Cryptography Pitfalls at OSCON 2013

Transcript

1. CRYPTOGRAPHY PITFALLS John Downey | @jtdowney
2. John Downey | Security Engineer
3. http://www.flickr.com/photos/60445767@N00/2466272019/
4. http://www.flickr.com/photos/freefoto/5692512457/
5. http://www.flickr.com/photos/zappowbang/2049368918/
6. http://www.flickr.com/photos/katieharbath/4382294246/
7. http://www.flickr.com/photos/kalebdf/2170180285/
8. http://www.flickr.com/photos/alstonfamily/2237347597/
10. http://www.flickr.com/photos/damiavos/4707651586/ You have probably seen the door to a bank vault, at least in the movies. You know, 10-inch- thick, hardened steel, with huge bolts to lock it in place. It certainly looks impressive. We often find the digital equivalent of such a vault door installed in a tent. The people standing around it are arguing over how thick the door should be, rather than spending their time looking at the tent. Cryptography Engineering Niels Ferguson, Bruce Schneier, and Tadayoshi Kohno
11. http://www.flickr.com/photos/bootycat/5849904501/
12. •For data in transit •Use TLS/SSL, SSH, or VPN/IPsec •For data at rest •Use GnuPG •Use a high level library •Keyczar (Python and Java) •NaCL (C, Ruby, etc)
13. http://www.flickr.com/photos/proimos/4199675334/
14. RANDOM NUMBER GENERATION
15. http://www.flickr.com/photos/brentnewhall/6559793329/
17. MD_Update(&m,buf,j);
18. Don't add uninitialised data to the random number generator. This stop valgrind from giving error messages in unrelated code. (Closes: #363516)
19. /* DO NOT REMOVE THE FOLLOWING CALL TO MD_Update()! */ MD_Update(&m,buf,j); /* We know that line may cause programs such as purify and valgrind to complain about use of uninitialized data. The problem is not, it's with the caller. Removing that line will make sure you get really bad randomness and thereby other problems such as very insecure keys. */
20. RECOMMENDATIONS • Use the crypto library RNG • OpenSSL random • On Linux (or other Unix-like OS) • /dev/random - blocks for entropy • /dev/urandom - non-blocking
21. LENGTH EXTENSION ATTACKS
22. HASH FUNCTIONS
23. http://www.flickr.com/photos/littlejohncollection/3675547973/
24. USCYBERCOM plans, coordinates, integrates, synchronizes and conducts activities to: direct the operations and defense of specified Department of Defense information networks and; prepare to, and when directed, conduct full spectrum military cyberspace operations in order to enable actions in all domains, ensure US/Allied freedom of action in cyberspace and deny the same to our adversaries. 9EC4C12949A4F31474F299058CE2B22A MD5
26. RECOMMENDATIONS •Use SHA-256 (SHA-2 family) •Stop using MD5 •Don’t use SHA1 in new projects
27. RestClient.post( 'https://example.com/things', :name => 'Widget', :price => 1_23, :signature => signature )
28. secret = "api-key" str = "name=#{name}&" str += "price=#{price}" body = "#{secret}|#{str}" signature = sha1(body)
29. sha1("api-key|name=Widget&price=123") 8CBBCB204861672F93B26A6401E685195AB5719B SHA1
30. http://www.flickr.com/photos/worldbank/3492662794/
31. h0 = 0x8CBBCB20 h1 = 0x4861672F h2 = 0x93B26A64 h3 = 0x01E68519 h4 = 0x5AB5719B h0 = 0x67452301 h1 = 0xEFCDAB89 h2 = 0x98BADCFE h3 = 0x10325476 h4 = 0xC3D2E1F0
32. h0 = 0x8CBBCB20 h1 = 0x4861672F h2 = 0x93B26A64 h3 = 0x01E68519 h4 = 0x5AB5719B 8CBBCB204861672F93B26A6401E685195AB5719B
33. &price=0
34. api-key|name=Widget&price=123&price=0
35. h0 = 0x8CBBCB20 h1 = 0x4861672F h2 = 0x93B26A64 h3 = 0x01E68519 h4 = 0x5AB5719B h0 = 0x7CA17A2B h1 = 0x91BD35C0 h2 = 0x9D50A3AD h3 = 0x5CAD1E9B h4 = 0x396DDEF4
36. api-key|name=Widget&price=123&price=0 7CA17A2B91BD35C09D50A3AD5CAD1E9B396DDEF4 SHA1
37. RestClient.post( 'https://example.com/things', :name => 'Widget', :price => 0, :signature => signature )
38. RECOMMENDATIONS •Use HMAC-SHA-256 for authentication •Keyed hash function •Resistant to length extension
39. ECB MODE
40. http://www.flickr.com/photos/kevinomara/3422866722
41. Plaintext ECB
42. Plaintext “This is a secret” Key 0xE60DC5C9747A 963A86FD9522547 Ciphertext 0x7CD937D779C4 555CF38244BEC63 AES-128(key, msg) Random IV 0x20B8F0FBE8CCA 71A58FC86E6F256 ⊕
