Cryptography Pitfalls at OSCON 2013

Cryptography Pitfalls at OSCON 2013

58376779023f009fc13d160bb3e82515?s=128

John Downey

July 26, 2013
Tweet

Transcript

  1. CRYPTOGRAPHY PITFALLS John Downey | @jtdowney

  2. John Downey | Security Engineer

  3. http://www.flickr.com/photos/60445767@N00/2466272019/

  4. http://www.flickr.com/photos/freefoto/5692512457/

  5. http://www.flickr.com/photos/zappowbang/2049368918/

  6. http://www.flickr.com/photos/katieharbath/4382294246/

  7. http://www.flickr.com/photos/kalebdf/2170180285/

  8. http://www.flickr.com/photos/alstonfamily/2237347597/

  9. None
  10. http://www.flickr.com/photos/damiavos/4707651586/ You have probably seen the door to a bank

    vault, at least in the movies. You know, 10-inch- thick, hardened steel, with huge bolts to lock it in place. It certainly looks impressive. We often find the digital equivalent of such a vault door installed in a tent. The people standing around it are arguing over how thick the door should be, rather than spending their time looking at the tent. Cryptography Engineering Niels Ferguson, Bruce Schneier, and Tadayoshi Kohno
  11. http://www.flickr.com/photos/bootycat/5849904501/

  12. •For data in transit •Use TLS/SSL, SSH, or VPN/IPsec •For

    data at rest •Use GnuPG •Use a high level library •Keyczar (Python and Java) •NaCL (C, Ruby, etc)
  13. http://www.flickr.com/photos/proimos/4199675334/

  14. RANDOM NUMBER GENERATION

  15. http://www.flickr.com/photos/brentnewhall/6559793329/

  16. None
  17. MD_Update(&m,buf,j);

  18. Don't add uninitialised data to the random number generator. This

    stop valgrind from giving error messages in unrelated code. (Closes: #363516)
  19. /* DO NOT REMOVE THE FOLLOWING CALL TO MD_Update()! */

    MD_Update(&m,buf,j); /* We know that line may cause programs such as purify and valgrind to complain about use of uninitialized data. The problem is not, it's with the caller. Removing that line will make sure you get really bad randomness and thereby other problems such as very insecure keys. */
  20. RECOMMENDATIONS • Use the crypto library RNG • OpenSSL random

    • On Linux (or other Unix-like OS) • /dev/random - blocks for entropy • /dev/urandom - non-blocking
  21. LENGTH EXTENSION ATTACKS

  22. HASH FUNCTIONS

  23. http://www.flickr.com/photos/littlejohncollection/3675547973/

  24. USCYBERCOM plans, coordinates, integrates, synchronizes and conducts activities to: direct

    the operations and defense of specified Department of Defense information networks and; prepare to, and when directed, conduct full spectrum military cyberspace operations in order to enable actions in all domains, ensure US/Allied freedom of action in cyberspace and deny the same to our adversaries. 9EC4C12949A4F31474F299058CE2B22A MD5
  25. None
  26. RECOMMENDATIONS •Use SHA-256 (SHA-2 family) •Stop using MD5 •Don’t use

    SHA1 in new projects
  27. RestClient.post( 'https://example.com/things', :name => 'Widget', :price => 1_23, :signature =>

    signature )
  28. secret = "api-key" str = "name=#{name}&" str += "price=#{price}" body

    = "#{secret}|#{str}" signature = sha1(body)
  29. sha1("api-key|name=Widget&price=123") 8CBBCB204861672F93B26A6401E685195AB5719B SHA1

  30. http://www.flickr.com/photos/worldbank/3492662794/

  31. h0 = 0x8CBBCB20 h1 = 0x4861672F h2 = 0x93B26A64 h3

    = 0x01E68519 h4 = 0x5AB5719B h0 = 0x67452301 h1 = 0xEFCDAB89 h2 = 0x98BADCFE h3 = 0x10325476 h4 = 0xC3D2E1F0
  32. h0 = 0x8CBBCB20 h1 = 0x4861672F h2 = 0x93B26A64 h3

    = 0x01E68519 h4 = 0x5AB5719B 8CBBCB204861672F93B26A6401E685195AB5719B
  33. &price=0

  34. api-key|name=Widget&price=123&price=0

  35. h0 = 0x8CBBCB20 h1 = 0x4861672F h2 = 0x93B26A64 h3

    = 0x01E68519 h4 = 0x5AB5719B h0 = 0x7CA17A2B h1 = 0x91BD35C0 h2 = 0x9D50A3AD h3 = 0x5CAD1E9B h4 = 0x396DDEF4
  36. api-key|name=Widget&price=123&price=0 7CA17A2B91BD35C09D50A3AD5CAD1E9B396DDEF4 SHA1

  37. RestClient.post( 'https://example.com/things', :name => 'Widget', :price => 0, :signature =>

    signature )
  38. RECOMMENDATIONS •Use HMAC-SHA-256 for authentication •Keyed hash function •Resistant to

    length extension
  39. ECB MODE

  40. http://www.flickr.com/photos/kevinomara/3422866722

  41. Plaintext ECB

  42. Plaintext “This is a secret” Key 0xE60DC5C9747A 963A86FD9522547 Ciphertext 0x7CD937D779C4

    555CF38244BEC63 AES-128(key, msg) Random IV 0x20B8F0FBE8CCA 71A58FC86E6F256 ⊕
  43. Plaintext “message” Key 0xE60DC5C9747A 963A86FD9522547 Ciphertext 0x5867695E0F48DE A14A33F1E70C416 AES-128(key, msg)

