Mathias Antoine

Sandrine Boschi-Muller

Guy Branlant
email: guy.branlant@maem.uhp-nancy.fr

Kinetic Characterization of the Chemical Steps Involved in the Catalytic Mechanism of Methionine Sulfoxide Reductase A from Neisseria meningitidis

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Methionine residues are easily oxidized to methionine sulfoxides (MetSO) 1 by reactive oxygen and nitrogen species produced either by aerobic metabolism or after exposure to various agents. This post-translation modification can provoke loss of protein function (1) and has been implicated in the aging process (for a review, see Ref. 2). Therefore, organisms have developed various defense strategies. One consists of restoring the biological function of the modified MetSO proteins. This is the role of methionine sulfoxide reductases (Msr), which reduce MetSO back to methionine (Met). There exist two classes of Msrs, called MsrA and MsrB. The physiological role of MsrAs has been particularly well illustrated. For instance, mice lacking MsrA show an atypical walking pattern and have a reduced life span [START_REF] Moskovitz | Proc. Natl. Acad. Sci. U. S. A[END_REF], whereas in contrast, overexpression of the msrA gene in the nervous system markedly extends the life span of the fruit fly Drosophila [START_REF] Ruan | [END_REF].

MsrAs and MsrBs have been extensively characterized at both structural (5)(6)(7)(8)(9) and enzymatic levels (10 -14). Although MsrAs from Escherichia coli, Bos taurus, and Mycobacterium tuberculosis and MsrB from Neisseria gonohorreae show quite different three-dimensional x-ray structures and are specific for the S and the R isomers of the sulfoxide of MetSO, respectively, both structural classes of Msrs present a similar, new catalytic mechanism that includes a minimum of three chemical steps (Scheme 1). This is the case for MsrA and MsrB from Neisseria meningitidis (13). In the first step, a Michaelis complex is formed between Msr and MetSO that precedes the nucleophilic attack of the catalytic cysteine on the sulfoxide of MetSO. Then, a 1,3-sigmatropic rearrangement of the tetrahedral transition state probably occurs, which leads to formation of a sulfenic acid intermediate with a concomitant release of 1 mol of Met/mol of Msr. In the second step, an intradisulfide bond is formed between the cysteine oxidized under sulfenic acid state and another cysteine. Finally, in the third step, a Michaelis complex is formed between the oxidized Msr and the reduced form of thioredoxin (Trx) that precedes the reduction of the disulfide bond of the Msr by Trx. Such a mechanism is in agreement with the ping-pong mechanism that was recently determined for the MsrA from E. coli (11) and for the MsrB from N. meningitidis. 2 No information is presently available for any of the two classes of Msrs on the nature of the amino acids essential for the catalysis or on the substrate stereo specificities. Such studies require first determining the rates of all the steps implicated in the mechanism to interpret the effects of the amino acid substitutions introduced by site-directed mutagenesis. As mentioned above, a sulfenic acid intermediate is formed in the first step. However, no information is available on the nature of the transition state(s) that leads to the sulfenic acid intermediate and on the efficiency of the reduction of MetSO. Furthermore, we do not know how efficient the formation of the intradisulfide bond is. In addition, finally, no kinetic data are available for the Trx reduction process.

In the present study, the rates of the three steps have been investigated for the MsrA from N. meningitidis. To attain these rates, adapted experimental kinetics approaches were used. The data show that the step associated with the Trx reduction process is rate-limiting, whereas the rate of the sulfoxide re-duction is very rapid and is rate-determining in the process leading to the formation of the intradisulfide bond. These results are discussed in relation with the three-dimensional structures of MsrAs described so far.

EXPERIMENTAL PROCEDURES

Site-directed Mutagenesis, Production, and Purification of Wild-type and Mutant N. meningitidis MsrAs-The E. coli strain used for all N. meningitidis MsrA productions was BE002 (MG1655 msrA::spec⍀, msrB::␣ 3kana), transformed with the plasmidic construction pSKPILBMsrA containing the coding sequence of msrA under the lac promoter (13). The BE002 strain was kindly provided by Dr F. Barras. Its use prevented expression of endogenous wild-type MsrA and MsrB from E. coli and thus avoided any contamination of the activity of the N. meningitidis MsrA by the Msrs from E. coli. Site-directed mutageneses were performed using the QuikChange site-directed mutagenesis kit (Stratagene).

Purifications were realized as described previously (13) with minor modifications. A Q-Sepharose column was done at 4 °C, and wild-type and mutant proteins were eluted at 80 mM KCl. At this stage, wild-type and mutant MsrAs were pure, as checked by electrophoresis on 12.5% SDS-PAGE gel followed by Coomassie Brilliant Blue R-250 staining and by electrospray mass spectrometry analyses.

Storage of the enzymes was done as described previously (13). The molecular concentration was determined spectrophotometrically, using extinction coefficient at 280 nm of 26,200 M Ϫ1 cm Ϫ1 for wild-type and C198S MsrA (13) and 20,480 M Ϫ1 cm Ϫ1 for W53F MsrA. In this report, N. meningitidis MsrA amino acid numbering is based on E. coli MsrA.

Quantification of the Free Cysteine Content with 5,5Ј-Dithiobis(2nitro)benzoate (DTNB)-Cysteine content of MsrA and Trx was determined using DTNB under nondenaturing conditions in buffer A (50 mM Tris-HCl, 2 mM EDTA, pH 8) as described previously (10).

Preparation of MsrA and Trx, under Oxidized Disulfide State-MsrA oxidation was achieved by mixing 100 M MsrA with 100 mM MetSO in buffer A. The MetSO used was DL-Met-R,S-SO, of which only the S isomer is a substrate for MsrA. For Trx, oxidation was achieved by mixing 500 M Trx with 1 mM DTNB in buffer A. After 10 min of incubation at room temperature, oxidized proteins were passed through an Econo-Pac 10 DG desalting column (Bio-Rad) equilibrated with buffer A. Oxidation of both proteins in the disulfide state was checked by titration with DTNB.

Fluorescence Properties of Wild-type and Mutated MsrAs and Trx-The fluorescence characteristics of 1) the wild-type MsrA in its reduced form and Cys-51/Cys-198 disulfide state, 2) the C198S MsrA in its reduced form and sulfenic acid state, 3) the W53F MsrA in its reduced form and Cys-51/Cys-198 disulfide state, and 4) the TrX in its reduced and disulfide state were recorded on an flx spectrofluorometer (SAFAS) thermostated at 25 °C, in buffer A with 10 M of each protein (see the legends of Figs. 1 and2 for more details).

Determination of the Rate of Met Formation and of Thiol Loss by Single Turnover Quenched-flow Experiments-Quenched-flow measurements were carried out at 25 °C on a SX18MV-R stopped-flow apparatus (Applied PhotoPhysics) fitted for the double-mixing mode and adapted to recover the quenched samples. The apparatus worked in a pulsed mode. Under the conditions used, a minimum aging time of about 25-40 ms was determined. Equal volumes (57.5 l) of a solution containing 550 M MsrA in 50 mM MES, pH 5.5, or buffer A and a solution containing 200 mM MetSO in 50 mM MES, pH 5.5, or buffer A were mixed in the aging loop. The mixture was then allowed to react for 40 -500 ms before being mixed with 115 l of a quenching aqueous solution containing 2% of trifluoroacetic acid. Quenched samples were then collected in a 200-l loop. For each aging time, four shots were done, and the four corresponding quenched samples were pooled in a volume of 700 l and then analyzed.

To precipitate the protein, 50 l of 100% trifluoroacetic acid were added to aliquots of 300 l of the quenched samples. Samples were centrifuged at 12,000 ϫ g for 30 min at room temperature. Met quantification in the resulting supernatant was carried out by reverse-phase chromatography as described previously in Ref. 10, with slight modifications: 100 l were injected onto a 4.6 ϫ 250 mm Atlantis dC18 reverse-phase column (Waters) on an AKTA explorer system (Amersham Biosciences), equilibrated with H 2 O, 7.5% acetonitrile, 0.1% trifluoroacetic acid. Met was eluted isocratically after MetSO.

The other part of the quenched samples that were not treated with 100% of trifluoroacetic acid was used to 1) determine the protein concentration from the absorbance at 280 nm and 2) quantify the free cysteine content, using 2,2Ј-dipyridyldisulfide as a thiol probe, in the presence of urea to avoid precipitation of the protein in the cuvette. Progress curves of pyridine-2-thione production were recorded at 343 nm in 1.1 M urea, buffer A. Enzyme concentration was 6.19 M, and 2,2Ј-dipyridyldisulfide concentration was 665 M. The amount of pyridine-2-thione formed was calculated using an extinction coefficient at 343 nm of 8,080 M Ϫ1 cm Ϫ1 .

