Keeping Secrets: Using Encryption Effectively

Keeping Secrets: Using Encryption Effectively Joe Kuemerle www.kuemerle.com @jkuemerle http://www.flickr.com/photos/28648582@N02/5766506970

@jkuemerle / www.kuemerle.com Joe Kuemerle • Over 15 years of
development experience with a broad range of technologies • Focused on application and data security, coding best practices and regulatory compliance • Presenter at community, regional and national events.

@jkuemerle / www.kuemerle.com http://www.flickr.com/photos/28725326@N07/4928122690/

@jkuemerle / www.kuemerle.com http://xkcd.com/1210/

@jkuemerle / www.kuemerle.com https://en.wikipedia.org/wiki/Letter_frequency

@jkuemerle / www.kuemerle.com http://www.flickr.com/photos/49889874@N05/6101434856

@jkuemerle / www.kuemerle.com dABoAGkAcwBpAHMAYQBuAGkAYwBlAGwAbwBuAGcAcABhAHMAcwB3AG8Ac gBkAA== h0+i44Utl3zmixH5HEBTng== S+cORg3e4Fz7Ckxks8rd4CVmxPzNMa6v+1k+m6/VD/G/HMY/tQxWR98Ypap/sQED dBTfZP7FM1osrctYIphw/AGDyuE= nap/V8KGx/W+L4RXBo1qJhOq2vQ= yuhDQAoHe1BXszrRlT1jTX8nzqs=
$2a$10$ip5k8Uu2UF7RD/oPUkVYluW8q5NSiQOl57FXuwqoGWVYqZG0lksvm thisisanicelongpassword $s0$e0801$ttAQ8v538tVoDxgCB2IqeoL9zgnsS19wx2BWCSOFoH0=$0isly2qWpQoaroZk a2e+uGykbd7YvifFlEeRxrFe7zE=

@jkuemerle / www.kuemerle.com

@jkuemerle / www.kuemerle.com http://www.troyhunt.com/2012/06/our-password-hashing-has-no-clothes.html

@jkuemerle / www.kuemerle.com http://www.nsa.gov/kids/

@jkuemerle / www.kuemerle.com http://www.flickr.com/photos/rachelpasch/2480941823 http://www.flickr.com/photos/platform3/425683175

@jkuemerle / www.kuemerle.com http://www.moserware.com/2009/09/stick-figure-guide-to-advanced.html

@jkuemerle / www.kuemerle.com public static string AESWeakImpl(string Data, byte[] Key,
byte[] IV) { var byteData = Encoding.Unicode.GetBytes(Data); byte[] encrypted; var crypt = new AesManaged() { IV = IV, Key = Key, Mode = CipherMode.ECB }; using (var encrypter = crypt.CreateEncryptor()) { using (var to = new MemoryStream()) { using (var writer = new CryptoStream(to, encrypter, CryptoStreamMode.Write)) { writer.Write(byteData, 0, byteData.Length); writer.FlushFinalBlock(); encrypted = to.ToArray(); } } } return Convert.ToBase64String(encrypted); } public static string AESBetterImpl(string Data, byte[] Key, byte[] IV) { var byteData = Encoding.Unicode.GetBytes(Data); byte[] encrypted; var crypt = new AesManaged() { IV = IV, Key = Key, Mode = CipherMode.CBC }; using (var encrypter = crypt.CreateEncryptor()) { using (var to = new MemoryStream()) { using (var writer = new CryptoStream(to, encrypter, CryptoStreamMode.Write)) { writer.Write(byteData, 0, byteData.Length); writer.FlushFinalBlock(); encrypted = to.ToArray(); } } } return Convert.ToBase64String(encrypted); } http://www.codinghorror.com/blog/2009/05/why-isnt-my-encryption-encrypting.html

@jkuemerle / www.kuemerle.com public string AESConstantIV(string Data, byte[] Key) {
byte[] IV = Convert.FromBase64String("jduM7QxU1IZch/sjNYB8Vw=="); var byteData = Encoding.Unicode.GetBytes(Data); byte[] encrypted; var crypt = new System.Security.Cryptography.AesManaged() { IV = IV, Key = Key, Mode = System.Security.Cryptography.CipherMode.CBC }; using (var encrypter = crypt.CreateEncryptor()) { using (var to = new MemoryStream()) { using (var writer = new CryptoStream(to, encrypter, CryptoStreamMode.Write)) { writer.Write(byteData, 0, byteData.Length); writer.FlushFinalBlock(); encrypted = to.ToArray(); } } } return Convert.ToBase64String(encrypted); }

@jkuemerle / www.kuemerle.com public string AESWeakIV(string Data, string Password) {
byte[] Key = new Rfc2898DeriveBytes(Password, Convert.FromBase64String("36rrsp0D4rkjg54ShyOOqA==")) .GetBytes(new System.Security.Cryptography.AesManaged().KeySize / 8); byte[] IV = new Rfc2898DeriveBytes(Password, Convert.FromBase64String("36rrsp0D4rkjg54ShyOOqA==")) .GetBytes(new System.Security.Cryptography.AesManaged().BlockSize / 8); var byteData = Encoding.Unicode.GetBytes(Data); byte[] encrypted; var crypt = new System.Security.Cryptography.AesManaged() { IV = IV, Key = Key, Mode = System.Security.Cryptography.CipherMode.CBC }; using (var encrypter = crypt.CreateEncryptor()) { using (var to = new MemoryStream()) { using (var writer = new CryptoStream(to, encrypter, CryptoStreamMode.Write)) { writer.Write(byteData, 0, byteData.Length); writer.FlushFinalBlock(); encrypted = to.ToArray(); } } } return Convert.ToBase64String(encrypted); }

@jkuemerle / www.kuemerle.com byte[] Key = Convert.FromBase64String("q+/6kLVpkfMLoqEe+nc+tDKygEw zOJMI1FrNXcu9p9I="); byte[] IV
= Convert.FromBase64String("aiUG8RBiea7/b9CaHsiahw=="); http://www.flickr.com/photos/mshades/225117359

@jkuemerle / www.kuemerle.com http://www.flickr.com/photos/brhefele/5750117824

@jkuemerle / www.kuemerle.com https://www.flickr.com/photos/metalriot/4279300557

@jkuemerle / www.kuemerle.com https://www.flickr.com/photos/ehacke/4584255926

@jkuemerle / www.kuemerle.com http://azure.microsoft.com/en-us/services/key-vault/ http://aws.amazon.com/cloudhsm/

@jkuemerle / www.kuemerle.com http://www.flickr.com/photos/morgantar/3548079597

@jkuemerle / www.kuemerle.com Resources • http://www.troyhunt.com/2012/06/our-password- hashing-has-no-clothes.html • http://www.codinghorror.com/blog/2009/05/why-isnt- my-encryption-encrypting.html
• http://www.microsoft.com/security/sdl/default.aspx • http://www.bouncycastle.org/csharp/ • http://plaintextoffenders.com/ • http://securitydriven.net/ • https://github.com/viniciuschiele/scrypt • https://github.com/jkuemerle/EncryptedType • https://www.nuget.org/packages/EncryptedType • http://wp.sjkp.dk/securing-azure-web-job-secrets-with-azure-key- vault/

Keeping Secrets: Using Encryption Effectively

Keeping Secrets: Using Encryption Effectively

Joe Kuemerle

More Decks by Joe Kuemerle

Other Decks in Programming

Featured

Transcript