10 lines of encryption, 1500 lines of key management

10 lines of encryption, 1500 lines of key management @vixentael

@vixentael product engineer in security and cryptography OSS maintainer: Themis,
Acra cryptographic tools, security engineering, datasec training

@vixentael zero knowledge searchable encryption cossacklabs.com/acra/ e2ee data collaboration cossacklabs.com/hermes/
zero knowledge authentication github.com/cossacklabs/themis/wiki/Secure-Comparator-cryptosystem cossacklabs.com/whitepapers/

Bespoke data security solutions and security engineering.

@vixentael Data encryption without compromising UX

1. Encryption: from GDPR to DoD @vixentael 2. Building security:
decision making in security, boring crypto, defense in depth 3. E2EE note sharing 4. Cat

GDPR @vixentael Article 32/35: responsibly store and process data according
to risks    Article 33/34: detecting data leakage and alert users & controller https://gdpr-info.eu/

@vixentael https://gdpr-info.eu/ Article 32

@vixentael US Department of Defense

@vixentael US Department of Defense https://media.defense.gov/2018/Apr/22/2001906836/-1/-1/0/ DEFENSEINNOVATIONBOARD_TEN_COMMANDMENTS_OF_SOFT WARE_2018.04.20.PDF

@vixentael Apple privacy policy update https://developer.apple.com/news/?id=06032019j

@vixentael Google https://support.google.com/cloud/answer/9110914

@vixentael Decision making in security 101

@vixentael Decision making in security 101 1. “just because we
can” 3. understanding risks & threats 2. every app should have security features

@vixentael Decision making in security 101 1. “just because we
can” 3. understanding risks & threats 2. every app should have security features ✅

@vixentael app ﬂow app features code user problem

risk & threat model security methods security controls libraries/ code
app ﬂow app features code user problem @vixentael

@vixentael risk model & threat model create demands for security

@vixentael Data & risks PII User data Service data likes,
preferences purchase history logs keys, accesses, API tokens backups conﬁgurations locations

@vixentael Data & risks compliance risks legal risks reputational risks
continuity risks User data Service data reputational risks medium.com/@cossacklabs/trick-or-threat-security-losses-for- business-f5b44243d89c

@vixentael Boring crypto

https://pdos.csail.mit.edu/papers/cryptobugs:apsys14.pdf 269 CVEs from 2011-2014 17% 83% bugs inside crypto
libs misuses of crypto libs by individual apps @vixentael

— crypto that simply works, solidly resists attacks, never needs
any upgrades https://cr.yp.to/talks/2015.10.05/slides-djb-20151005-a4.pdf Daniel J. Bernstein Boring crypto @vixentael

encryption integration abstraction level complexity @vixentael

encryption integration abstraction level complexity cipher crypto- library cryptosystem
boxed solution @vixentael pain

@vixentael @vixentael easy to make mistakes

@vixentael should be random should use KDF(key) uses AES CBC,
not AES GCM padding? salt? @vixentael easy to make mistakes

Themis: hard to make mistakes @vixentael @vixentael github.com/cossacklabs/themis

@vixentael hides cryptographic details: salt, IV, KDF, padding built-in KDF,
safe to use passphrase uses AES-256-GCM @vixentael github.com/cossacklabs/themis Themis: hard to make mistakes

encryption integration abstraction level complexity cipher crypto- library cryptosystem
boxed solution @vixentael pain

https://github.com/vixentael/my-talks#dont-waste-time-on-learning-cryptography-better-use-it-properly see full talk about Boring crypto @vixentael

@vixentael Defense in depth

Defense in depth – independent, yet interconnected, set of security
controls aimed at mitigating multiple risks during the whole application ﬂow @vixentael

@vixentael 1. Encryption to protect data globally   (during the
whole data ﬂow / app lifecycle). 2. Whatever is the attack vector, there is a defense layer. 3. For most popular attack vectors, we want as many independent defenses as possible. Overlapped security controls

@vixentael Lines of defense

@vixentael

@vixentael 10 lines of encryption, 1500 lines of key management

@vixentael 10 lines of encryption, 1500 lines of key management
60 3000

@vixentael

@vixentael • smooth UX • not ﬁnance/banking app • syncing
between all user’s devices • privacy • incident response • next versions: Web/Electron Bear e2ee for notes

@vixentael 1. user notes encrypted using unique keys (per app
per user) 2. user password is never stored in plaintext 3. data in Keychain encrypted 4. notes & passwords are synced between devices Results

@vixentael UX is important, so we made the security scheme
more complex from an engineering perspective, but less stressful for users

@vixentael note encryption & note locking

@vixentael app locking

@vixentael note encryption != note locking != app locking

@vixentael note encryption != note locking != app locking encryption
authentication authentication

@vixentael note text user passphrase note encryption key data model
plaintext user input unique per note