Data were plotted as mol of Met formed per mol of MsrA and as free remaining thiols per mol of MsrA, both as a function of time. The rate of Met formation was determined by fitting the curve to the monoexponential equation (Equation 1) in which a represents the fraction of Met formed per mol of MsrA and k obs represents the rate constant.

y ϭ a͑1 Ϫ e Ϫkobs t ) (Eq. 1)
The rate of loss in free thiols was determined by fitting the curve to the monoexponential equation (Equation 2) in which y 0 represents the number of free remaining thiols, a represents the number of oxidized thiols, and k obs represents the rate constant. y ϭ y 0 ϩ a e Ϫkobs t (Eq. 2)

Kinetics of the Formation of the Cys-51/Cys-198 MsrA Disulfide Bond in the Absence of Trx by Single Turnover Stopped-flow Experiment-

Kinetics of the MsrA fluorescence increase associated with the formation of the Cys-51/Cys-198 disulfide bond were measured at 25 °C on a SX18MV-R stopped-flow apparatus (Applied PhotoPhysics) fitted for fluorescence measurements. The excitation wavelength was set at 284 nm, and the emitted light was collected using a 320-nm cutoff filter. One syringe contained MsrA in buffer A (10 M, final concentration after mixing), and the other one contained MetSO at various concentrations in buffer A (25 mM to 1 M, final concentration). An average of six runs was recorded for each MetSO concentration. Rate constants, k obs , were obtained by fitting fluorescence traces with the monoexponential equation (Equation 3) in which c represents the end point, a represents the amplitude of the fluorescence increase (Ͻ0), and k obs represents the rate constant. y ϭ a e Ϫkobs t ϩ c (Eq. 3)

Data were fit to Equation 4 using least squares analysis to determine k obs max and K for MetSO. S represents the MetSO concentration, and K represents the apparent affinity constant.

k obs ϭ k obs max S/K ϩ S (Eq. 4)
Kinetics of the Reduction of the Cys-51/Cys-198 MsrA Disulfide Bond by Trx by Single Turnover Stopped-flow Experiments-Kinetics measurements of the Trx fluorescence quenching associated with the formation of the Cys-32/Cys-35 disulfide bond upon the reduction of the oxidized MsrA were carried out as described above. The excitation wavelength was set at 310 nm, and the emitted light was collected using a 320-nm cutoff filter. One syringe contained the oxidized MsrA in buffer A (25 M, final concentration), and the other one contained the reduced Trx at various concentrations in buffer A (from 20 to 800 M, final concentration). An average of six runs was recorded for each concentration of Trx. Rate constants, k obs , were obtained by fitting fluorescence traces with the monoexponential Equation 3 with a Ͼ 0. To investigate the rates of all these steps thus implied setting up experimental approaches that selectively apprehended each rate. For the formation of the sulfenic acid intermediate, the rate was determined by following that of the Met formation under single turnover conditions, i.e. in the absence of Trx. For the formation of the Cys-51/Cys-198 disulfide bond, two methods were used, also under single turnover conditions. The first one took advantage of the observation that the fluorescence emission intensity of MsrA increased upon going from the reduced to the oxidized disulfide forms. The second one used a specific thiol reagent to follow the rate of the oxidation of Cys-51 and Cys-198, which was shown to occur concomitantly. The third step was apprehended by following the rate of the reduction of the Cys-51/Cys-198 disulfide bond by Trx under single turnover conditions, using as a probe the quenching of the Trx fluorescence intensity upon going from reduced to oxidized forms. Finally, the catalytic constants of MsrA were determined for the MetSO reductase step and the Trx-reducing step as well, under conditions in which the concentrations of the substrates were nearly saturating.

Characterization of the Fluorescence Properties of the MsrA and Trx under Reduced and Disulfide Oxidized Forms-MsrA, under reduced form, presented a maximum excitation wavelength at 284 nm and a fluorescence emission maximum at 302 nm with a shoulder around 340 nm (Fig. 1). This suggested a contribution of both tyrosine and tryptophan residues to the fluorescence signal when excitation was set at 284 nm. In MsrA from N. meningitidis, there are 16 tyrosines and 1 tryptophan at position 53. When excitation was done at 295 nm, a fluorescence emission maximum was observed at 340 nm (Fig. 1). This suggested the contribution of only Trp-53 at this excitation wavelength. This was confirmed by the fact that W53F MsrA did not exhibit any fluorescence emission at 340 nm when the excitation was done at 295 nm (spectrum not shown). When excited at 295 nm, oxidized MsrA in the Cys-51/Cys-198 disulfide state also showed a fluorescence emission maximum at 340 nm but with a fluorescence increase of 85% (integrated from 320 to 450 nm) when compared with that of the reduced form (Fig. 1). Inspection of the x-ray structure shows that Trp-53 is situated in an ␣ helix near the catalytic Cys-51 (5). Therefore, the formation of the Cys-51/Cys-198 disulfide bond, which is located near Trp-53, is likely responsible for the increase of the fluorescence emission intensity at 340 nm.

As already shown by others, Trx1 from E. coli exhibited a fluorescence emission maximum at 342 nm when excited at 280 nm (17). Two tryptophans are present in the E. coli enzyme at positions 28 and 31, and it was shown that Trp-28 is mainly responsible for the strong quenching of the fluorescence emission intensity observed when Trx is oxidized in the Cys-32/ Cys-35 disulfide state (17)(18)(19). Therefore, following the rate associated with the formation of the Cys-32/Cys-35 Trx disulfide bond on a stopped-flow apparatus equipped for fluorescence measurements can give information on the nature of the rate-limiting step in the Trx-reducing process provided that the fluorescence signal of the Msr does not interfere. As mentioned above, the reduction of the Cys-51/Cys-198 MsrA bond also leads to a quenching of the fluorescence emission intensity at 340 nm. However, as shown in Fig. 2, when the excitation was done at 295 nm, the contribution of MsrA to the quenching of the fluorescence signal is small when compared with that of Trx. It is even insignificant when the excitation was done at 310 nm and when considering the ratio of the fluorescence emission intensity of both partners, integrated from 320 to 450 nm (Fig. 2).

Rate of the Met Formation-A means to determine the rate of the formation of the sulfenic acid intermediate was to attain that of the Met, which is formed concomitantly. To do so, the stopped-flow apparatus was adapted to be used in a quenchedflow mode. At various times of incubation of MsrA with MetSO, in the absence of Trx, the reaction mixture was quenched by mixing it with trifluoroacetic acid. Met was then quantified by reverse-phase chromatography analysis (see "Experimental Procedures" for more details). The study was done at 100 mM MetSO, a concentration that is known to be saturating under steady-state conditions (13). At pH 8, which is the optimum pH determined under steady-state conditions (data not shown), a Met burst was observed with a stoichiometry of 0.9 mol of Met/mol of MsrA. However, the rate of the Met formation was too fast, at least 100 s Ϫ1 , to be determined with the apparatus adapted for quenched-flow experiments, which gave a minimum aging time around 30 ms. In contrast, at pH 5.5, the curve profile fitted to the monoexponential Equation 1 with a k obs value of 12 Ϯ 1 s Ϫ1 and a stoichiometry of 0.9 Ϯ 0.1 mol of Met/mol of MsrA (Fig. 3). Under steady-state conditions, at 200 M Trx and 100 mM MetSO, k cat values were 7 and 0.6 s Ϫ1 at pH 8 and 5.5, respectively. Therefore, the data demonstrated that the rate-limiting step in MsrA occurs after the formation of the A second approach for determining the rate of the formation of the Cys-51/Cys-198 disulfide bond was to follow the loss of the two free thiol groups. This analysis was done with the samples obtained from the quenched-flow experiments described above. As suggested above, as soon as Cys-51 is oxidized into sulfenic acid form, Cys-198 forms a disulfide bond with Cys-51. Consequently, the enzyme should pass directly from the reduced state form with two free thiols to the oxidized Cys-51/Cys-198 disulfide form with no more free thiols. At pH 5.5 and using 100 mM MetSO, the curve profile fitted to the monoexponential Equation 2, with the loss of two cysteines and a k obs value of 20 Ϯ 2 s Ϫ1 (Fig. 3). The fact that the k obs value is in the range of that found for the Met formation again supports a rate-determining step associated with the formation of the sulfenic acid intermediate and the nonaccumulation of the sulfenic acid intermediate. A quenched-flow experiment was carried out at 25 °C in 50 mM MES, pH 5.5. Briefly, reduced MsrA (275 M, final concentration) was allowed to react with MetSO (100 mM, final concentration) in the aging loop of the stopped-flow apparatus before being mixed with a 2% trifluoroacetic acid aqueous solution (1% final concentration). After recovery, quenched samples were used for Met quantification and free thiols titration as well (see "Experimental Procedures" for more details). Symbols represent experimental points (q for Met, Ⅺ for free thiols). Data were fitted to Equations 1 and 2, respectively, and gave rate constants of 11 Ϯ 1 and 20 Ϯ 2 s Ϫ1 , respectively.

