Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Cryptography made easy with Zend Framework 2

Cryptography made easy with Zend Framework 2

Do you need to encrypt data managed in your PHP project? Do you want to protect user's passwords against hacker attacks? Do you need to guarantee the integrity of your data? In this presentation we give the answers to all these questions, and not only, using the component ZendCrypt of the Zend Framework 2 project. We will show how is easy to have strong cryptography standards like the AES-256, PBKDF2, bcrypt, RSA, etc, in your PHP projects.

Enrico Zimuel

October 24, 2012
Tweet

More Decks by Enrico Zimuel

Other Decks in Programming

Transcript

  1. © All rights reserved. Zend Technologies, Inc. Cryptography made easy

    with Zend Framework 2 by Enrico Zimuel ([email protected]) Senior Software Engineer Zend Framework Core Team Zend Technologies Ltd
  2. © All rights reserved. Zend Technologies, Inc. About me •

    Enrico Zimuel • From Turin (Italy) • Software Engineer since 1996, PHP since 1999 • Senior PHP Engineer at Zend Technologies since 2008, in the Zend Framework Team since 2011 • Research Programmer at the Informatics Institute, University of Amsterdam, from 2005 to 2006 • International speaker, author of technical articles and books • Co-founder PHP User Group Turin @ezimuel [email protected] www.zimuel.it
  3. © All rights reserved. Zend Technologies, Inc. Cryptography is hard

    • Cryptography is hard, and implement it is even more hard! • As developers we need a solid background in cryptography engineering • Cryptography engineering is a relatively young discipline, it's a complicated, multidisciplinary field • PHP offers some crypto primitives but you need to know how to use it (this is not straightforward) • This can be a barrier that discouraged PHP developers
  4. © All rights reserved. Zend Technologies, Inc. Cryptography using ZF2

    • Zend\Crypt wants to help PHP developers to use strong cryptography in their projects • In PHP we have built-in functions and extensions for cryptography scopes: ▶ crypt() ▶ Mcrypt ▶ OpenSSL ▶ Hash (by default in PHP 5.1.2) ▶ Mhash (emulated by Hash from PHP 5.3)
  5. © All rights reserved. Zend Technologies, Inc. Zend\Crypt • Zend\Crypt

    components: ▶ Zend\Crypt\Password ▶ Zend\Crypt\Key\Derivation ▶ Zend\Crypt\Symmetic ▶ Zend\Crypt\PublicKey ▶ Zend\Crypt\Hash ▶ Zend\Crypt\Hmac ▶ Zend\Crypt\BlockCipher
  6. © All rights reserved. Zend Technologies, Inc. Encrypt and Authenticate

    • Zend\Crypt\BlockCipher can be used to encrypt/decrypt sensitive data (symmetric encryption) • Provides encryption + authentication (HMAC) • Simplified API: ▶ setKey($key) ▶ encrypt($data) ▶ decrypt($data) • It uses the Mcrypt adapter (Zend\Crypt\Symmetric\Mcrypt)
  7. © All rights reserved. Zend Technologies, Inc. Default encryption values

    • Default values used by BlockCipher: ▶ AES algorithm (key of 256 bits) ▶ CBC mode + HMAC (SHA-256) ▶ PKCS7 padding mode (RFC 5652) ▶ PBKDF2 to generate encryption key + authentication key for HMAC ▶ Random IV for each encryption
  8. © All rights reserved. Zend Technologies, Inc. Example: AES encryption

    The encrypted text is encoded in Base64, you can switch to binary output using setBinaryOutput(true)
  9. © All rights reserved. Zend Technologies, Inc. Example: encryption output

    064b05b885342dc91e7915e492715acf0f896620d bf9d1e00dd0798b15e72e8cZg+hO34C3f3eb8TeJ M9xWQRVex1y5zeLrBsNv+dYeVy3SBJa+pXZbUQY NZw0xS9s Zend\Crypt\BlockCipher::encrypt “This is the message to encrypt” “this is the encryption key” HMAC, IV, ciphertext
  10. © All rights reserved. Zend Technologies, Inc. BlockCipher factory •

    factory($adapter, $parameters), where $parameters can be an array with the following keys: ▶ algorithm (or algo), the name of the block cipher to use (supported algorithms are: aes (rijndael-128), rijndael-192, rijndael-256, blowfish, twofish, des, 3des, cast-128, cast- 256, saferplus, serpent); ▶ mode, the encryption mode of the block cipher (the supported modes are: cbc, cfb, ctr, ofb, nofb, ncfb); ▶ key, the encryption key; ▶ iv (or salt), the Initialization Vector (IV) also known as salt; ▶ padding, the padding mode;
  11. © All rights reserved. Zend Technologies, Inc. Under the hood

