SlideShare a Scribd company logo
1 of 33
Cryptographic storage
for people in a hurry
               Graham Lee
 Smartphone security boffin, Fuzzy Aliens Ltd.




                                 fuzzyaliens.com
Cryptographic storage
for people in a hurry
               Graham Lee
 Smartphone security boffin, Fuzzy Aliens Ltd.
From App to Crap
From App to Crap
Nut[the problem]shell
Nut[the problem]shell
• Want to store data
Nut[the problem]shell
• Want to store data
• But it must be secret
Nut[the problem]shell
• Want to store data
• But it must be secret
 • if the phone is stolen
Nut[the problem]shell
• Want to store data
• But it must be secret
 • if the phone is stolen
 • if the iTunes backup is stolen
Nut[the problem]shell
• Want to store data
• But it must be secret
 • if the phone is stolen
 • if the iTunes backup is stolen
• It must be tamper-proof
Nut[the problem]shell
• Want to store data
• But it must be secret
 • if the phone is stolen
 • if the iTunes backup is stolen
• It must be tamper-proof
• …to some extent
Solution: aescrypt
Solution: aescrypt
• Unencumbered (public domain) format and
  freeware implementation at http://
  aescrypt.org
Solution: aescrypt
• Unencumbered (public domain) format and
  freeware implementation at http://
  aescrypt.org
• Not just you using it
Solution: aescrypt
• Unencumbered (public domain) format and
  freeware implementation at http://
  aescrypt.org
• Not just you using it
• Mac, iOS, more
Solution: aescrypt
• Unencumbered (public domain) format and
  freeware implementation at http://
  aescrypt.org
• Not just you using it
• Mac, iOS, more
• Let’s start at byte 0 :-)
‘AES0020’


• Magic number
• Tells you the version of the crypto format
Meet a Data
Metadata
Metadata

• Arbitrary ‘extensions’ section
Metadata

• Arbitrary ‘extensions’ section
• Creator ID, creation date…
Metadata

• Arbitrary ‘extensions’ section
• Creator ID, creation date…
• …as long as that stuff isn’t a secret
What’s our vector,
               Victor?
   // We will use an initialization vector comprised of the
current time
   // process ID, and random data, all hashed together
with SHA-256.




                                           source: wikipedia
You can’t come in here unless
     you say “Swordfish”
   // Hash the IV and password 8192 times
   memset(digest, 0, 32);
   memcpy(digest, IV, 16);
   for(i=0; i<8192; i++)
   {
      sha256_starts( &sha_ctx);
      sha256_update( &sha_ctx, digest, 32);
      sha256_update( &sha_ctx,
                (unsigned char*)passwd,
                (unsigned long)passlen);
      sha256_finish( &sha_ctx,
                digest);
   }
Cutty say 'e can't HANG!
Cutty say 'e can't HANG!

 • The key we just derived is not used to
   encrypt the plaintext file
 • Instead, it’s used to encrypt a key, which is
   itself used to encrypt the file.
 • …why?
Irony: Eminem tribute act
singing “the real slim shady”
…
16 Octets - Initialization Vector (IV) used for encrypting the
        IV and symmetric key that is actually used to encrypt
        the bulk of the plaintext file.
48 Octets - Encrypted IV and 256-bit AES key used to encrypt the
        bulk of the file
        16 octets - initialization vector
        32 octets - encryption key
32 Octets - HMAC
nn Octets - Encrypted message (2^64 octets max)
 1 Octet - File size modulo 16 in least significant bit positions
32 Octets - HMAC
…
Filler material
…
16 Octets - Initialization Vector (IV) used for encrypting the
       IV and symmetric key that is actually used to encrypt
       the bulk of the plaintext file.
48 Octets - Encrypted IV and 256-bit AES key used to encrypt the
       bulk of the file
       16 octets - initialization vector
       32 octets - encryption key
32 Octets - HMAC
nn Octets - Encrypted message (2^64 octets max)
 1 Octet - File size modulo 16 in least significant bit positions
32 Octets - HMAC
…
To the Question Pit!
     @iamleeg
To the Question Pit!
     @iamleeg


              fuzzyaliens.com

More Related Content

Similar to Crypto storage

Breaking Smart Speakers: We are Listening to You.
Breaking Smart Speakers: We are Listening to You.Breaking Smart Speakers: We are Listening to You.
Breaking Smart Speakers: We are Listening to You.Priyanka Aash
 