Rate of the Reduction of

For each concentration of Trx, a k obs value was determined. At a concentration of 200 M Trx, a k obs value of 9.5 s Ϫ1 was obtained (Fig. 5). This value is in the range of the rate value of 7 s Ϫ1 found under steady-state conditions, i.e. 200 M Trx and 100 mM MetSO, and under conditions in which the process of Trx reduction by thioredoxin reductase and NADPH was shown not to be rate-limiting. These results demonstrated that the rate-limiting step of MsrA is associated with the Trx reduction process. Furthermore, we could conclude that the ratelimiting step is prior to the dissociation of oxidized Trx from reduced MsrA, a step that occurs after the chemical process. In this context, the rate-limiting step can be associated either with the formation of the Michaelis complex between the oxidized intradisulfide bond, and therefore is not rate-limiting.

The K m Trx and k obs max values cannot be determined with accuracy (Fig. 5). This is because when Trx is in a large excess when compared with MsrA, the fluorescence quenching message measured upon the formation of the oxidized Trx becomes small as compared with the fluorescence message of the remaining reduced Trx and, as a consequence, the quenching signal cannot be measured with great precision. Therefore, only an estimation of the K m Trx and of the k obs max values was made, i.e. 500 -900 M and at least 30 s Ϫ1 , respectively. The values of K m for Trx and k obs max are much higher than those described so far by our group and other groups, which were determined under steady-state conditions with the Trx reductase recycling system. This apparent discrepancy is probably due to the fact that under the steady-state conditions used, the rate of the Trx reductase process becomes rate-limiting at high concentrations of Trx.

Rate of the Met Formation under Saturating MetSO Concentration-The fact that the Trx reduction step is rate-limiting suggested that the K m value for MetSO determined under steady-state conditions was much lower than the apparent affinity constant in the MetSO reductase step. Indeed, having a slow step following a fast catalytic one always lowers the K m value for the substrate. Thus, the concentration of MetSO, i.e. 100 mM, which was used for determining the k obs of the reductase activity, was probably not saturating. This is indeed the case. At pH 8, using the fluorescence signal increase observed upon the formation of the Cys-51/Cys-198 bond, in the absence of Trx, a k obs value of 795 s Ϫ1 was observed at 800 mM MetSO. From the curve, an apparent affinity constant value of 740 mM for MetSO with a k obs max value of 1510 s Ϫ1 can be estimated (Fig. 6). These values are 80-and 40-fold higher than those determined under steady-state conditions at 200 M Trx, respectively. As shown above, the rate of the formation of the sulfenic acid intermediate is rate-determining in the process leading to the formation of the Cys-51/Cys-198 disulfide bond. Therefore, the k obs and affinity constant values correspond to those of the MetSO reductase step. In this context, it should be noted that the affinity constant values for the D and the L isomers of MetSO are similar (data not shown) and have to be divided by 2, taking into account the fact that the R isomer of the sulfoxide function of MetSO is neither a substrate nor an inhibitor of MsrA (13).

Conclusion-We have shown that 1) the rate-limiting step of the N. meningitidis MsrA reaction is associated with the thioredoxin reduction process and 2) the formation of the sulfenic acid intermediate is rate-determining within the two-step processes leading to the formation of the intradisulfide Cys-51/ Cys-198 intermediate. As already mentioned (11), three subclasses of MsrAs exist. The N. meningitidis enzyme, which is the prototype of the first subclass, contains two essential cysteines at positions 51 and 198. The second one, which is represented by E. coli and B. taurus MsrAs, possesses three essential cysteines at positions 51, 198, and 206. In this case, only the Cys-198/Cys-206 disulfide bond was shown to be reduced by Trx (10). In fact, the reduction of the Cys-51/Cys-198 bond probably does not occur because of its nonaccumulation. As soon as the Cys-51/Cys-198 disulfide intermediate is formed, Cys-206, which is located in a flexible region, attacks it and forms the Cys-198/Cys-206 disulfide bond, which is then reduced by Trx. The fact that in C206S E. coli MsrA, the Cys-51/ Cys-198 disulfide bond can be reduced by Trx (data not shown) supports our interpretation. The third subclass, which is rep-resented by the Bacillus subtilis MsrA, contains two essential cysteines at positions 51 and 54. Also, in this case, the ratelimiting step is associated with reduction by Trx (data not shown).

Under saturating concentrations of MetSO, at pH 8, the rates of formation of the sulfenic acid intermediate and of the Cys-51/Cys-198 disulfide bond are 1510 s Ϫ1 and at least 1510 s Ϫ1 , respectively. Thus, the chemical process that leads to the formation of the sulfenic acid is efficient. Cys-51 is probably activated by the active site, and the electrophilic character of the sulfur atom of the substrate sulfoxide and the rate of the 1,3-sigmatropic rearrangement of the tetrahedral transition state are likely increased via an acid catalyst belonging to the active site, which has been recently shown to be Glu-94 (data not shown). Both activations should favor the efficiency of the reductase process. Also, the rate of formation of the Cys-51/ Cys-198 disulfide bond is fast. Therefore, the nucleophilic attack of Cys-198 on sulfenic acid Cys-51 is also efficient. Inspection of the three-dimensional structures of MsrAs solved so far and comparison of the primary structures of MsrAs show that Cys-198 is located in a flexible region with no secondary structural elements (5). The fact that 1) a sulfenic acid is chemically unstable; 2) the Cys-198, as part of a flexible region, can easily approach position 51; and 3) an acidic amino acid likely intervenes to favor the release of the water molecule from the Cys-51 oxidized in the sulfenic acid state can explain why the formation of the Cys-51/Cys-198 disulfide bond is so efficient. Studies are presently underway to characterize all the amino acids of the MsrA from N. meningitidis, which are involved not only in the chemical activation of the three steps but also in the substrate specificities.

SCHEME 1 .

 1 SCHEME 1. Proposed catalytic mechanism of MsrA and MsrB from N. meningitidis. A Michaelis complex is formed between Msr and MetSO, which precedes the nucleophilic attack of Cys-X on the sulfur atom of the sulfoxide function of MetSO (step IA). Then, a 1,3sigmatropic rearrangement of the tetrahedral transition state probably occurs, which led to formation of a sulfenic acid intermediate with a concomitant release of 1 mol of Met/mol of enzyme (step IB). Steps IA and IB are favored by acid-assisted catalysis. In step II, nucleophilic attack of Cys-Y on the sulfur atom of the sulfenic acid leads to formation of a Cys-X/Cys-Y disulfide bond and a release of a water molecule, which is also favored by acid-assisted catalysis. In step III, return of the active site to a fully reduced state proceeds via reduction of the Msr disulfide bond by reduced Trx.

FIG. 1 .

 1 FIG.1. Fluorescence spectra of N. meningitidis MsrA under reduced and disulfide oxidized state. Excitation spectra of reduced (ࡗ) and oxidized (छ) MsrA (emission followed at 340 nm), emission spectra of reduced (q) and oxidized (E) MsrA (excitation at 284 nm), reduced (f) and oxidized (Ⅺ) MsrA (excitation at 295 nm), and reduced (OE) and oxidized (') MsrA (excitation at 310 nm) were recorded with 10 M protein at 25 °C in buffer A.

  Cys-51/Cys-198 MsrA Bond by Trx-As already mentioned, the rate of reduction of the Cys-51/Cys-198 MsrA disulfide bond was determined on a stoppedflow apparatus by following selectively the quenching of the fluorescence emission intensity of Trx upon going from the reduced to an oxidized form, i.e. Cys-32/Cys-35 intradisulfide state or MsrA Cys-198/Trx Cys-32 interdisulfide form. Under the experimental conditions used, at pH 8, the concentration of the Cys-51/Cys-198 disulfide MsrA was 25 M, and the concentration of the reduced Trx was varied from 75 M to up 800 M.