    • Zend\Crypt\BlockCipher uses Zend\Crypt\Symmetric that implements symmetric ciphers • We support the Mcrypt extension • Zend\Crypt\Symmetric\Mcrypt is a wrapper of Mcrypt extension with a simplified API and best practices of security built-in • Remember: Don't use directly Zend\Crypt\Symmetric\Mcrypt to encrypt sensitive data (you need also authentication, see the Padding Oracle Attack)
  12. © All rights reserved. Zend Technologies, Inc. Zend\Crypt\PublicKey • Implements

    public key algorithms • We support: ▶ RSA (Zend\Crypt\PublicKey\Rsa) ▶ Diffie-Hellman (Zend\Crypt\PublicKey\DiffieHellman), for key exchange • We use the OpenSSL extension
  13. © All rights reserved. Zend Technologies, Inc. Example: generate the

    keys You can also generate the public and private key using OpenSSL from the command line (Unix style syntax): ssh-keygen -t rsa
  14. © All rights reserved. Zend Technologies, Inc. Limited size using

    RSA • With a key of 2048 bit we can encrypt string with a maximum size of 1960 bit (245 characters) • In most use cases the RSA encryption is used only to encrypt a symmetric key • Then the ciphertext is encrypted using a symmetric cipher (e.g. Zend\Crypt\BlockCipher) • The encrypted key is attached to the ciphertext, in order to be decrypted using the private key of the receiver
  15. © All rights reserved. Zend Technologies, Inc. How to store

    a password • How do you safely store a password? • Old school (insecure): ▶ MD5/SHA1(password) ▶ MD5/SHA1(password . salt) where salt is a random string • New school (secure): ▶ bcrypt
  16. © All rights reserved. Zend Technologies, Inc. Why MD5/SHA1 ±salt

    is not secure? • Dictionary/brute force attacks more efficient • GPU-accelerated password hash: ▶ Whitepixel project whitepixel.zorinaq.com 4 Dual HD 5970, ~ $2800 Algorithm Speed 8 chars 9 chars 10 chars md5($pass) 33 billion p/s 1 ½ hour 4 ½ days 294 days
  17. © All rights reserved. Zend Technologies, Inc. bcrypt • bcrypt

    uses Blowfish cipher + iterations to generate secure hash values • bcrypt is secure against brute force attacks because is slow, very slow (that means attacks need huge amount of time to be completed) • The algorithm needs a salt value and a work factor parameter (cost), which allows you to determine how expensive the bcrypt function will be
  18. © All rights reserved. Zend Technologies, Inc. Zend\Crypt\Password\Bcrypt • We

    used the crypt() function of PHP to implement the bcrypt algorithm • The cost is an integer value from 4 to 31 • The default value for Zend\Crypt\Password\Bcrypt is 14 (that is equivalent to 1 second of computation using an Intel Core i5 CPU at 3.3 Ghz). • The cost value depends on the CPU speed, check on your system! We suggest to consume at least 1 second.
  19. © All rights reserved. Zend Technologies, Inc. Example: bcrypt •

    The output of bcrypt ($hash) is a string of 60 bytes
  20. © All rights reserved. Zend Technologies, Inc. How to verify

    a password • To check if a password is valid against an hash value we can use the method: ▶ Bcrypt::verify($password, $hash) where $password is the value to check and $hash is the hash value generated by bcrypt • This method returns true if the password is valid and false otherwise
  21. © All rights reserved. Zend Technologies, Inc. Zend\Crypt\Key\Derivation • Never

    use a user’s password as cryptographic key • User's password are not secure because: 1) they are not random 2) they generate a small space of keys (low entropy) • We should always use a Key Derivation Function (or KDF) • KDF are special algorithms that generate cryptographic keys, of any size, from a user’s password • ZF2 supports the algorithms: Pbkdf2, SaltedS2k, Scrypt
  22. © All rights reserved. Zend Technologies, Inc. Pbkdf2 • Pbkdf2

    algorithm (RFC 2898) • Uses a cryptographic hash to the input password along with a salt value and repeats the process many times to produce a derived key • Uses the key stretching technique (multiple iterations to increase the CPU time) • The PBKDF2 algorithm is implemented in Zend\Crypt\Key\Derivation\Pbkdf2
  23. © All rights reserved. Zend Technologies, Inc. Example: Pbkdf2 •

    Generates a cryptographic key of 64 bytes • We used a random salt value • We used 100'000 iterations for the algorithm (1 second of computation using Intel Core i5 CPU at 3.3 Ghz)
  24. © All rights reserved. Zend Technologies, Inc. SaltedS2k • SaltedS2k

    algorithm (RFC 2440) • Uses a cryptographic hash to the input password along with a salt value and repeats the process many times to produce a derived key • Uses the key stretching techniques (multiple iterations to increase the CPU time) • The SaltedS2k algorithm is implemented in Zend\Crypt\Key\Derivation\SaltedS2k
  25. © All rights reserved. Zend Technologies, Inc. scrypt • scrypt

    algorithm (RFC draft), introduce by Colin Percival in 2009 • scrypt is a sequential memory hard algorithm: ▶ memory-hard functions require high memory ▶ cannot be parallelized efficiently • scrypt uses Pbkdf2, HMAC-SHA256, Salsa 20/8 core • The Scrypt algorithm is implemented in Zend\Crypt\Key\Derivation\Scrypt
  26. © All rights reserved. Zend Technologies, Inc. Example: scrypt Note:

