Security and Trust on the Web

2014-Security_and_Trust_on_the_Web.mkd

Security and Trust on the Web

Daryl Tucker

Cryptography

Encryption

---

Decryption

---

Cipher/Cypher

---

Coding

---

Methods of Encryption

---

Block Cipher

Uses chunks of data. Fills extra room in each chunk with padding.

1. Data Encryption Standard (DES)

   • IMB developed in 1970's
   • Published in 1977
   • Vulnerable to attacks due to small key size (56b)
   • DEPRECATED => triple-DES

2. Advanced Encryption Standard (AES)

   • Published in 2001
   • Uses Rijndael Cipher

Stream Cipher

Encrypts each character or byte in succession.

1. RC4
   • RSA 'Trade Secret' until September, 1994
   • Fast and Simple
   • Allows attacker to 'distinguish' encrypted data.
   • Causing issues with HTTPS/SSL

Digital Signature Schemes

Allows authentication of source of data

• RSA
• DSA

Cryptographic Hash Function

Gives a determined-length identifier for a series of bytes.

1. MD5 / SHA-1

   • DEPRECATED
   • Collisons every 2^64
   • Replaced by SHA-2

2. SHA-2 / SHA-3

   • Variable bits: 224, 256, 384, 512
   • Designed to be used in parallel/contingency
   • SHA-3 Uses Sponge Function

   $ sha256("Frank").hexdigest() 'db605e8f71913d1f3966ad908d78b8a8084f5047122037b2b91a7192b598a9ad'

   $ sha256("Frank White").hexdigest() '112eed9bd22287808323f9ed7760e566b78798d57cfb834d6a570774c9e1c77e'

Message Authentication Codes (MAC)

Cryptographic hash that allows validation with secret key.

What is Public-key Cryptography?

Symmetric-key vs Asymmetric-key

1. Symmetric
   • The same key is used for encryption and decryption
   • Users must all have the same key
   • Problems with Secure Channel/MitM
2. Asymmetric (1976)
   • 1970 James H. Ellis of Government Communications Headquarters, Britain
   • 1973 Clifford Cocks of GCHQ
   • 1974 Malcom J. Williamson of GCHQ (Diffie-Hellman Clone)
   • 1976 Diffie-Hellman

Diffie-Hellman Key Exchange

• One Trip
• ElGamal and DSA

Other Popular usages of Asymmetric Cryptography

• RSA
• TLS => SSL
• GPG/PGP
• Bitcoin (donate: 17Hwm5tuH7rCMf8Ukc2U7RUvxN22WWPur5)

Web of Trust

• GPG/PGP
• Certificate Authorities

User Security

What we've learned since 1970

Establishing Trust

• Chicken and Egg
• Secure Channel
• Man in the Middle (MitM)

Passwords and Phrases

Brute-Force

90% of 16,00+ hashed passcodes cracked

"Our goal is to find the most plains in the least amount of time, so we want to find as much low-hanging fruit as possible first."

PIN Analysis

• 11% 1234
• 6% 1111
• 2% 0000

27% of all PINs cracked using only 20 combinations

Rainbow Tables

---

Protecting your key ring

• WPA2 with AES
• Password Generation/Storage
• Browser Security
• Trusting your LAN
• Mobile Devices
• Using GPG
• Physical Security

---

Development

• Deprecation of MD5 and SHA-1
• Specific usage of SHA-3
• Padding (WWII: The World Wonders)
  • N+(0-INF)
• HTTP Authentication Protocol
  • Uses salts!
• Oauth 2
  • Assumes a secure channel (Use HTTPS!)
  • Signed/Authenticated
  • Tokens are no longer completely randomized

Misconceptions

• [Cryptographic] Hashing vs Encrypting
• Cryptanalysis
• Cryptography vs Cryptology
• Hacking vs Cracking
• Storing Passwords
• Misc Learnings and Best Practices

Strengths

Computer Complexity

1. Integer Factorization
   • 
   • RSA
2. Discrete Logarithm
   • 
   • Diffie-Hellman
   • DSA
3. Elliptic Curve
   • 
   • ECDSA
   • Time-Consuming
   • Smaller Ciphertext
   • NSA Influence [1] [2]
   • Please use Curve25519

Attacks

1. Man in the Middle (MitM)
   • CA/Arbitrator
   • PKI Providers
   • Offline/Other secure channel
2. Brute Force
   • Arbitrary/Random Pausing
   • Limiting requests over a timeframe
   • Whitelists
   • Blacklists
3. Rainbow Tables
   • Salts
4. Chosen-Plaintext
   • Collect many ciphertexts
   • Gardening
   • DES (Vulnerable)
   • AES (Secure)
5. Side Channel
   • DANGER, DANGER
   • System/Physical Information
     • Sound, Electromagnetism
     • Differential Fault Analysis
     • Remanent Data
6. Covert Channel
   • "Hacker's API"
7. XSL
   • AES (Vulnerable, but not exactly)
8. Key Recovery
   • Determine entire key vs breaking individual ciphertexts
   • AES-128 2^126.1
   • AES-192 2^189.7
   • AES-256 2^254.4
9. Distinguishing
   • Random vs Real Data

This has been made publicly available to assist people who wish to learn more about cryptography usage and as an opportunity for people to make constructive feedback, if they so choose.