FIG. 2 .

 2 FIG. 2. Fluorescence emission spectra of E. coli thioredoxin under reduced and disulfide oxidized state and comparison with those of N. meningitidis MsrA under reduced and disulfide oxidized state. In A, fluorescence spectra of 10 M reduced (f) and oxidized (Ⅺ) Trx and reduced (q) and oxidized (E) MsrA in buffer A were recorded at 25 °C on excitation at 295 nm. In B, fluorescence spectra of 10 M reduced (OE) and oxidized (') Trx and reduced (ࡗ) and oxidized (छ) MsrA in buffer A were recorded at 25 °C on excitation at 310 nm.

FIG. 4 .FIG. 5 .

 45 FIG. 6. Determination of the catalytic parameters of the MetSO reductase step of the N. meningitidis MsrA. The MsrA fluorescence increase associated with the Cys-51/Cys-198 disulfide bond formation was recorded on a stopped-flow apparatus at 25 °C in buffer A. MsrA final concentration was 10 M. Excitation wavelength was set at 284 nm, and emitted light was collected via a 320-nm cutoff filter. Data were then fitted to Equation 4 by least squares regression which gave k obs max and apparent affinity constant values of 1510 Ϯ 90 s Ϫ1 and 740 Ϯ 80 mM, respectively. Symbols (q) represent experimental points. FIG. 4. Rate of formation of the Cys-51/Cys-198 MsrA disulfide bond measured by fluorescence stopped-flow experiment under single turnover kinetics. The MsrA fluorescence increase associated with the disulfide bond formation was recorded on a stopped-flow apparatus at 25 °C in buffer A (A) or in 50 mM MES, pH 5.5 (B). In both experiments, MsrA and MetSO final concentrations were 10 M and 100 mM, respectively. Excitation wavelength was set at 284 nm, and emitted light was collected via a 320 nm cutoff filter. The upper frames show the recorded fluorescence trace, and the lower frames show the residual values of the best monoexponential fit. Rate constants were 144 Ϯ 1 and 11 Ϯ 1 s Ϫ1 in buffer A and in MES buffer, pH 5.5, respectively.

at CNRS on January 23, 2018 http://www.jbc.org/ Downloaded from

at CNRS on January 23, 2018 http://www.jbc.org/

Acknowledgments-We are very grateful to Drs. A. Van Dorsselear and S. Sanglier-Cianferani for mass determination and to Dr. F. Barras for the gift of BE002 E. coli strain. We also thank Dr. S. Azza and C. Gauthier for very efficient technical help and Dr. E. McRae for the careful reading of the manuscript.

* This research was supported by the Centre National de la Recherche Scientifique ("Programme Physique et Chimie du Vivant 2000," "Programme Prote ´omique et Ge ´nie des Prote ´ines 2001"), the University Henry Poincare ´Nancy I, the Association pour la Recherche sur le Cancer (Association pour la Recherche sur le Cancer Grant 5436), and the Institut Fe ´de ´ratif de Recherches 111 Bioinge ´nierie. The costs of publication of this article were defrayed in part by the payment of page charges. This article must therefore be hereby marked "advertisement" in accordance with 18 U.S.C. Section 1734

Mathias Antoine, Sandrine Boschi-Muller and Guy Branlant

Neisseria meningitidis of Methionine Sulfoxide


Natalia Miloslavskaya
email: ngmiloslavskaya@mephi.ru

Alexander Tolstoy
email: aitolstoj@mephi.ru

ISO/IEC Competence Requirements for Information Security Professionals

Keywords: Information Security, Competence, Information Security Professionals, ISO/IEC Standards

niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

INTRODUCTION

The ever-growing need for information security (IS) professionals in this fast-moving field is currently understood worldwide as never before. A professional in any field of activity (including the IS area) must have specific qualifying characteristics. The modern approach to determining them is based on the definition of a set of professional competencies demonstrating a professional's capacity to solve given problems and to perform specific work within his sphere of activity. We distinguish "competence" from "competency" [1]. Competence refers to the ability to apply knowledge and skills to achieve intended results and to do something well: the quality or state of being competent. It enables a person to function effectively in a job or situation and demonstrate the ability to apply knowledge and/or skills. In turn, competencies support definitions of job classifications/occupational group profiles, roles and responsibilities, position descriptions, duty statements, etc. A competency is traditionally defined as a combination of observable and measurable knowledge (K), skills (S), and abilities (A) (KSA all together) as well as individual attributes and work experience that contribute to enhanced employee performance and ultimately result in organizational success. Knowledge is the cognizance of facts, truths and principles gained from formal training and/or experience. A skill is a developed proficiency or dexterity in mental operations or physical processes that is often acquired through specialized training; using these skills results in successful performance. Ability is the power or aptitude to perform physical or mental activities that are often affiliated with a particular profession. The ability to apply knowledge and skills in a productive manner, which can be characterized by such attributes of behavior as aptitude, initiative, enthusiasm, willingness, communication skills, team participation, leadership and others, shows the professional's effectiveness.

The efforts to develop a common approach to vocational training's Common Body of Knowledge (CBK) and requirements to the IS professional competencies are underway worldwide for a long time. A CBK is "a collection of information and a framework that provides a basis for understanding terms and concepts in a particular knowledge area" [2] and it relates only to the first competency's component. The first attempts to create a common point of view on the subject in general were in the World International Conferences on IS Education (WISEs) in the late 1990's and early 2000's [START_REF]Proceedings of the IFIP WG 11.8 First World Conference on Information Security Education WISE1[END_REF][START_REF]Proceedings of the IFIP WG 11.8 Second World Conference on Information Security Education WISE2[END_REF][5]. About the same time, some CBKs for security professionals were initiated by the industry for certification purposes (like CISA, CISSP, GIAC, etc.).

At present, we can say that three key views -American, Australian and European (analyzed in [START_REF] Miloslavskaya | State-Level Views on Professional Competencies in the Field of IoT and Cloud Information Security[END_REF]) -have been formed:  "Information Technology Security Essential Body of Knowledge: A Competency and Functional Framework for IT Security Workforce Development" by the National Cyber Security Division of the U.S. Department of Homeland Security [START_REF]Model. A Best Practice Model and Framework[END_REF] and the more specialized National Initiative for Cybersecurity Education (NICE), led by the National Institute of Standards and Technology [START_REF] The | National Cybersecurity Workforce Framework[END_REF];  "Cyber Security Capability Framework & Mapping of IS Manual Roles" [START_REF]The Cyber Security Capability Framework & Mapping of ISM Roles[END_REF] by the Australian Government Information Management Office;  e-Competence Framework 3.0 (e-CF 3.0) by the European Commission [START_REF]The European e-Competence Framework 3.0. A common European Framework for ICT Professionals in all industry sectors[END_REF]. e-CF 3.0 will include four new ISO/IEC standards, as yet uncompleted: 27021 "Information technology --Security techniques --Competence requirements for information security management systems professionals"; and three parts of 19896 "Information technology --Competence requirements for information security testers and evaluators": 1) "Introduction, concepts and general requirements"; 2) "Knowledge, skills and effectiveness requirements for ISO/IEC 19790 testers"; 3) "Knowledge, skills and effectiveness requirements for ISO/IEC 15408 evaluators".

The main goals of this paper are to analyze e-CF 3.0 as a potential source of additional IS professional requirements beyond those of the current ISO/IEC standards on IS professional competence. It is organized as follows. e-CF 3.0 is analyzed in detail in Section 2. In Section 3 and Section 4 we discuss possible contents of the ISO/IEC 27021 and ISO/IEC 19896-1 standards respectively. Key findings conclude the paper.

THE EUROPEAN e-COMPETENCE FRAMEWORK

e-CF 3.0 is a result of nine years' continuing effort and commitment by multistakeholders from the European ICT sector, with the encouragement of the European Commission and strongly backed by the CEN ICT Skills Workshop community. This 53-pages document defines competence as a demonstrated ability to apply knowledge, skills, and attitudes for achieving observable results.