43. Plaintext “message” Key 0xE60DC5C9747A 963A86FD9522547 Ciphertext 0x5867695E0F48DE A14A33F1E70C416 AES-128(key, msg) ⊕ Last Ciphertext 0x7CD937D779C4 555CF38244BEC63
44. Random IV 0x20B8F0FBE8CCA 71A58FC86E6F256 Ciphertext 0x7CD937D779C4 555CF38244BEC63 Ciphertext 0x5867695E0F48DE A14A33F1E70C416
45. Plaintext ECB CBC
46. RECOMMENDATIONS • Use AES • Do not use DES • Do not use ECB mode • Use an authenticated encryption mode • GCM, CCM, OCB • CBC with an HMAC of IV and ciphertext • Verify the tag/MAC first
47. PASSWORD STORAGE
48. http://www.flickr.com/photos/sponng/4554602341/
54. sha1(password)
55. 1.One-way •Only useful for verification
56. sha1(salt + password)
57. 1.One-way •Only useful for verification 2.Randomized •Defeats pre-computed tables •Forces focus on one password
58. http://www.flickr.com/photos/jaffathecake/2618896075/
59. 1.One-way •Only useful for verification 2.Randomized •Defeats pre-computed tables •Forces focus on one password 3.Slow
60. bcrypt, scrypt, or PBKDF2 ADAPTIVE HASHING
61. RECOMMENDATIONS • Delegate authentication if possible • Facebook, Twitter, Google, Github • Store one-way verifiers using bcrypt, scrypt, or PBDKF2 • Use existing framework • has_secure_password (Rails >= 3.1) • devise
62. TLS/SSL VERIFICATION
63. http://www.flickr.com/photos/your_teacher/400805545/
68. RECOMMENDATIONS • Check your SSL connections • Verify certificate / verify peer • Verify host • Setup an automated test
69. TRUST
70. The authenticity of host 'apollo.local (10.0.2.56)' can't be established. RSA key fingerprint is 04:63:c1:ba:c7:31:04:12:14:ff:b6:c4:32:cf:44:ec. Are you sure you want to continue connecting (yes/no)?
71. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that the RSA host key has just been changed. The fingerprint for the RSA key sent by the remote host is 04:63:c1:ba:c7:31:04:12:14:ff:b6:c4:32:cf:44:ec. Please contact your system administrator.
72. • AOL Time Warner Inc. • AS Sertifitseerimiskeskus • AddTrust • Baltimore • beTRUSTed • Buypass • CNNIC • COMODO CA Limited • Certplus • certSIGN • Chambersign • Chunghwa Telecom Co., Ltd. • ComSign • Comodo CA Limited • Cybertrust, Inc • Deutsche Telekom AG • Deutscher Sparkassen Verlag GmbH • Dhimyotis • DigiCert Inc • DigiNotar • Digital Signature Trust Co. • Disig a.s. • EBG Bilişim Teknolojileri ve Hizmetleri A.Ş. • EDICOM • Entrust, Inc. • Equifax • GTE Corporation • GeoTrust Inc. • GlobalSign nv-sa • Hongkong Post • Japan Certification Services, Inc. • Japanese Government • Microsec Ltd. • NetLock Halozatbiztonsagi Kft. • Network Solutions L.L.C. • PM/SGDN • QuoVadis Limited • RSA Security Inc • SECOM Trust Systems CO.,LTD. • SecureTrust Corporation • Sociedad Cameral de Certificación Digital • Sonera • Staat der Nederlanden • Starfield Technologies, Inc. • StartCom Ltd. • SwissSign AG • Swisscom • TC TrustCenter GmbH • TDC • Taiwan Government • Thawte • The Go Daddy Group, Inc. • The USERTRUST Network • TÜBİTAK • TÜRKTRUST • Unizeto Sp. z o.o. • VISA • ValiCert, Inc. • VeriSign, Inc. • WISeKey • Wells Fargo • XRamp Security Services Inc
73. CERTIFICATE PINNING
75. RECOMMENDATIONS • Think about what organizations you really trust • Consider disabling some roots • Use certificate pinning in your apps
76. https://www.coursera.org/course/crypto STANFORD CRYPTO CLASS
77. http://www.matasano.com/articles/crypto-challenges/ MATASANO CRYPTO CHALLENGES
78. PRAGMATIC CRYPTOGRAPHY http://pragmaticcrypto.com/
79. • Videos • Theory and Practice of Cryptography series • http://www.youtube.com/watch?v=IzVCrSrZIX8 • http://www.youtube.com/watch?v=KDvt_0cafPw • http://www.youtube.com/watch?v=YcgqBEzcD_I • http://www.youtube.com/watch?v=ZDnShu5V99s • Crypto Strikes Back! • http://www.youtube.com/watch?v=ySQl0NhW1J0 • Presentations • http://www.bsdcan.org/2010/schedule/attachments/135_crypto1hr.pdf • http://www.eff.org/files/DefconSSLiverse.pdf • Books • Cryptography Engineering - Ferguson, Schneier, and Kohno • Blogs • http://blog.cryptographyengineering.com/ • http://rdist.root.org/
80. QUESTIONS? John Downey | @jtdowney