    ⊕ Last Ciphertext 0x7CD937D779C4 555CF38244BEC63
  44. Random IV 0x20B8F0FBE8CCA 71A58FC86E6F256 Ciphertext 0x7CD937D779C4 555CF38244BEC63 Ciphertext 0x5867695E0F48DE A14A33F1E70C416

  45. Plaintext ECB CBC

  46. RECOMMENDATIONS • Use AES • Do not use DES •

    Do not use ECB mode • Use an authenticated encryption mode • GCM, CCM, OCB • CBC with an HMAC of IV and ciphertext • Verify the tag/MAC first
  47. PASSWORD STORAGE

  48. http://www.flickr.com/photos/sponng/4554602341/

  49. None
  50. None
  51. None
  52. None
  53. None
  54. sha1(password)

  55. 1.One-way •Only useful for verification

  56. sha1(salt + password)

  57. 1.One-way •Only useful for verification 2.Randomized •Defeats pre-computed tables •Forces

    focus on one password
  58. http://www.flickr.com/photos/jaffathecake/2618896075/

  59. 1.One-way •Only useful for verification 2.Randomized •Defeats pre-computed tables •Forces

    focus on one password 3.Slow
  60. bcrypt, scrypt, or PBKDF2 ADAPTIVE HASHING

  61. RECOMMENDATIONS • Delegate authentication if possible • Facebook, Twitter, Google,

    Github • Store one-way verifiers using bcrypt, scrypt, or PBDKF2 • Use existing framework • has_secure_password (Rails >= 3.1) • devise
  62. TLS/SSL VERIFICATION

  63. http://www.flickr.com/photos/your_teacher/400805545/

  64. None
  65. None
  66. None
  67. None
  68. RECOMMENDATIONS • Check your SSL connections • Verify certificate /

    verify peer • Verify host • Setup an automated test
  69. TRUST

  70. The authenticity of host 'apollo.local (10.0.2.56)' can't be established. RSA

    key fingerprint is 04:63:c1:ba:c7:31:04:12:14:ff:b6:c4:32:cf:44:ec. Are you sure you want to continue connecting (yes/no)?
  71. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

    IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that the RSA host key has just been changed. The fingerprint for the RSA key sent by the remote host is 04:63:c1:ba:c7:31:04:12:14:ff:b6:c4:32:cf:44:ec. Please contact your system administrator.
  72. • AOL Time Warner Inc. • AS Sertifitseerimiskeskus • AddTrust

    • Baltimore • beTRUSTed • Buypass • CNNIC • COMODO CA Limited • Certplus • certSIGN • Chambersign • Chunghwa Telecom Co., Ltd. • ComSign • Comodo CA Limited • Cybertrust, Inc • Deutsche Telekom AG • Deutscher Sparkassen Verlag GmbH • Dhimyotis • DigiCert Inc • DigiNotar • Digital Signature Trust Co. • Disig a.s. • EBG Bilişim Teknolojileri ve Hizmetleri A.Ş. • EDICOM • Entrust, Inc. • Equifax • GTE Corporation • GeoTrust Inc. • GlobalSign nv-sa • Hongkong Post • Japan Certification Services, Inc. • Japanese Government • Microsec Ltd. • NetLock Halozatbiztonsagi Kft. • Network Solutions L.L.C. • PM/SGDN • QuoVadis Limited • RSA Security Inc • SECOM Trust Systems CO.,LTD. • SecureTrust Corporation • Sociedad Cameral de Certificación Digital • Sonera • Staat der Nederlanden • Starfield Technologies, Inc. • StartCom Ltd. • SwissSign AG • Swisscom • TC TrustCenter GmbH • TDC • Taiwan Government • Thawte • The Go Daddy Group, Inc. • The USERTRUST Network • TÜBİTAK • TÜRKTRUST • Unizeto Sp. z o.o. • VISA • ValiCert, Inc. • VeriSign, Inc. • WISeKey • Wells Fargo • XRamp Security Services Inc
  73. CERTIFICATE PINNING

  74. None
  75. RECOMMENDATIONS • Think about what organizations you really trust •

    Consider disabling some roots • Use certificate pinning in your apps
  76. https://www.coursera.org/course/crypto STANFORD CRYPTO CLASS

  77. http://www.matasano.com/articles/crypto-challenges/ MATASANO CRYPTO CHALLENGES

  78. PRAGMATIC CRYPTOGRAPHY http://pragmaticcrypto.com/

  79. • Videos • Theory and Practice of Cryptography series •

    http://www.youtube.com/watch?v=IzVCrSrZIX8 • http://www.youtube.com/watch?v=KDvt_0cafPw • http://www.youtube.com/watch?v=YcgqBEzcD_I • http://www.youtube.com/watch?v=ZDnShu5V99s • Crypto Strikes Back! • http://www.youtube.com/watch?v=ySQl0NhW1J0 • Presentations • http://www.bsdcan.org/2010/schedule/attachments/135_crypto1hr.pdf • http://www.eff.org/files/DefconSSLiverse.pdf • Books • Cryptography Engineering - Ferguson, Schneier, and Kohno • Blogs • http://blog.cryptographyengineering.com/ • http://rdist.root.org/
  80. QUESTIONS? John Downey | @jtdowney