PHP Cryptography Extensions

PHP Cryptography Extensions Hash, Mcrypt, and OpenSSL Tristan Penman tristan@tristanpenman.com Images and primary reference: wikipedia Examples and snippets based on example code from the PHP Manual

Overview •  Cryptography Background –  Cryptographic algorithms Background –  Block size and padding •  Hashing Background Hash •  Hash Demos Demos •  More Cryptography Background –  Modes of operaGon Mcrypt –  Cipher Block Chaining •  Mcrypt Demos Demos 2x •  OpenSSL Background –  Public Key Cryptography OpenSSL –  Digital Signatures Demos –  X.509 cerGﬁcates •  OpenSSL Demos QuesGons!

Cryptographic Algorithms (Ciphers) •  Symmetric key algorithms –  Stream ciphers (e.g. XOR with one-‐Gme pad) –  Block ciphers (e.g. DES, AES-‐128) –  ApplicaGons: EncrypGon of documents •  Asymmetric key algorithms –  Public key cryptography (e.g. RSA) –  ApplicaGons: TLS/SSL cerGﬁcates, PGP/GPG

Block Size and Padding •  Blocks –  Plaintext is divided into blocks of same size –  Blocks are typically the same size as the key –  E.g. AES-‐128 uses 128-‐bit blocks •  Padding –  Padding schemes fits content into whole blocks –  Usually a simple bit pa]ern –  Zero padding is used in mcrypt –  PKCS5 or PKCS7 oèn used in crypto implementaGons –  Padding block is added if content fits block size

PKCS7 Padding •  PKCS7 (Public Key Cryptography Standard #7) –  Padding is in whole bytes –  Value of each padding byte is number of bytes added –  See snippets/unpad-‐PKCS7.php Example 1 (content does not ﬁt block size): Block 1 Block 2 Block 3 Block 4 Block 5 AA BB CC DD EE FF AA BB CC DD EE FF AA BB CC DD EE 03 03 03 Padding Example 2 (content ﬁts block size): Block 1 Block 2 Block 3 Block 4 Block 5 AA BB CC DD EE FF AA BB CC DD EE FF AA BB CC DD 04 04 04 04 Padding

Hash FuncGons •  One-‐way funcGons •  Ideally, each unique input will produce a unique hash •  Not always the case due to collisions •  Collisions occur when two unique inputs produce the same hash –  MD5 and SHA-‐1 are considered broken since collisions can be found faster than brute force –  Use SHA-‐256 •  PHP provides the HASH Message Digest Framework

HMAC •  Hash-‐based Message AuthenGcaGon Code –  Uses a key to reduce likelihood of collision –  Very diﬃcult to forge •  HMAC(K,m) = H((K ⊕ opad) $ H((K ⊕ ipad) $ m)) –  $ denotes concatenaGon –  ⊕ denotes XOR operaGon –  H is the hash funcGon –  K is the key –  m is the message –  opad is the outer pad –  ipad is the inner pad

Demos -‐ Hashing •  Demos –  01-‐hash-‐incremental –  02-‐hash-‐hmac •  FuncGons of interest –  hash_algos() // lists available algorithms –  hash(a, m) // calculate hash of m using algorithm a –  hash_init(a) // init context using algorithm a (returns context) –  hash_update(c, m) // add message m to context c –  hash_ﬁnal(c) // calculate ﬁnal hash for context c –  hash_hmac(a, m, k) // calc HMAC of m using algorithm a and key k

Cryptography -‐ Modes of operaGon •  How blocks are inﬂuenced by previous blocks –  Enables secure re-‐use of a key –  Some modes support ‘self-‐synchronisaGon’ –  Good pracGce is to use chaining •  Common modes of operaGon –  Electronic Codebook (ECB) –  Cipher Block Chaining (CBC) very common –  PropagaGng CBC (PCBC) –  Cipher Feedback (CFB) –  Output Feedback (OFB)

Electronic Codebook (Bad) •  IdenGcal plaintext blocks encrypt into idenGcal ciphertext Original Encrypted using ECB Encrypted using a mode other than ECB* * Random appearance does not guarantee secure encrypGon

Cipher Block Chaining (Be]er) •  Each block depends on all previous blocks •  Block of plaintext is XORed with ciphertext from the previous block •  The XORed block is then encrypted •  Previous Ciphertext is not available for the ﬁrst block •  An IniGalisaGon Vector (IV) is used instead •  IV is public, but should be random

CBC in Pictures EncrypGon DecrypGon

A few alternaGve modes •  PropagaGng Cipher Block Chaining (PCBC) –  Small changes in cipher text propagate indeﬁnitely when decrypGng •  Cipher Feedback (CFB) / Output Feedback (OFB) –  Allows use of block cipher as a self-‐ synchronizing stream cipher –  SynchronisaGon at block-‐level –  Can skip 1 bit/byte errors if block size is 1 bit /1 byte –  CFB and OFB have similar goals but operate diﬀerently

Basic Mcrypt funcGons •  Basic funcGons –  mcrypt_list_algorithms() –  mcrypt_encrypt(cipher, key, plaintext, mode, iv) –  mcrypt_decrypt(cipher, key, ciphertext, mode, iv) –  mcrypt_get_iv_size(cipher, mode) •  Avoid these deprecated funcGons –  mcrypt_cbc These funcGons handle both encrypGon and –  mcrypt_cq decrypGon. They have been deprecated in –  mcrypt_eq favour of mcrypt_generic and mdecrypt_generic, introduced later. –  mcrypt_oq

Demos – Basic Mcrypt •  Demos –  03-‐mcrypt-‐encrypt –  04-‐mcrypt-‐decrypt •  Notes –  Using CBC mode (MCRYPT_MODE_CBC) –  In real life, a hashing funcGon should be used to create a key from a string. This ensures that the key is the correct length for the cipher.