Compared to the four IS functions (Manage, Design, Implement and Evaluate) from [START_REF]Model. A Best Practice Model and Framework[END_REF] and the seven Specialty areas (Securely Provision; Operate and Maintain; Protect and Defend; Investigate; Collect and Operate; Analyze; Oversight and Development) from [START_REF] The | National Cybersecurity Workforce Framework[END_REF], e-CF 3.0 is structured with four dimensions reflecting different levels of business and human resource planning requirements in addition to job/work proficiency guidelines. Dimension 1 covers five e-Competence areas derived from the ICT business processes, namely Plan (A) -Build (B) -Run (C) -Enable (D) -Manage (E). Dimension 2 reflects a set of reference e-Competences (40 in total) for each area. Dimension 3 describes proficiency levels for each e-Competence. Dimension 4 is a sample of knowledge (K) and skills (S) but not abilities (A) related to e-Competences in Dimension 2.

The main shortcoming of e-CF 3.0 is that it distinguishes e-Competences only for two types of IS professionals -ICT Security Manager and ICT Security Specialist.  K1-K7: the organization's IS management policy and its implications for engagement with customers, suppliers and subcontractors; the best practices and standards in IS management; the critical risks for IS management; the ICT internal audit approach; IS detection techniques, including mobile and digital; cyber attack techniques and counter measures for avoidance; computer forensics;  S1-S7: document the IS management policy, linking it to business strategy; analyze the company critical assets and identify weaknesses and vulnerability to intrusion or attack; establish a risk management plan to feed and produce preventative action plans; perform IS audits; apply monitoring and testing techniques; establish the recovery plan; implement the recovery plan in case of crisis. E.3 Risk Management -Implements the management of risk across information systems through the application of the defined risk management policy and procedure. Assesses risk to the organization's business, including web, cloud and mobile resources. Documents potential risk and containment plans. PL 3: Decides on appropriate actions required to adapt security and address risk exposure. Evaluates, manages and ensures validation of exceptions; audits ICT processes and environment. E.8 IS Management -Implements IS policy. Monitors and takes action against intrusion, fraud, IS breaches or leaks. Ensures that IS risks are analyzed and managed. Reviews IS incidents, makes recommendations for IS policy and strategy to ensure continuous improvement of IS provision. PL 4: Provides leadership for the integrity, confidentiality and availability of data stored on information systems and complies with all legal requirements. E.9 IS Governance -Defines, deploys and controls the management of information systems in line with business imperatives. Takes into account all internal and external parameters such as legislation and industry standard compliance to influence risk management and resource deployment to achieve balanced business benefit. PL 4: Provides leadership for IS governance strategy by communicating, propagating and controlling relevant processes across the entire ICT infrastructure. The IS competencies are mentioned throughout e-CF 3.0 and incorporated within the relevant dimensions in several places (e.g., K8-security and S4-contribute to the development of ICT strategy and policy, including ICT security and quality for A.1 Information System and Business Strategy Alignment; K6-ICT security standards for A.2 Service Level Management; K2-systems architecture requirements performance, maintainability, extendibility, scalability, availability, security and accessibility for A.5 Architecture Design; K14-security for B.1 Application Development; and K5best practices and standards in IS management for C.2 Change Support and C.3 Service Delivery, etc.).

The ISO/IEC 27000 family of standards is a globally accepted world leading for managing IS in organizations and will be broadened by the new ISO/IEC 27021 "…Competence requirements for information security management systems professionals". Its development started in fall 2013 and final publication is planned for October 2017. In March 2017, ISO/IEC 27021 is at the 40.20 "Draft international standard ballot initiated" stage) (see Fig. 1). Fig. 1. ISO/IEC 27021 preview at http://www.iso.org By providing a required Body of Knowledge (BoK) in the area of IS management (ISM) only, this standard combines with ISO/IEC 27001 [START_REF]Information technology --Security techniques -Information security management systems -Requirements[END_REF] to produce a logical continuation of the that standard. It is expected to specify the minimum competence requirements and to provide guidelines for setting the BoK for ISM system (ISMS) professionals required for leading or establishing, implementing, maintaining and continually improving ISMS according to the Plan-Do-Check-Act (PDCA) cycle. In the worst case, only elements of the BoK will be given in the standard.

Clause 7.2 of ISO/IEC 27001 supports ISMSs by ensuring that people are competent. For that purpose, the following activities should be performed: identify the competence requirements for those who have an impact on IS performance within an organization; acquire the necessary competence whenever current personnel fail to meet the organization's IS competence requirements; and evaluate the effectiveness of any actions taken to acquire the IS competence that the organization needs to have.

The audience of ISO/IEC 27021 includes, but is not limited, to the following categories: organizations seeking ISMS professionals, to define the competence required for positions in ISMS related roles; educational institutions, to align their syllabi for training ISMS professionals; ISMS professional certification bodies, to use the BoK for examination sources; all ISMS related roles (such as managers, auditors, advisers and others), to prove their competence as ISMS professionals; and students, to understand and attain the competence required for working in the area.

As can be seen in the ISO/IEC 27021 preview, an ISMS professional refers to a person who establishes, implements, maintains and continuously improves one or more ISMS processes. And competence is the ability to apply knowledge and skills to achieve intended results [START_REF]Conformity assessment --General requirements for bodies operating certification of persons[END_REF].

ISO/IEC 27001 leads to dividing the KSA competencies of ISMS professionals (see Fig. 2) into two groups:

1) General or domain-independent, including managerial; and 2) Professional or domain-specific for IS and ISMS Planning -Operation -Support -Performance evaluation -Improvement (particularly for the IS and ISMS areas like Risk Management, Incident Management, Auditing, Security Controls, Business Continuity, Forensics, Access Control, Data Protection, Intrusion Prevention, Vulnerabilities Assessment, Physical and Environmental Security, Cryptography, etc.).

Fig. 2. ISMS competencies areas

Some examples of general competence are: Organisation organisation design, culture and business, Project Management, Leadership, Governance, Strategies and Policies, IT and Information Systems, Human Resources, Communication, Problem management, Analytical Methods, Efficiency and Effectiveness Measurement, Finance and Budgeting, Compliance, and Supplier Management.

The IS domain-specific competences include but are not limited to knowledge and skills required in the following areas:

Compared to ISO/IEC 27021, the first two parts of ISO/IEC 19896 are at the 30.60 "Close of voting/comment period" stage in March 2017, while the third is at the 10.99 stage (new project approved). Their audience includes IS and IS product evaluation and conformance testing specialists (testers and evaluators), validators, certifiers and approval authorities, testing laboratories, vendors and technical providers as well as organizations offering professional credentialing.

We expect that ISO/IEC 19896-1 will provide an overview of the definitions, the fundamental concepts, and a general description of the framework used to communicate the competence requirements for IT product security evaluations and conformance testing as well as the minimum competence requirements for IT product security evaluators and testers to conduct its testing/evaluation using standards established by the ISO committee CASCO.

Without any doubt, all parts of the ISO/IEC 19896 series will be based on ISO/IEC 17025:2005 "General requirements for the competence of testing and calibration laboratories" [START_REF]General requirements for the competence of testing and calibration laboratories[END_REF], which was also prepared by CASCO. ISO/IEC 17025 is frequently specified as a basis for conformity testing amongst security assurance conformancetesting and evaluation laboratories. It addresses the general requirements for the competence of testing and calibration laboratories (a broad range of laboratories, and not only in the field of IT product security assurance testing and evaluation).

Clause 5 of ISO/IEC 17025 requires two important controls: 1) laboratory management, to ensure the competence of all who operate specific equipment, perform tests and/or calibrations, evaluate results and sign test reports and calibration certificates; and 2) personnel performing specific tasks to be qualified on the basis of appropriate education, training, experience and/or demonstrated essential skills. Thus, in order to support conformity in evaluating or conformance-testing IT security products, one of the key factors is the competence of the individuals performing this work.

As for any other professional activity, a minimum competence is needed to support achieving conformity and repeatability of the results. The main elements of competence are the minimum necessary knowledge, skills, experience and qualifications relevant to the target IT product security assurance standard. The CBK is formed from a knowledge of IT product architecture and design in relevant technology areas, all relevant standards, policies and procedures, any associated testing or evaluation methods, typical vulnerabilities, which may occur in that product or technology, etc.

Skills are the ability to understand the evaluation and testing scope (including its boundaries), to analyze various documentation, to understand the source code used in specifying and implementing products, to develop and perform functional and special IS testing, to use specialized testing tools, to interpret testing results and to write reports detailing these results, etc. Additional skills to communicate effectively and to perform project management are needed at the higher competence's levels.

An experienced individual should have a deep understanding of the accreditation body's requirements and policies, have already performed evaluations or testing, and perhaps have taught or mentored others.