    a pure PHP implementation of the scrypt algorithm is very slow, compared with a C implementation. If you want use a faster scrypt algorithm we suggest to use the Scrypt extension for PHP (please note that this PHP extension is not official supported by php.net). The scrypt adapter of Zend Framework 2.1.0 supports the Scrypt extension
  27. © All rights reserved. Zend Technologies, Inc. Which algorithm to

    use? • It depends on the security level that you have to support • The bcrypt algorithm is the best choice using a standard PHP environment (last PHP is 5.4.7) • The scrypt algorihtm is considered more secure of bcrypt but you need the Scrypt extension installed to get this improvement (the PHP implementation is too slow) • Use the SaltedS2k only for backward compatibility needs
  28. © All rights reserved. Zend Technologies, Inc. Zend\Crypt\Hash • Implements

    the hash algorithms • We used the Hash extension included in PHP 5.1.2 • Zend\Crypt\Hash provides static methods • The usage is very simple: ▶ Zend\Crypt\Hash::compute($hash, $data, $output = Zend\Crypt\Hash::STRING) where $hash is the hash algorithm to be used (i.e. sha256), $data is the data to hash and $output specify if the output is a string or a binary.
  29. © All rights reserved. Zend Technologies, Inc. Zend\Crypt\Hash (2) •

    We can retrieve the list of all the supported algorithms using the method: ▶ Zend\Crypt\Hash::getSupportedAlgorithms() this is a wrapper to the hash_algos() function of PHP. • We can use retrieve the output size of a specific hash algorithm using the method: ▶ Zend\Crypt\Hash::getOutputSize($hash, $output = Zend\Crypt\Hash::STRING) where $hash is the name of the algorithm and $output specify string or binary as result
  30. © All rights reserved. Zend Technologies, Inc. Zend\Crypt\Hmac • Implements

    the Hash-based Message Authentication Code (HMAC) algorithm supported by Mhash extension of PHP (emulated by Hash from PHP 5.3) • Zend\Crypt\Hmac provides static methods • The usage is very simple: ▶ Zend\Crypt\Hmac::compute($key, $hash, $data, $output = Zend\Crypt\Hmac::STRING) where $key is the key of HMAC, $hash is the name of the hash algorithm to be use, $data is the input data, and $output specify the output format, string or binary
  31. © All rights reserved. Zend Technologies, Inc. PHP vs. randomness

    • How generate a pseudo-random value in PHP? • Not good for cryptography purpose: ▶ rand() ▶ mt_rand() • Good for cryptography (PHP 5.3+): ▶ openssl_random_pseudo_bytes()
  32. © All rights reserved. Zend Technologies, Inc. rand() is not

    so random :( rand() of PHP on Windows Pseudo-random bits Source: random.org
  33. © All rights reserved. Zend Technologies, Inc. Random Number Generator

    in ZF2 • We refactored the random number generator in ZF2 to use (in order): 1) openssl_random_pseudo_bytes() 2) mcrypt_create_iv(), with MCRYPT_DEV_URANDOM 3) mt_rand(), not used for cryptography! • OpenSSL provides secure random numbers • Mcrypt with /dev/urandom provides good security • mt_rand() has low security for crypto purposes
  34. © All rights reserved. Zend Technologies, Inc. /dev/urandom • /dev/urandom

    is the "unlocked"/non-blocking version of /dev/random, it reuses the internal pool to produce more pseudo-random bits • /dev/urandom has less entropy of /dev/random • /dev/urandom is much faster than /dev/random (milliseconds compared with seconds) and is non- blocking (can be used for web apps) • There are some environments where are the same, for instance OpenBSD and FreeBSD
  35. © All rights reserved. Zend Technologies, Inc. Random number in

    Zend\Math • We provides a couple of methods for RNG: ▶ Zend\Math\Math::randBytes($length, $strong = false) ▶ Zend\Math\Math::rand($min, $max, $strong = false) • randBytes() generates $length random bytes • rand() generates a random number between $min and $max • If $strong === true, the functions use only OpenSSL or Mcrypt (if PHP doesn't support these extensions throw an Exception)
  36. © All rights reserved. Zend Technologies, Inc. References • N.

    Ferguson, B. Schneier, T. Kohno, “Cryptography Engineering”, Wiley Publishing, 2010 • D. Boneh "Cryptography course" Stanford University, Coursera - free online courses • C. Hale, “How to safely store a password” • S. Vaudenay, “Security Flaws Induced by CBC Padding Applications to SSL, IPSEC, WTLS”, EuroCrypt 2002 • T. Biege, “Analysis of a strong Pseudo Random Number Generator”, 2006 • PHP-CryptLib, all-inclusive cryptographic library for PHP • Random.org, true random numbers to anyone on the Internet • stackexchange.com, Recommended numbers of iterations when using PKBDF2 • E.Zimuel, “Cryptography in PHP” Web & PHP Magazine, issue 2/2012 • E.Zimuel, “Password (in)security” MOCA, Metro Olografix CAmp 2012