With Symfony 4.4, your secrets will be well kept!

@gheb_dev @gregoirehebert

@gheb_dev @gregoirehebert Cypher Symetric key or public key

@gheb_dev @gregoirehebert Cypher

@gheb_dev @gregoirehebert p = a prime number  q = a
prime number  n = p × q Cypher

@gheb_dev @gregoirehebert ϕ(n) = (p − 1)(q − 1) Cypher

@gheb_dev @gregoirehebert 3 < Prime number < ϕ(n) Public key
Cypher

@gheb_dev @gregoirehebert (private key * public key) mod ϕ(n) =
1

@gheb_dev @gregoirehebert et         public key  
private key       p = 11 q = 13 n = p ⋅ q = 143 ϕ(n) = (p − 1) ⋅ (q − 1) = 120 e = 7 d = 103 (e ⋅ d)modϕ(n) = 1 (7 ⋅ 103)mod120 = 721mod120 = 1 Aa message M has a value of  9        c = memodn = 97mod143 = 48 m = cdmodn = 48103mod143 = 9 encode decode Example

@gheb_dev @gregoirehebert SHA1

@gheb_dev @gregoirehebert SHA1  secure hashing algorithm

@gheb_dev @gregoirehebert SHA1  secure hashing algorithm    2005 -> 2,7billion
€ in hardware

€ in hardware  2015 -> 120 000€ in hardware

€ in hardware  2015 -> 120 000€ in hardware  2017 -> SHA1 is not in a good shape  2019 -> SHA1 is K.O. (11k$)

@gheb_dev @gregoirehebert How ?

@gheb_dev @gregoirehebert How ? Any length -> 160 bits  512
bits en entry   then compressed

@gheb_dev @gregoirehebert How ? môman = 6 bytes = 48bits
môman = aca9c866584e891be0e5c736798273c00bb48a00

@gheb_dev @gregoirehebert How ? môman = 6 bytes = 48bits
môman = aca9c866584e891be0e5c736798273c00bb48a00    Birthday Paradox or Birthday-near-collision-attack

@gheb_dev @gregoirehebert môman = aca9c866584e891be0e5c736798273c00bb48a00  môman = 6 bytes =
48bits    Birthday Paradox or Birthday-near-collision-attack 23/365 -> 6% How ?

@gheb_dev @gregoirehebert 50% How ? môman = aca9c866584e891be0e5c736798273c00bb48a00  môman =
6 bytes = 48bits    Birthday Paradox or Birthday-near-collision-attack

@gheb_dev @gregoirehebert How ? 97% môman = aca9c866584e891be0e5c736798273c00bb48a00  môman =
6 bytes = 48bits    Birthday Paradox or Birthday-near-collision-attack

@gheb_dev @gregoirehebert 365 possibilities over 365 How ?

@gheb_dev @gregoirehebert 365/365 x 364/365 365 possibilities over 365 How
?

@gheb_dev @gregoirehebert 365/365 x 364/365 365/365 x 364/365 x 363/365
365/365 x 364/365 x 363/365 x 362/365 365 possibilities over 365 How ?

@gheb_dev @gregoirehebert 364! ÷ (365 − N)! × 365N−1 How
?

@gheb_dev @gregoirehebert 364! ÷ (342! × 36522) How ?

@gheb_dev @gregoirehebert 364! ÷ (342! × 36522) = 0,492703 How
?

@gheb_dev @gregoirehebert Real application ?

@gheb_dev @gregoirehebert 99024280cab824efca53a5d1341b9210 Real application ?

@gheb_dev @gregoirehebert 99024280cab824efca53a5d1341b9210 99024280cab824efca53a5d1341b9210 Real application ?

@gheb_dev @gregoirehebert SHA1 -> 160 bits -> collision 1280 Real
application ?

@gheb_dev @gregoirehebert SHA1 -> 160 bits -> Birhday-near-collision -> 260
Real application ?

@gheb_dev @gregoirehebert SHA2 -> 256 bits -> Birhday-near-collision -> 2128
Real application ?

@gheb_dev @gregoirehebert SP-NETWORK

@gheb_dev @gregoirehebert Substitution / Permutation A = E  E =
A

A MD4, MD5, SHA0 et SHA1

B

@gheb_dev @gregoirehebert Substitution / Permutation [0110][1001] A = E  E
= B

@gheb_dev @gregoirehebert Substitution / Permutation [0110][1001]  [sbox][sbox]  [1001][1101]    A
= E  E = B

@gheb_dev @gregoirehebert Substitution / Permutation [0110][1001]  [sbox][sbox]  [1001][1101]  [ pbox
]  [1101][1001] A = E  E = B

@gheb_dev @gregoirehebert Substitution / Permutation     key = f8ef4efa9842azgjyu248ger4h984a
[0110][1001]  [sbox][sbox]  [1001][1101]  [ pbox ]  [1101][1001] A = E  E = B

[0110][1001]  [sbox][sbox]  [1001][1101]  [ pbox ]  [1101][1001] A = E  E = B 10x  80x

[0110][1001]  [sbox][sbox]  [1001][1101]  [ pbox ]  [1101][1001] A = E  E = B 10x  14x AES

@gheb_dev @gregoirehebert AES - RIJNDAEL

@gheb_dev @gregoirehebert DES - DES3 Advanced Encryption Standard

@gheb_dev @gregoirehebert A.E.S.

@gheb_dev @gregoirehebert [b01,b05,b09,b13]  [b02,b06,b10,b14]  [b03,b07,b11,b15]  [b04,b08,b12,b16]

@gheb_dev @gregoirehebert Substition -> Galois field of   between 00000000
& 11111111 28

@gheb_dev @gregoirehebert A.E.S.

@gheb_dev @gregoirehebert n 12… Pick an extremely high value higher
than the maximum allowed.  Picture a hand on the clock, forced to do multiple rounds until it reached the expected value Multiple initial value can result in the same value on the clock.  Which is why it’s difficult to find the original value used as an input.

@gheb_dev @gregoirehebert THANK YOU FOR WATCHING!

@gheb_dev @gregoirehebert SOURCES https://chiffrer.info/  https://www.youtube.com/channel/UC9-y-6csu5WGm29I7JiwpnA  https://en.wikipedia.org/wiki/Transport_Layer_Security  https://en.wikipedia.org/wiki/Substitution%E2%80%93permutation_network  https://en.wikipedia.org/wiki/Advanced_Encryption_Standard  https://en.wikipedia.org/wiki/RSA_(cryptosystem)  https://en.wikipedia.org/wiki/MD5 
https://en.wikipedia.org/wiki/SHA-1  https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange  https://en.wikipedia.org/wiki/Elliptic-curve_Diffie%E2%80%93Hellman  https://en.wikipedia.org/wiki/Triple_DES  https://en.wikipedia.org/wiki/Data_Encryption_Standard  http://competitions.cr.yp.to/aes.html  https://en.wikipedia.org/wiki/Public-key_cryptography  https://sha-mbles.github.io/  https://en.wikipedia.org/wiki/Password-authenticated_key_agreement

@gheb_dev @gregoirehebert Further studies Triple-Diffie-hellmann  Triple Ratchet  Elliptic curves

@gheb_dev @gregoirehebert What if we could use that for our
users password too ? Further studies

@gheb_dev @gregoirehebert Further studies

@gheb_dev @gregoirehebert Detach yourself from your passwords !  https://github.com/web-auth/webauthn-framework Further
studies

With Symfony 4.4, your secrets will be well kept!

With Symfony 4.4, your secrets will be well kept!

More Decks by Grégoire Hébert

Other Decks in Programming

Featured

Transcript