The specification of particular educational qualifications can help determine an individual's ability to follow a formal program or work independently. In some cases, it may be acceptable to substitute appropriate and relevant experience for education or qualifications.

These main elements of competence can be extended by additional elements such as leadership, teamwork, initiative, aptitude, willingness, etc.

All competence elements must assume their measurability. Knowledge tests may include an examination of professional qualifications gained through third parties or through testing by approval authorities or the laboratory itself. Methods for skills measurement should demonstrate the mastery of all necessary skills. They can be based on a specific laboratory's proficiency testing programme or on the use of previous training records. Experience is measured not by the number of years of experience, but by the number of projects in which a person participated before (considering project complexity, technologies and test methods used). An individual's education can be measured by referring to the educational certification issued by accredited and recognized authorities/university and checked by the laboratory.

It will be reasonable to include in ISO/IEC 19896-1 a few competence levels, to distinguish different levels of professional capability and define professional roles within the organizations with respect to competence. For example, the first one is usually a technician, supporting another's activities and performing testing or evaluation under supervision. An evaluator/tester is competent to work unsupervised in many areas, but may require supervision in a few testing and evaluation areas. A senior evaluator/tester is competent to work unsupervised in most areas and is able to supervise the work of two previous persons. A lead evaluator/tester is competent to work unsupervised in all areas of testing or evaluation according to the defined standards and methods, to provide project management, to supervise the work of three other persons and to communicate with stakeholders.

We estimate this standard will be ready for publication not earlier than 2018.

CONCLUSION

Our dynamic life has put us in the forefront of the need to develop the specialized professional competencies for the very popular field of IS in the short term. While waiting for them, it is very hard to predict the new ISO/IEC 27021 and ISO/IEC 19896-1 international standards' content, even after scrupulously analyzing the ISO/IEC 27000 standard family and ISO/IEC 17025 as their main statements. Our review of the key ideas underlying the European approach to IS professionals' competencies development revealed that e-CF 3.0 as the first all-Europe attempt to begin formulating e-Competencies was not very successful with respect to the IS area because of its very narrow consideration, but it began a very proper and necessary process. Since the description of e-Competencies for IS professionals is not the primary goal of e-CF 3.0, it can be used only as the most basic initial guidance, and requires substantial additions and clarifications. For example, general, business and managerial knowledge and skills, competence in IS area and legal issues, IS operation, auditing and risk management from e-CF 3.0 are completely applicable to ISO/IEC 27021 and ISO/IEC 19896-1. Hence, all European academia, industry and governments hope to see soon mature enough and usable standards.

  e-Competences for the ICT Security Manager and Specialist are shown in Tables2 and 3respectively. As can be seen, they have only one common e-Competence (E.8 IS Management), but with different proficiency levels (PLs). E.8 e-CF 3.0 contains seven K and seven S examples (only examples are given, not the full lists):

PL 5 :

 5 Provides strategic leadership to embed IS into the culture of the organization.

Table 1

 1 allows us to compare them very easily.

Table 1 .

 1 General description for ICT Security Manager and ICT Security Specialist (e-CF 3.0)

	ICT Security Manager	ICT Security Specialist
	Manages the ICT security policy (ICTSP).	Ensures the ICTSP's implementation.
	Mission: Defines the ICTSP. Manages security	…Proposes and implements necessary IS
	deployment across all Information Systems.	updates. Advises, supports, informs and
	Ensures the provision of information availability.	provides IS training and awareness. Takes
	Recognized as the ICTSP expert by internal and	direct action on all/part-of a net-
	external stakeholders.	work/system. Recognized as the ICT tech-
		nical IS expert by peers.
	Deliverables: accountable: ICTSP; responsible:	…accountable: Knowledge or Information
	Knowledge or Information base, IS strategy;	base (Security); responsible: New technol-
	contributor: Risk Management policy, New	ogy integration proposal (Security); con-
	technology integration proposal, ICT Strategy &	tributor: Risk Management policy & plan;
	Implementation.	ICTSP.
	Main tasks: defines and implements procedures	…ensures security and appropriate uses of
	linked to ICT security; contributes to the devel-	ICT resources; evaluates risks, threats and
	opment of the organization's IS policy; estab-	consequences; provides security training/
	lishes the prevention plan; informs and raises	education; provides technical validation of
	awareness among general management; ensures	security tools; contributes to definition of
	the promotion of the IS charter among users;	security standards; audits vulnerabilities;
	inspects and ensures that IS principles and rules	monitors security developments to ensure
	are applied.	ICT resource data and physical security.
	Key performance indicators: ICTSP effective-	…Security measures in place.
	ness.

Table 2 .

 2

	e-Competences for ICT Security Manager (e-CF 3.0)
	A.7 Technology Trend Monitoring -Investigates latest	PL 4: Exploits wide ranging
	ICT technological developments to establish understanding	knowledge of new and emerging
	of evolving technologies. Devises innovative solutions for	technologies, coupled with a
	integration of new technology into existing products, ap-	deep understanding of the busi-
	plications or services or for the creation of new solutions.	ness, to envision and articulate
		solutions for the future. Provides
		expert guidance and advice, to
		the leadership team to support
		strategic decision-making.
	D.1 IS Strategy Development -Defines and makes appli-
	cable a formal organizational strategy, scope and culture to
	maintain IS from external and internal threats, i.e. digital
	forensic for corporate investigations or intrusion investiga-
	tion. Provides the foundation for IS Management, includ-
	ing role identification and accountability. Uses defined
	standards to create objectives for information integrity,
	availability, and data privacy.

Table 3 .

 3 e-Competences for ICT Security Specialist (e-CF 3.0) C.2 Change Support -Implements and guides the evolution of an ICT solution. Ensures efficient control and scheduling of software or hardware modifications to prevent multiple upgrades creating unpredictable outcomes. Minimizes service disruption as a consequence of changes and adheres to defined service level agreement (SLA). Ensures consideration and compliance with IS procedures. Service Delivery -Ensures service delivery in accordance with established SLA's. Takes proactive action to ensure stable and secure applications and ICT infrastructure to avoid potential service disruptions, attending to capacity planning and to IS. Updates operational document library and logs all service incidents. Maintains monitoring and management tools (i.e. scripts, procedures). Maintains IS services. Takes proactive measures.

	PL 3: Ensures the integrity of the
	system by controlling the appli-
	cation of functional updates,
	software or hardware additions
	and	maintenance	activities.
	Complies with budget require-
	ments.

ACKNOWLEDGEMENT

This work was supported by Competitiveness Growth Program of the Federal Autonomous Educational Institution of Higher Education National Research Nuclear University MEPhI (Moscow Engineering Physics Institute).


Konstantin G Kogos
email: kgkogos@mephi.ru

Sergey V Zapechnikov
email: svzapechnikov@mephi.ru

Studying Formal Security Proofs for Cryptographic Protocols

Keywords: Information Security Science, Syllabus, Information Security Training, Cryptography, Provable Security

This paper discusses the problem of teaching provable security in cryptography when studying information security. The concept of provable security is one of the most important in modern cryptography, soit is necessary to integrate it into the syllabus on cryptographic protocols. Now provable security is not rare thing in basic cryptography courses. However, security proofs for cryptographic protocols are far more complicated than for primitives. We suggest the way of embedding Sequence of Games technique, Universally Composability framework, module design of protocols and other techniques into the cryptography protocols course. Our experience of teaching formal security proofs for cryptographic protocols brings quite positive effect for students' research and development.

Introduction

The study of any science should base on a solid theoretical foundation. In modern cryptography, such foundation is provable security methodology. Comparing to classical cryptography, it replaces the empirical approach of proving security with a strict formal proofs. Nowadays, the concept of provable security becomes prevalent in cryptography. University courses should present modern science and technology quite adequately. So, a lot of attention should be paid to provable security in contemporary university courses. We see that the concept of provable security was included in many cryptography classes all over the world, but there are still some gaps. At first, current courses use ideas of provable security just for cryptographic primitives, but the provable techniques for cryptographic protocols not covered in the courses. At second, security proofs for modern cryptosystems become more and more complicated. So, it becomes quite difficult to introduce such advanced techniques into the syllabus. At third, a suite of representative examples should be chosen for teaching purposes, and it is not evident how to make these examplesquite didactic, and reachable for classwork and self-studying.

The purpose of our work is to suggest a concept of integration provable security into modern university courses on cryptographic protocols for students specializing in the area of information security. Why is it so important? Because there is a growing demand for specialists capable not only to correctly apply the already existing methods, but also to solve new cryptographic problems "on the fly".