Advanced Mcrypt funcGons •  Low-‐level API •  Advanced funcGons (used in demos) –  mcrypt_module_open(alg, alg_dir, mode, mode_dir) –  mcrypt_enc_get_iv_size(encrypGon_desc) –  mcrypt_create_iv(size, source) –  mcrypt_generic_init(encrypGon_desc, key, iv) –  mcrypt_generic(encrypGon_desc, plaintext) –  mcrypt_generic_deinit(encrypGon_desc) –  mcrypt_module_close(encrypGon_desc) •  Need an Encryp>on Descriptor •  Must ini>alise and deini>alise the encrypGon descriptor for each key and IV used

CreaGng an EncrypGon Descriptor EncrypGon descriptor Algorithm idenGﬁer Mode of operaGon $desc = mcrypt_module_open (alg, alg_dir, mode, mode_dir) Algorithm directory -‐ Mode directory – default value set using default value set using mcrypt.algorithms_dir mcrypt.modes_dir direcGve in php.ini direcGve in php.ini mcrypt_generic(desc, plaintext)

CreaGng an IV (for CBC) IV size EncrypGon descriptor (block size) (speciﬁes cipher and mode) $size = mcrypt_enc_get_iv_size (desc) OpGonal random source for IV data. Default value is MCRYPT_DEV_RANDOM which uses /dev/random. $iv = mcrypt_create_iv (size, source) AlternaGve sources are MCRYPT_RAND for the default OS random generator and MCRYPT_DEV_URANDOM for /dev/urandom. mcrypt_generic_init(desc, key, iv)

Demos – Advanced Mcrypt •  Demos –  05-‐encrypt-‐cbc-‐adv –  06-‐decrypt-‐cbc-‐adv •  Notes –  mcrypt_generic(desc, plaintext) is used to encrypt data –  mdecrypt_generic(desc, ciphertext) is used to decrypt data

OpenSSL •  Implements SSL and TLS protocols •  Also supports a wide range of algorithms –  Symmetric key ciphers (e.g. AES, Blowﬁsh) –  Cryptographic hash funcGons (e.g. MD5, SHA-‐1) –  Public Key Cryptography •  We focus on Public Key Cryptography –  Speciﬁcally Digital Signatures

Public Key Cryptography •  Constructed using asymmetric key algorithms –  One key for encrypGon (public key) –  Another key for decrypGon (private key) •  Example Algorithms –  Diﬃe-‐Hellman Key Exchange (allows for negoGaGon of a secret key over an insecure channel) –  RSA (commonly used for signing) •  ApplicaGons –  Public key encrypGon (ensure conﬁdenGality) –  Digital signatures (ensure authenGcity)

Digital Signatures 1.  Hash is calculated for data 2.  Hash is encrypted using the private key of the enGty that is signing the data 3.  Encrypted hash is a Digital Signature 4.  Signature is appended to data 5.  Recipient calculates hash for received data 6.  Decrypts Signature using public key of signing enGty (assumes public key is known) 7.  Compares decrypted hash with calculated hash

X.509 Standard •  Standard for PKI (Public Key Infrastructure) –  CerGficate formats (.cer, .crt, .pem) –  RevocaGon lists –  CerGficate validaGon •  CerGficate ValidaGon –  Based on a CerGficate Authority (CA) hierarchy –  CA issues cerGficates to ‘ve]ed’ organisaGons –  CerGficates are Ged to the organisaGon’s public key •  It is helpful to understand the X.509 CerGficate format

X.509 CerGficate for freeso`.org Issuer Issuer details are used to locate cerGficate Public key on issuer cerGficate is used to decrypt signature Signature Public key for (hash of cerGficate freeso`.org encrypted using issuer’s public key)

Signing Data with OpenSSL Private key handle Private key data $priv_key_id = openssl_get_privatekey(priv_key_data) openssl_sign(data, signature, priv_key_id, signature_alg) Output variable (passed in by reference)

Verify Signed Data with OpenSSL Public key handle CerGﬁcate data $pub_key_id = openssl_get_publickey(cert_data) openssl_verify(data, signature, pub_key_id, signature_alg) Returns boolean

Demos -‐ OpenSSL •  Demos –  07-‐openssl-‐sign –  08-‐openssl-‐verify •  Notes –  Private key and self-‐signed cerGﬁcate generated using keys/generate.sh –  keys/demo.pem (private key inc. public key informaGon) –  keys/demo.crt (cerGﬁcate containing public key)

QuesGons? •  References –  Wikipedia –  PHP Manual –  OpenSSL website (PHP docs are incomplete) •  This talk was going to include a simple Client/Server demo to demonstrate Diﬃe-‐Hellman Key Exchange, however the relevant secGons of the PHP Manual were very incomplete. •  I found that the digital signature funcGonality was well documented (and probably more relevant). •  Slides, demos and other ﬁles can be found at: h]p://tristanpenman.com/talks/php-‐crypto/php-‐crypto.tar.gz

PHP Cryptography Extensions

by Tristan Penman on Aug 16, 2011

Accessibility

Tags

Upload Details

Usage Rights

Statistics

PHP Cryptography Extensions — Presentation Transcript