Crypto 101 by Laurens Van Houtven

Transcript

1. Crypto 101 @lvh
2. @lvh _@lvh.io
6. POST /quantum HTTP/1.1
8. Lightning Talk Version
9. In motion: TLS
10. At rest: GPG
11. (Py)NaCl KeyCzar cryptlib
12. If you are typing the letters A-E-S into your code, you’re doing it wrong.
13. DES: extra wrong MD5, SHA: maybe wrong
14. Why stay?
15. Recognizing wrong stuff still matters
16. Understanding stuff still matters
19. xor
20. 1 ^ 0 == 1 0 ^ 1 == 1
21. 1 ^ 1 == 0 0 ^ 0 == 0
22. Invert? Input Output
23. Invert: yes (1) Input: 1 Output: 0
24. Invert: no (0) Input: 1 Output: 1
25. One-time Pad
26. 1110010101010110 1010100000111101 0100101010101010 ...
27. OTP crypto XWCVPR
28. Perfect secrecy
29. 0? 1? 1
30. 1? 0? 1
34. Victory!
35. len(one_time_pad)
36. == len(all_data_ever)
37. == very_big_number
38. Exchange?
39. Ciphers
40. Block Ciphers
41. Block Cipher Key abc XYZ Ciphertext Same fixed size Plaintext Fixed size
42. P C
43. Random permutation
44. 000: 001 001: 010 010: 111 011: 000 100: 110 101: 011 110: 100 111: 101
45. x, C(k, x) vs y, C(k, y)
46. P C
47. AES
48. Blowfish/Twofish
49. DES/3DES
50. Victory!
51. “Hello”
52. with open(“x.jpg”) as f: send(f, you)
53. Block Cipher
54. len(message) > block_size
55. aes.block_size == 128 (16 bytes)
56. Stream Ciphers
57. Native stream ciphers
58. RC4
59. Salsa20 ChaCha20
60. Implemented as construction with block ciphers
61. abcdefghijklmnopqrstuvw C k C k C k C k C k C k C k { { { { { { { { C k padding KEGASVTPCFDRUWBOJNMHXQIL { { { { { { { {
62. ECB
63. plaintext chunk ciphertext chunk
68. Replay Attacks
71. Block Cipher Modes of Operation
72. ECB, (P)CBC, CFB, OFB, CTR
73. ECB, (P)CBC, CFB, OFB, CTR
74. CBC
75. Most common in the wild
76. BEAST
77. CTR
78. {nonce}{count:08d}
79. D501320200000000 D501320200000001 D501320200000002 Nonce Count . . .
80. C k C k D501320200000000, D501320200000001, ... D1DC4D1FE3679212, 0FD25C7B1CF46485, ...
81. D1DC4D1FE3679212 0FD25C7B1CF46485 ...
82. Keystream
83. Pseudo-OTP
84. GCM, EAX, OCB, IAPM, CCM, CWC
85. GCM, EAX, OCB, IAPM, CCM, CWC
86. PATENT PENDING
87. Victory!
89. Key exchange?
90. In person?
92. O(n2)
93. Diffie-Hellman Key Exchange
95. = +
96. = + +
97. - =
98. Internet Me You
100. + = + =
103. + = + =
104. = + + + +
105. Victory!
107. Cease fire! ZSTAMUTJMEFFILH Cease fire!
108. Attack at dawn! HUWKEMMQTXMR Attack at dawn!
109. Authenticity
110. sender == expected_sender
111. message == expected_message
112. Encryption without authentication
113. Almost certainly wrong
114. Attackers don’t need to decrypt to modify
115. Cryptographic hash functions
116. lorem ipsum 358d846c39 digest (state) fixed size message arbitrary size Hash Function
117. lorem ipsum 358d846c39 Hash Function
118. lorem ipsum 358d846c39 Hash Function
119. lorem python 358d846c39 lorem ipsum 358d846c39 Hash Function Hash Function
120. lorem python 358d846c39 lorem ipsum 358d846c39 Hash Function Hash Function
121. That’s it.
122. H(x) can be used to compute H(f(x))
123. Extension attacks
124. hf = HF(“hello pycon\n”) hf.update(“how are you”) hf.hexdigest()
125. hf = HF(state=your_hash) hf.update(my_string) hf.hexdigest()
126. my_string = “\nI am not attending, because I have switched to PHP”
127. Payment processor
128. MD5(secret + amount)
129. $12.00: “1200”
130. hf = HF(state=your_hash) hf.update(“0” * 12) hf.hexdigest()
131. bwall/HashPump
132. SHA-3 era: fixed (SHA-3, BLAKE2)
133. SHA-256, SHA-3 (both are fine)
134. BLAKE2
135. MAC
136. H(x) can be used to compute H(f(x))
137. MAC(k, x) says nothing about MAC(k, f(x))
138. MAC(k, x) says nothing about MAC(k, y)
139. HMAC
140. hmac(k, hf, msg)
141. import hmac
142. Password storage
143. CHFs are WRONG
144. password 45ed8f8c31 Hash Function
145. Brute force?
147. ATI HD 5970, 2GB 5.6e9 MD5/s 2.3e9 SHA2/s
149. SHA-3?
150. lorem ipsum 358d846c39 Hash Function
151. SHA-2-256: 14 cpb SHA-3-256: 11 cpb (Intel Ivy Bridge/Sandy Bridge)
152. Salts?
153. Dictionary attacks
154. KDFs should be hard to compute
155. bcrypt (tunably) time-hard
156. scrypt time- and space-hard
157. Sender authentication?
159. Public key Cryptography
163. Key generation
164. me me you you
165. me you
166. Encryption
167. PK Enc you hello world BXUWD VWQEF
168. Decryption
169. PK Dec you hello world BXUWD VWQEF you
170. Signing
171. Anyone can use my public key
172. How do I know you’re you?
173. PK Dec you Signature HF(m) you
174. PK Enc you Signature HF(m)
175. RSA
176. Victory!
177. “me” == actually me?
178. Chains of signatures
179. I don’t trust you.
180. But X trusts you.
181. And I trust X.
182. So I trust you.
183. GPG key signing
184. SSL
185. TLS
187. version, ciphersuites, ...
188. Key exchange method (RSA, DH, ...)
189. Signing algorithm (RSA, DSA, ECDSA)
190. Bulk encryption algorithm (AES-CBC, RC4...)
191. MAC algorithm (HMAC-{MD5, SHA2})
192. version, ciphersuites, ...
193. ✓
194. RSA Enc srvr random secret OUTDX BHXUS
195. OUTDXBHXUS
196. RSA Dec srvr random secret OUTDX BHXUS srvr
197. random secret AES MAC random secret AES MAC
198. MAC
200. Encrypted + Authenticated
201. ✓
203. CAs
204. ...
206. valid vs trustworthy?
207. valid vs trustworthy?
208. What if I plant a root cert?
209. sslbump
210. ICAP/eCAP
211. lvh/minitrue
212. Questions?
213. Timing attacks
214. Side-channel
215. Implementation, not theory
221. provided == password
222. compare length
223. compare byte by byte
224. “abc” == “xyz”
225. “abc” == “ayz”
226. “abc” == “abz”
227. len(alpha) ** len(pw)
228. X * X * X * .... len(alpha) possibilities len(pwd) times
229. k * len(alpha) * len(pw) possibilities measurements characters
230. More TLS
231. Client certificates
232. Ephemeral Diffie-Hellman
233. Elliptic Curves ECDH/ECDSA