Cryptography Pitfalls at GOTO Chicago 2016

Cryptography Pitfalls at GOTO Chicago 2016

58376779023f009fc13d160bb3e82515?s=128

John Downey

May 25, 2016
Tweet

Transcript

  1. 4.

    The views expressed in this presentation are my own, and

    not those of PayPal or any of its affiliates. @jtdowney 4
  2. 12.

    You have probably seen the door to a bank vault,

    at least in the movies. You know, 10-inch-thick, hardened steel, with huge bolts to lock it in place. It certainly looks impressive. We often find the digital equivalent of such a vault door installed in a tent. The people standing around it are arguing over how thick the door should be, rather than spending their time looking at the tent. — Cryptography Engineering by Niels Ferguson, Bruce Schneier, and Tadayoshi Kohno @jtdowney 12
  3. 13.

    • For data in transit • Use TLS (née SSL),

    SSH, or VPN/IPsec • For data at rest • Use GnuPG @jtdowney 13
  4. 14.

    • Avoid low level libraries • OpenSSL • PyCrypto •

    Bouncy Castle • Use a high level library • NaCL/libsodium (C, Ruby, etc) • Keyczar (Python and Java) @jtdowney 14
  5. 17.

    • Randomness is a central part of any crypto system

    • Used to generate: • Encryption keys • API keys • Session tokens • Password reset tokens @jtdowney 17
  6. 18.

    Pitfalls 1. Not using a cryptographically strong random number generator

    2. Broken random random number generators 3. Not using random data when it is required @jtdowney 18
  7. 21.

    Pitfalls 1. Not using the right random number generator 2.

    Broken random random number generators 3. Not using random data when it is required @jtdowney 21
  8. 24.

    Don't add uninitialised data to the random number generator. This

    stop valgrind from giving error messages in unrelated code. (Closes: #363516) @jtdowney 24
  9. 25.

    /* DO NOT REMOVE THE FOLLOWING CALL TO MD_Update()! */

    MD_Update(&m,buf,j); /* We know that line may cause programs such as purify and valgrind to complain about use of uninitialized data. The problem is not, it's with the caller. Removing that line will make sure you get really bad randomness and thereby other problems such as very insecure keys. */ @jtdowney 25
  10. 29.

    Pitfalls 1. Not using the right random number generator 2.

    Broken random random number generators 3. Not using random data when it is required @jtdowney 29
  11. 31.

    Recommendations • Unix-like • Read from /dev/urandom • Windows •

    RandomNumberGenerator.Create() (.NET) • CryptGenRandom (Windows) @jtdowney 31
  12. 33.

    • Often called a fingerprint • One way • Not

    reversible (can’t find person without fingerprint DB) • Ideally, no two people with same fingerprint (no two inputs) @jtdowney 33
  13. 40.

    mission = """ USCYBERCOM plans, coordinates, integrates, synchronizes and conducts

    activities to: direct the operations and defense of specified Department of Defense information networks and; prepare to, and when directed, conduct full spectrum military cyberspace operations in order to enable actions in all domains, ensure US/Allied freedom of action in cyberspace and deny the same to our adversaries. """ md5(mission) # => 9EC4C12949A4F31474F299058CE2B22A @jtdowney 40
  14. 44.

    Length Extension Attacks secret = "my-secret-key" value = "buy 10

    units at $1" signature = sha256(secret + "|" + value) @jtdowney 44
  15. 45.

    Length Extension Attacks secret = "my-secret-key" value = "buy 10

    units at $1<garbage>actually make that at $0" signature = sha256(secret + "|" + value) @jtdowney 45
  16. 46.

    Length Extension Attacks secret = "my-secret-key" value = "buy 10

    units at $1" signature = hmac_sha256(secret, value) @jtdowney 46
  17. 47.

    Message Authentication Code (MAC) tag = hmac_sha256(key, value) • key

    - shared secret • value - value to protected integrity of • tag - value that represents the integrity @jtdowney 47
  18. 50.

    Recommendations • Use SHA-256 (SHA-2 family) • Choose HMAC-SHA-256 if

    you want a signature • Stop using MD5 • Don't use SHA-1 in new projects • Phase it out for uses that require collision resistance @jtdowney 50
  19. 61.

    1. One-way • Value can be used for verification 2.

    Randomized • Can largely defeat pre-computed tables • Forces attackers to focus on one password @jtdowney 61
  20. 63.

