APPLIED CRYPTOGRAPHY: FROM ALGORITHMS TO LIBRARIES @ABSTRACTJ - - PowerPoint PPT Presentation

▶
applied cryptography
SMART_READER_LITE
LIVE PREVIEW

APPLIED CRYPTOGRAPHY: FROM ALGORITHMS TO LIBRARIES @ABSTRACTJ - - PowerPoint PPT Presentation

Feb 23, 2024 280 likes •1.03k views

APPLIED CRYPTOGRAPHY: FROM ALGORITHMS TO LIBRARIES @ABSTRACTJ GOAL OF THIS PRESENTATION ALGORITHMS An algorithm must be seen to be believed. Donald E. Knuth THIS TALK IS NOT ABOUT ALGORITHMS, ONLY SECURITY the state of being

slide-1
SLIDE 1

APPLIED CRYPTOGRAPHY:

FROM ALGORITHMS TO LIBRARIES

slide-2
SLIDE 2

@ABSTRACTJ

slide-3
SLIDE 3
slide-4
SLIDE 4
slide-5
SLIDE 5
slide-6
SLIDE 6
slide-7
SLIDE 7

GOAL OF THIS PRESENTATION

slide-8
SLIDE 8

ALGORITHMS

slide-9
SLIDE 9
slide-10
SLIDE 10
slide-11
SLIDE 11

“ An algorithm must be seen to be

believed.

― Donald E. Knuth

slide-12
SLIDE 12
slide-13
SLIDE 13
slide-14
SLIDE 14
slide-15
SLIDE 15
slide-16
SLIDE 16
slide-17
SLIDE 17

THIS TALK IS NOT ABOUT ALGORITHMS, ONLY

slide-18
SLIDE 18
slide-19
SLIDE 19

SECURITY

“ the state of being free from danger or

threat

slide-20
SLIDE 20

FEELING VS REALITY

slide-21
SLIDE 21

“ Cryptography is the art and science of

encryption

― Cryptography Engineering

slide-22
SLIDE 22

“ The study of codes, or the art of

writing and solving them.

― Oxford dictionaries

slide-23
SLIDE 23

HISTORICALLY FOCUSED ON SECRET COMMUNICATIONS

slide-24
SLIDE 24
slide-25
SLIDE 25

VIGENÈRE CIPHER

~ 1553, Rome

slide-26
SLIDE 26

ENIGMA

(1920)

slide-27
SLIDE 27

DES

(1974)

Key size 2⁵⁶, block size 64 bits Short key sizes can be subject of brute force Should be avoided Broken in 22 hours

slide-28
SLIDE 28

DES

(1974)

slide-29
SLIDE 29

LIMITED PROCESSING POWER

slide-30
SLIDE 30

TODAY

slide-31
SLIDE 31

TODAY

slide-32
SLIDE 32

TODAY

slide-33
SLIDE 33

BROADER SCOPE

File integrity Random IDs API authentication Password storage JWTs Software updates Bank transactions

slide-34
SLIDE 34

ALGORITHMS

Hashes Block ciphers Stream ciphers Digital signatures Message authentication codes Private key encryption Public key encryption

slide-35
SLIDE 35

CRYPTO WON'T SOLVE ALL OF YOUR PROBLEMS

slide-36
SLIDE 36

IT'S COMPLETELY TRICKY

slide-37
SLIDE 37

MOST PART OF THE TIME IS LIKE

slide-38
SLIDE 38

Source: Veracode

slide-39
SLIDE 39

Source: Stackoverflow

slide-40
SLIDE 40

DON'T ROLL YOUR OWN CRYPTO

slide-41
SLIDE 41

“ A cryptosystem should be secure even

if everything about the system, except the key, is public knowledge

― Kerckhoffs's principle

slide-42
SLIDE 42
slide-43
SLIDE 43
slide-44
SLIDE 44

HOW CRYPTO IS DONE TODAY?

slide-45
SLIDE 45

LIBRARIES

Java Node.js & Ruby Web javax.crypto OpenSSL WebCrypto BouncyCastle libsodium sjcl Keyczar crypto-js Jasypt

slide-46
SLIDE 46

LET'S GET OUR HANDS DIRTY

slide-47
SLIDE 47

THE BADLY DESIGNED APP

slide-48
SLIDE 48

Hmmm, I wish I had an app to share my notes

ALICE

slide-49
SLIDE 49

Why not? Count me in

BOB

slide-50
SLIDE 50

I like it!

EVE

slide-51
SLIDE 51

#1 STORY

AS A USER OF THIS APP, ALICE WANTS TO CREATE AND SHARE NEW NOTES

slide-52
SLIDE 52

Barbecue tomorrow? Yes, please!

slide-53
SLIDE 53

Barbecue tomorrow 12 pm? Yes! Barbecue on Monday 9 am?

slide-54
SLIDE 54

#2 STORY

AS A USER OF THIS APP, BOB WANTS TO VERIFY THE INTEGRITY OF ALICE'S FILES

slide-55
SLIDE 55

CWE-327 USE OF A BROKEN OR RISKY CRYPTOGRAPHIC ALGORITHM

slide-56
SLIDE 56

MD5

white.jpg e06723d4961a0a3f950e7786f3 766338 brown.jpg e06723d4961a0a3f950e7786f3 766338

slide-57
SLIDE 57
slide-58
SLIDE 58

SHA-224 SHA-256 SHA-384 SHA-512 ARE ALL GOOD CHOICES

slide-59
SLIDE 59

BUT WHAT ABOUT INCLUDING A SALT?

slide-60
SLIDE 60

CWE-916 PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT

slide-61
SLIDE 61
slide-62
SLIDE 62

#3 STORY

AS A PARANOID, I WOULD LIKE NOT ONLY INTEGRITY, BUT ALSO AUTHENTICITY

slide-63
SLIDE 63

#4 STORY

AS A USER OF THIS APP, I WANT TO ADD INTEGRITY, AUTHENTICITY, SECRECY AND PROTECT MY DATA

slide-64
SLIDE 64

Alice Bob

slide-65
SLIDE 65

MODES OF OPERATION

slide-66
SLIDE 66

Source: Wikipedia Text Text Text Text

ECB IS NOT SECURE

slide-67
SLIDE 67
slide-68
SLIDE 68

Source: Wikipedia

CBC

slide-69
SLIDE 69

Source: Wikipedia

CTR

slide-70
SLIDE 70

#5 STORY

AS A USER I WANT TO HAVE PASSWORD PROTECTED ENTRIES

slide-71
SLIDE 71

#6 STORY

AS SOMEONE VERY SOCIAL, I WANT TO SHARE MY ENTRIES WITH A FRIEND WITHOUT EXPOSING MY KEYS

slide-72
SLIDE 72

Alice Bob sK pK sK pK

slide-73
SLIDE 73

“ Privacy is an inherent human right, and a

requirement for maintaining the human condition with dignity and respect. It is about choice, and having the power to control how you present yourself to the world. Bruce Schneier

slide-74
SLIDE 74

THANK YOU!

http://abstractj.org https://keycloak.org https://github.com/abstractj/krypto-playground