieve each grade.
• Guest lecture from MUST exemplified topics within cryptography in the
  real-world in an interesting way. Also cool that he brought a little
  “cryptography history museum”.
• The quiz seems better than last year’s edition. All questions and
  answers were clear and within the course contents.

Negative Aspects

• Getting the whole quiz at the end probably isn’t very educational.
  Neither does it assess much since you had unlimited tries. (But should be
  fixed with the changes Daniel proposed)
• A lot of overlap with DD2391, specifically protocol design.
• The seminars don’t really have any connection to the rest of the course,
  and don’t cover cryptography specifically. (To the extent they do, they
  equally apply to security in general)
• The difficulty of the optional exercises was quite uneven. Side channels
  was especially easy.

Suggestions

• Follow through with Daniel’s planned changes for the quiz.
• (Not serious) Rename course to “Kryptografins applikationer och
  tillämpningar” so it can be shortened "kryatill*"*.

Vänliga hälsningar,

Mathias Magnusson

Masterrepresentant TCYSM

Konglig Datasektionen, KTH