    1. One-way • Value can be used for verification 2.

    Randomized • Can largely defeat pre-computed tables • Forces attackers to focus on one password 3. Slow @jtdowney 63
  21. 65.

    Recommendations • Delegate authentication if possible • Facebook, Twitter, Google,

    Github • Store one-way verifiers using bcrypt, scrypt, or PBDKF2 @jtdowney 65
  22. 69.

    • Don't wait for user to login and silently upgrade

    • Wrap bcrypt around existing scheme • Use bcrypt(sha1(salt || password) • Upgrade all passwords in place • This does require you're previous password scheme wasn't atrociously bad (e.g. DES crypt) @jtdowney 69
  23. 72.

    Pitfalls 1. Using old/weak algorithms 2. Using ECB mode 3.

    Not using authenticated encryption @jtdowney 72
  24. 76.

    Pitfalls 1. Using old/weak algorithms 2. Using ECB mode 3.

    Not using authenticated encryption @jtdowney 76
  25. 77.

    AES - primitive ciphertext = AES_Encrypt(key, plaintext) plaintext = AES_Decrypt(key,

    ciphertext) • Function over: • key - 128, 192, or 256 bit value • plaintext - 128 bit value • ciphertext - 128 bit value @jtdowney 77
  26. 78.

    ECB Encrypt while (remaining blocks) { block = ... #

    next 16 byte (128 bit chunk) ouput.append(AES_Encrypt(key, block)) } @jtdowney 78
  27. 81.

    Pitfalls 1. Using old/weak algorithms 2. Using ECB mode 3.

    Not using authenticated encryption @jtdowney 81
  28. 87.

    Recommendations • Prefer to use box/secret box from NaCL/libsodium •

    Stop using DES • Stop building your own on top of AES • Stop encrypting without protecting integrity @jtdowney 87
  29. 88.

    What if you have to use AES • Do not

    use ECB mode • Be sure to use authenticated encryption • GCM mode would be a good first choice • Verify the tag/MAC first • Still easy to mess up in a critical way @jtdowney 88
  30. 91.

    Pitfalls 1. Not verifying the certificate chain 2. Not verifying

    the hostname 3. Using a broken library @jtdowney 91
  31. 94.

    Pitfalls 1. Not verifying the certificate chain 2. Not verifying

    the hostname 3. Using a broken library @jtdowney 94
  32. 95.

    • Hostname verification is protocol dependent • OpenSSL doesn't have

    it built in • Also, some people just turn it off: curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); @jtdowney 95
  33. 96.

    Pitfalls 1. Not verifying the certificate chain 2. Not verifying

    the hostname 3. Using a broken library @jtdowney 96
  34. 99.

    Recommendations • Do ensure you're validating connections • Lean on

    a framework/library if possible • But check that it also does the right thing • Setup and automated test to validate this setting (badssl.com) @jtdowney 99
  35. 102.

    The authenticity of host 'apollo.local (10.0.2.56)' can't be established. RSA

    key fingerprint is 04:63:c1:ba:c7:31:04:12:14:ff:b6:c4:32:cf:44:ec. Are you sure you want to continue connecting (yes/no)? @jtdowney 102
  36. 103.

    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

    IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that the RSA host key has just been changed. The fingerprint for the RSA key sent by the remote host is 04:63:c1:ba:c7:31:04:12:14:ff:b6:c4:32:cf:44:ec. Please contact your system administrator. @jtdowney 103
  37. 107.

    Recommendations • Think about what organizations you really trust •

    Investigate certificate pinning for your apps @jtdowney 107
  38. 112.

    Images • https://flic.kr/p/6eagaw • https://flic.kr/p/4KWhKn • https://flic.kr/p/9F2BCv • https://flic.kr/p/486xYS •

    https://flic.kr/p/7Ffppm • https://flic.kr/p/8TuJD9 • https://flic.kr/p/4iLJZt • https://flic.kr/p/4pGZuz • https://flic.kr/p/48w7wP • https://flic.kr/p/8aZWNE • https://flic.kr/p/5NRHp • https://flic.kr/p/7p7raq • https://flic.kr/p/aZEE1Z • https://flic.kr/p/7WtwAz • https://flic.kr/p/6AN9mM • https://flic.kr/p/6dt62u • https://flic.kr/p/4ZqwyB • https://flic.kr/p/Bqewr • https://flic.kr/p/ecdhVE @jtdowney 112