The paper is organized according to the tasks we have solved to achieve the goal. Section 2 briefly presents some related works. After discussing main approaches to proving security in modern cryptography in section 3, we observe and analyze existing practices for studying provable security in the current cryptography courses in section 4. In section 5 we discuss in detail how to integrate provable security into the syllabus on cryptographic protocols and preceding courses, taking into account that provable techniques for protocols are different from techniques for primitives. In section 6 we suggest how to optimally embed so-called Sequence of Games approach for proving security of cryptographic protocols. Section 7 is devoted to problems of embedding so-called Universal Composability (UC) approach and some more advanced related techniques. In section 8 we outline our experience of teaching formal security proofs for cryptographic protocols and conclude that it brings some positive effects. Finally, we identify main results and future directions of the work.

2

Related works

Of course, there is a number of research focusing on optimizing syllabus on modern cryptography. Some wide-known massive open online courses (MOOCs) and university courses include provable security foundations. In our mind, the best examples are Cryptography course on Coursera [START_REF] Boneh | Cryptography I[END_REF], MIT course [START_REF]Cryptography and Cryptanalysis[END_REF], Stanford course [START_REF] Maurer | Cryptography Foundations[END_REF], UC Davies course [START_REF] Rogaway | Cryptography course[END_REF] and some others. However, we are essentially interested not in the courses themselves, but in teaching methods.

We have carefully analysed a lot of textbooks and scientific papers used in teaching practice. In our opinion, the best textbooks based on provable security approach are [5 -7]. Also, we used some well-written papers on advanced proving techniques, such as UC framework by Canetti [START_REF] Canetti | Universally Composable Security: A New Paradigm for Cryptographic Protocols[END_REF], guides on Sequence of Games techniques by Shoup [START_REF] Shoup | Sequences of games: a tool for taming complexity in security proofs[END_REF] and Pointcheval [START_REF] Pointcheval | Contemporary cryptology provable security for public key schemes[END_REF], reactive security concept [START_REF] Backers | The reactive simulatability (RSIM) framework for asynchronous systems[END_REF], an idea of modular design of UC-composable protocols by Camenisch et al. [START_REF] Camenisch | UC commitments for modular protocol design and applications to revocation and attribute tokens[END_REF]. It is worth noting that most of these papers require essential adaptation to be used effectively in teaching.

Provable security in cryptography

We have investigated many approaches to proving security of cryptographic algorithms and protocols in modern cryptography. Here we are going to outline briefly our view on a landscape of proof techniques (Fig. 1). There are three fundamentally different approaches to reasoning and proving security of cryptographic constructions: information-theoretic security, computational security, and symbolic security.

Fig. 1. A landscape of modern provable security methods

Information-theoretic approach is the oldest one. Shannon introduced it in the middle of 1940s [START_REF] Shannon | Communication Theory of Secrecy Systems[END_REF]. It is well known, that the main idea of this approach is to provide a method of constructing cryptosystems secure against the computationally unlimited adversary. However, it is also well known, that the main drawback of such perfectly secure cryptosystems is its impracticality. For example, implementation of perfectly secure symmetric cipher must have key length no less than the plaintext length. But in some other applications perfectly secure cryptosystems are far more practical. Good examples are Shamir's secret sharing scheme [START_REF] Shamir | How to share a secret[END_REF] and Pedersen's verifiable secret sharing and commitment schemes [START_REF] Pedersen | Non-interactive and information-theoretic secure verifiable secret sharing[END_REF], which play an important role in modern cryptographic constructions.

Computational security is the leading approach in modern cryptography. Goldwasser and Micali introduce it in the middle of 1980s [START_REF] Goldwasser | Probabilistic Encryption[END_REF], and Goldwasser, Micali and Rackoff extended it to cryptographic protocols soon [START_REF] Goldwasser | The Knowledge Complexity of Interactive Proof-Systems[END_REF].

At first, such proof requires a definition of secure cryptographic construction (primitive, protocol, scheme). Secondly, some suggestion about the computationally infeasible problem has to be made. Next, a construction solving the task is offered and a mathematical proof that the construction satisfies the definition must be outlined assuming existence of the infeasible problem. As a rule, the proof makes sure that only chance to violate the security of such a construction is to solve the abovementioned infeasible task.

We believe it is convenient to allocate some "layers" in modern computationally secure proving techniques.

The lowest layer complies of two basic definitional concepts of security measuring concrete approach and asymptotical approach. The first one was developed by Goldwasser [START_REF] Goldwasser | Lecture notes on cryptography[END_REF], the last oneby Goldreich [START_REF] Goldreich | Foundations of modern cryptography[END_REF].

The second level is composed of some proving models using certain definitional approach. They bring a "mechanics" of proving assuming some agreements. Well-known examples are standard model (game-based), random oracle model, ideal cipher model, generic group model (we do not discuss here the specificity of each model).

The next level is Sequence of Games technique. When a proof becomes too complicated, it should be presenred as a series of steps replacing security against ideal adversary to security against real one. Each step could be performed based on indistinguishability argument or event's probability evaluation. If both arguments are combined, this is so called hybrid argument. Sequence of Games technique with hybrid argument is one of the main tools for proving security of cryptosystems.

All three levels are necessary for proving security of cryptographic primitives and relatively simple cryptosystems. However, such levels are not sufficient for complicated cryptosystems composed of many building blocks such as zero-knowledge proofs, commitments and so on. Some kind of simulating cryptosystem's behavior model is desirable for such systems. That is why the forth level of computational security proofs goes on stage. The most known examples are Canetti's UC model [START_REF] Canetti | Universally Composable Security: A New Paradigm for Cryptographic Protocols[END_REF] using ideal functionalities and reactive systems model [START_REF] Backers | The reactive simulatability (RSIM) framework for asynchronous systems[END_REF] simulating dynamically interactive communities. However, when using all these techniques, the monolithic proofs obtained for complicated cryptographic constructions, are very difficult for synthesis and verification. Recently, some techniques to manage this complexity have been offered, for example, UC commitments for modular protocol design [START_REF] Camenisch | UC commitments for modular protocol design and applications to revocation and attribute tokens[END_REF].

Currently, symbolic security approach has a limited scope in cryptography, but it is quite efficient for some protocols, such as key establishment. The first such technique so-called BAN-logic was invented in 1990 [START_REF] Burrows | A logic of authentication[END_REF]. Some other techniques were introduced in subsequent years, i.e. GNY-logic [START_REF] Gong | Reasoning about belief in cryptographic protocols[END_REF]. Tamarin is one of the currently evolving tools [START_REF] Meier | The TAMARIN prover for the symbolic analysis of security protocols[END_REF]. The main advantage of symbolic techniques is their easy automation. The drawback is that only special types of protocols can be analysed this way.

Provable security in current cryptography courses

As we noted earlier, provable security is an important part of many MOOC and university cryptography courses. Most of them include only historical Shannon's approach and basic computational security techniques. Of course, Shannon's perfect security idea is inavoidable element of cryptography syllabus. It should be emphasized to students, that Shannon was the first to find strong mathematical evidence of information security. His approach became the reference for all subseguent ones. Computational security is the most usable approach, so it should be represented fully enough in the course. Existing practices mostly include definitional concepts and standard (game-based) model, in other words, first and second level of our landscape (Fig, 1). These are the most fundamental techniques, which ware used for analyzing security of basic symmetric and asymmetric cryptoschemes.

Of course, it is difficult to have enough time to combine both concrete and asymptotical approaches in one course, so just one definitional approach is used in every course. Examples of courses based on concrete security are [START_REF] Rogaway | Cryptography course[END_REF][START_REF] Goldwasser | Lecture notes on cryptography[END_REF], and courses based on asymptotical security are [START_REF] Katz | Introduction to modern cryptography[END_REF][START_REF] Boneh | A graduate course on applied cryptography[END_REF]. According to our research, asymptotical-based courses are far more common. More than 60 universities use it according to [START_REF]Introduction to Modern Cryptography book's site[END_REF].

The second element of typical cryptography course is standard game-based model of proving security. The main idea of game-based security model is simulation of interaction among the adversary and responder (prototype of real-world party). It allows to prove that any supposed adversary can get an advantage over the responder if and only if she is able to solve some computationally infeasible problem (i.e., discrete logarithm, Diffie -Hellman, integer factorization etc.).