@vixentael Access Disclosure Modification Access denial note text Moderate Critical
Critical High user passphrase Moderate Critical Critical Critical note encryption key Moderate Low Low Moderate threats

@vixentael Device filesystem Device process memory Device keychain & secure
enclave Transport, iCloud database iCloud Keychain Medium High High Medium Medium trust model

@vixentael Breaking Keychain youtube.com/watch?v=EUGDa0Z71uk youtube.com/watch?v=sR6KeCaCRMA github.com/LinusHenze/Keysteal macOS keychain: https://thetapedrive.com/face-id-fail-ios-13 iOS13
beta keychain:

@vixentael We have more trust towards the data stored on
the device than the data stored in a cloud

@vixentael key model

@vixentael from user mind or password mngr cached for some
time calculated before usage Keychain, Secure Enclave key model

@vixentael multiple caches to minimize user distractions user Keychain SecureEnclave
iCloudKeychain in memory cache temp var password manager

@vixentael App encryption key Key stretching: PBKDF2, deterministic long_data =
user_passphrase + generated_passphrase_password + generated_app_context app_encryption_key = SecureCellContextImprint(data: long_data, context: generated_app_context, key: user_passphrase)

@vixentael long_data = user_passphrase + generated_passphrase_password + generated_app_context app_encryption_key =
SecureCellContextImprint(data: long_data, context: generated_app_context, key: user_passphrase) long_data = app_encryption_key + generated_passphrase_password + generated_app_context note_encryption_key = SecureCellContextImprint(data: long_data, context: note_encryption_id, key: app_encryption_key) App encryption key, note encryption key Key stretching: PBKDF2, deterministic

@vixentael data encryption encrypted_note = SecureCellSeal(data: note_text, context: note_encryption_id, key:
note_encryption_key) decrypted_note = SecureCellSeal(data: encrypted_note, context: note_encryption_id, key: note_encryption_key) AES-256-GCM, random IV/nonce, non-deterministic

@vixentael 1. Encryption to protect data globally   (during the
whole data ﬂow / app lifecycle). 2. Whatever is the attack vector, there is a defense layer. 3. For most popular attack vectors, we want as many independent defenses as possible. Overlapped security controls ✅

@vixentael encrypted_passphrase = SecureCellSeal(data: user_passphrase, context: nil, key: generated_passphrase_key) decrypted_passphrase
= SecureCellSeal(data: user_passphrase, context: nil, key: generated_passphrase_key) passphrase encryption https://www.youtube.com/watch?v=EUGDa0Z71uk https://www.youtube.com/watch?v=sR6KeCaCRMA https://github.com/LinusHenze/Keysteal remember about breaking keychain AES-256-GCM, random IV/nonce, non-deterministic https://thetapedrive.com/face-id-fail-ios-13

@vixentael hint encryption

@vixentael hint encryption encrypted_hint = SecureCellSeal(data: hint, context: nil, key:
generated_hint_key) decrypted_hint = SecureCellSeal(data: encrypted_hint, context: nil, key: generated_hint_key) AES-256-GCM, random IV/nonce, non-deterministic

@vixentael Auto-locking timer clean up caches and decrypted data after
T seconds let unlockDate = Date() ... let unlockedInterval = unlockDate.timeIntervalSinceNow();

@vixentael Auto-locking timer clean up caches and decrypted data after
T seconds let unlockDate = Date() ... let unlockedInterval = unlockDate.timeIntervalSinceNow(); timezones

@vixentael Auto-locking timer monotonic https://twitter.com/wilshipley/status/1130973433120952321

@vixentael Failed attempts counter, increasing delays makes it harder to
brute force the passphrase user_passphrase t

@vixentael Failed attempts counter, increasing delays

@vixentael Compatibility & incident response

1. Encryption to protect data globally   (during the whole
data ﬂow / app lifecycle). 2. Whatever is the attack vector, there is a defense layer. 3. For most popular attack vectors, we want as many independent defenses as possible. Overlapped security controls ✅ ✅ ✅ @vixentael

Key points

1. Encryption: from GDPR to DoD @vixentael 2. Building security:
decision making in security, boring crypto, defense in depth 3. E2EE note sharing 4. Cat

@vixentael crypto gets harder if you need usability 1. E2EE
for notes, synced between devices – Bear 2. Searchable encryption – Acra 3. E2EE for data collaboration – Hermes

@vixentael coming soon

@vixentael OWASP ASVS / MASVS

It is secure. It’s not broken yet. @vixentael

failure of single security control is a question of time
failure of security system is a question of design

@vixentael cryptographic tools, security consulting, training github.com/vixentael/ my-talks

10 lines of encryption, 1500 lines of key management

10 lines of encryption, 1500 lines of key management

More Decks by CocoaHeads Ukraine

Other Decks in Programming

Featured

Transcript