Symbolic security is rarely used in modern cryptography courses. Thus, the main conclusion from the analysis of currently taught courses is the following. Currently, just basic methods of provable security are represented in cryptography courses. Evidently, the knowledge of them may be incomplete for construction and analyzing modern crypto algorithms and protocols. So, it is necessary to integrate advanced provable security techniques and tools into the syllabus not only on foundations of cryptography but also on cryptographic protocols.

Integrating provable security into the syllabus on cryptographic protocols

One of the main factors to expand provable security techniques in research and in training courses is a complication of cryptosystems' structure. Our view on the architecture of modern cryptosystems is shown on Fig. 2. There are several levels in every complicated cryptosystem:

 basic mathematical facts;  cryptographic primitives, including engineering (confucion/diffusion) and algebraic/combinatorial;  cryptographic algorithms (fucntions), including one-key (symmetric), two-key (asymmetric) and no-key algorithms;  building blocks of cryptographic protocols, such as zero-knowledge proofs, key management infrastructure etc.;  cryptographic protocols, including two-party and multi-party protocols;  cryptographic schemes (security mechanisms);  cryptographic systems (security services);  security systems, including cryptographic and non-cryptographic security services.

We do not comment this scheme in details, so it is confirmed by wide analysis of numerous modern cryptosystems. We use this scheme as a framework for "Cryptographic protocols" course.

It is easy to notice that architecture on Fig. 2 is quite well correlated with the landscape on Fig. 1. Thus, the above-mentioned levels of proving techniques can be projected on the levels of cryptosystems' architecture. We identify on Fig. 1 a subset of proving techniques that is now included in typical cryptography course (dark grey blocks) and that we recommend including in the syllabus additionally (light grey blocks). Briefly, we recommend to add in syllabus the following:  Sequence of Games technique, more precisely, hybrid argument method;  Universal Composability framework and its extensions.

We will analyze special aspects of integrating of these techniques in next sections.

Fig. 2. Architecture of modern cryptosystems

Embedding Sequence of Games technique

Sequence of Games is a popular tool for structuring security proofs for cryptographic protocols and schemes. The purpose of this technique is to tame the complexity of security proofs that otherwise is so difficult as to repeat and verify is nearly impossi-ble [START_REF] Shoup | Sequences of games: a tool for taming complexity in security proofs[END_REF]. It is not a silver bullet, of course. As Shoup righteously notes, it is only a tool for organizing actual ideas for cryptographic constructions and security analysis. The essence of this approach is as follows. To prove security one constructs a sequence of N games among the adversary and cryptographic primitive or protocol. The first game in the sequence is the original adversary's attack on the construction. Changes between successive games are minor, so probabilities of events connected to adversary's success or failure, differ very slightly. So, the last game in the sequence is ideal and a target probability of an event is typically either 0 or1/2 (i.e. probability that an adversary can guess, which of two plaintexts corresponds to given ciphertext). This is quite powerful method. However, we stress that it was developed in scientific environment for research purposes, so it has to be adapted for teaching purposes. So, we note that for pedagogical purposes two aspects are necessary: inevitable simplifying of the technique and carefully selected examples.

To simplify the explanation of Sequence of Games technique for students we recommend limiting the types of possible transitions among games to transitions based on indistinguishability of 2-3 computationally infeasible problems (preferably, the discrete logarithm nad the Diffie -Hellman problems, integer factorization and the RSA problems, and, may be, the Bilinear Diffie -Hellman problem for advanced students), and also transitions based on failure events that students should be able to evaluate (i.e., probability to find collisions of hash functions).

As regards the examples, we select the following:

 some variants of Luby -Rackoff construction for building a pseudo-random permutation family and one of authenticated encryption modes for "Symmetric cryptography" course;  El Gamal public key encryption scheme without message hashing and with it and also FDH-RSA scheme for "Asymmetric cryptography" course;  chosen ciphertext secure symmetric encryption (prototype of TLS protocol), one of the provably secure group key establishment protocols (we used protocols from TDH1 family [START_REF] Manulis | Provably secure group key exchange[END_REF]) and oblivious transfer (we used protocols from [START_REF] Dubovitskaya | Cryptographic protocols for privacy-preserving access control in databases[END_REF]) for "Cryptographic protocols" course.

The above-mentioned examples of proofs for cryptographic protocols are quite tricky, so the tutor should explain them as clearly as possible. But we insist that so non-trivial examples should be presented in university courses because of their importance and representativeness.

Embedding Universal Composability framework

Universal Composability is one of the most powerful techniques of provable security in cryptography invented by Canetti in 1990s [START_REF] Canetti | Universally Composable Security: A New Paradigm for Cryptographic Protocols[END_REF].

The essence of the approach is in its ability to simulate cryptographic protocol properties when many sessions of analyzed protocols along with other protocols are executed in parallel. The UC framework allows specifying the security requirements of most of cryptographic tasks in a unified manner. The advantage of this technique is the possibility of designing complex protocols from relatively simple building blocks. The security of separate protocols is preserved under a composition. The kernel of protocol analysis under UC approach lies in the specification of protocol's ideal functionality and comparison it with execution in the real-world environment to prove that difference among real and ideal executions is negligible. This approach is widely used in research. It is not always used strictly in Canetti's form [START_REF] Canetti | A simpler variant of universally composable security for standard multiparty computation[END_REF], but many of its elements can be composed with other techniques, such as above-mentioned Sequence of Games and other modular desing techniques.

The UC approach also requires adaptation for teaching purposes. We think, it is sufficient to inform students about main ideas of UC approach, without unnecessary details. The main things are Canetti's Composition theorem (proof is unnecessary) and technique for constructing ideal functionality based on virtual trusted third party.

We recommend the following well-documented examples for using during the studying the UC approach in classwork and homework: universally composable symmetric encryption [START_REF] Kuesters | Universally composable symmetric encryption[END_REF], universally composable undeniable signatures [START_REF] Kurosawa | Universally composable undeniable signature[END_REF], universally composable key management [START_REF] Kremer | Universally composable key-management[END_REF], universally composable role-based access control [START_REF] Liu | Universally composable cryptographic role-based access control[END_REF]. How to work with such examples? We recommend to analyze one of them in details in class and set analyzing slightly modified variant of one of the other schemes as a homework. It will require to make changes in the proof in many places of ideal functionality model, real protocol, game between the adversary and party of protocol and so on. Thus, students will learn how to construct proofs by themselves.

Experience of teaching formal security proofs for cryptographic protocols

Our ideas were embedded into the "Cryptographic protocols" course for graduate students in MEPhI. To measure an effect of changing the syllabus we have tested our students (60 people) studied on old and new syllabuses. In particular, the students had to solve some tasks when they passed all three courses:

 to prove the security of some simple RSA modifications;  to prove the security of some variants of Luby-Rackoff construction;  to prove the security of universally composable symmetric encryption scheme [START_REF] Kuesters | Universally composable symmetric encryption[END_REF].

The result of students studying courses before their changing is as follows. 80 percent of students dealt with the first task, 20 percent of students got through the second task and nobody was successful with the third task. Such a result was not surprising, so the first task is easily solvable by most students with basic mathematical background, the second task is quite complicated for students not familiar with advanced provable security techniques, the third task is actually unsolvable by students without high-level qualifications in provable security.

Students studying courses after our changings showed significant improvement. 80 percent of students were still successful with the first task, but 60 percent of students got through the second task and about 25 percent of students were successful with the third task. It was predictable that the number of students dealt with the first task would not change (it is not a difficult task). But the rate of students that were successful with the second and the third tasks has essentially increased.

Conclusion

Summarizing the results of our work, we conclude with the following. 1. A new pedagogical idea was formed. Its essence is to integrate modern provable security techniques into the "Cryptographic protocols" course and improve basic cryptography cources to harmonize them with the provable security based cryptographic protocols course.

2. Views on a suite of current provable security techniques and architecture of modern cryptosystems are offered. Proposals on embedding some proving techniques in the curriculum on cryptographic protocols were formulated.

3. New techniques of teaching cryptographic protocols based on constructing and proving security of prototypes or slightly modified real-life protocols were offered. A set of examples and use cases on proving techniques was selected.

Most of our findings are original, and they were tested on the graduate students specializing in the area of information security. Our experience indicates that integrating our approach has some positive effect, including improving students' competences and more active participation in research and innovations. We plan to improve our crypto syllabuses to monitor the leading crypto tracks.

Acknowledgement. This work was supported by Competitiveness Growth Program of the Federal Autonomous Educational Institution of Higher Professional Education National Research Nuclear University MEPhI (Moscow Engineering Physics Institute).