Protect Sensitive Data with Ada Keystore
Protect Sensitive Data with Ada KeystoreProtect Sensitive Data with Ada Keystore
Protect Sensitive Data with Ada KeystoreStephane Carrez
 
Password Storage Sucks!
Password Storage Sucks!Password Storage Sucks!
Password Storage Sucks!nerdybeardo
 
Cryptography 101 for_java_developers, Fall 2019
Cryptography 101 for_java_developers, Fall 2019Cryptography 101 for_java_developers, Fall 2019
Cryptography 101 for_java_developers, Fall 2019Michel Schudel
 
Crypto Wallets: A Technical Perspective (Nakov at OpenFest 2018)
Crypto Wallets: A Technical Perspective (Nakov at OpenFest 2018)Crypto Wallets: A Technical Perspective (Nakov at OpenFest 2018)
Crypto Wallets: A Technical Perspective (Nakov at OpenFest 2018)Svetlin Nakov
 
How does cryptography work? by Jeroen Ooms
How does cryptography work?  by Jeroen OomsHow does cryptography work?  by Jeroen Ooms
How does cryptography work? by Jeroen OomsAjay Ohri
 
Hitcon badge 2018
Hitcon badge 2018 Hitcon badge 2018
Hitcon badge 2018 Alan Lee
 
How to Use Cryptography Properly: The Common Mistakes People Make When Using ...
How to Use Cryptography Properly: The Common Mistakes People Make When Using ...How to Use Cryptography Properly: The Common Mistakes People Make When Using ...
How to Use Cryptography Properly: The Common Mistakes People Make When Using ...POSSCON
 
Exploiting null byte vm
Exploiting null byte vmExploiting null byte vm
Exploiting null byte vmdevanshdubey7
 
Feasibility of Security in Micro-Controllers
Feasibility of Security in Micro-ControllersFeasibility of Security in Micro-Controllers
Feasibility of Security in Micro-Controllersardiri
 
Using Cryptography Properly in Applications
Using Cryptography Properly in ApplicationsUsing Cryptography Properly in Applications
Using Cryptography Properly in ApplicationsGreat Wide Open
 
JavaOne 2016 - JVM assisted sensitive data
JavaOne 2016 - JVM assisted sensitive dataJavaOne 2016 - JVM assisted sensitive data
JavaOne 2016 - JVM assisted sensitive dataCharlie Gracie
 
Cryptography 101 for Java Developers - Devoxx 2019
Cryptography 101 for Java Developers - Devoxx 2019Cryptography 101 for Java Developers - Devoxx 2019
Cryptography 101 for Java Developers - Devoxx 2019Michel Schudel
 
Cryptography and PKI
Cryptography and PKICryptography and PKI
Cryptography and PKIRabei Hassan
 
Cryptography 101 for Java Developers - JavaZone2019
Cryptography 101 for Java Developers - JavaZone2019Cryptography 101 for Java Developers - JavaZone2019
Cryptography 101 for Java Developers - JavaZone2019Michel Schudel
 
Bitcoin Keys, Addresses & Wallets
Bitcoin Keys, Addresses & WalletsBitcoin Keys, Addresses & Wallets
Bitcoin Keys, Addresses & WalletsChristopher Allen
 
0x4841434b45525a – H4x0r presentation for n00bs
0x4841434b45525a – H4x0r presentation for n00bs0x4841434b45525a – H4x0r presentation for n00bs
0x4841434b45525a – H4x0r presentation for n00bsGil Megidish
 
Advanced SOHO Router Exploitation XCON
Advanced SOHO Router Exploitation XCONAdvanced SOHO Router Exploitation XCON
Advanced SOHO Router Exploitation XCONLyon Yang
 

Similar to Crypto storage (20)

Breaking Smart Speakers: We are Listening to You.
Breaking Smart Speakers: We are Listening to You.Breaking Smart Speakers: We are Listening to You.
Breaking Smart Speakers: We are Listening to You.
 
Protect Sensitive Data with Ada Keystore
Protect Sensitive Data with Ada KeystoreProtect Sensitive Data with Ada Keystore
Protect Sensitive Data with Ada Keystore
 
Password Storage Sucks!
Password Storage Sucks!Password Storage Sucks!
Password Storage Sucks!
 
Cryptography 101 for_java_developers, Fall 2019
Cryptography 101 for_java_developers, Fall 2019Cryptography 101 for_java_developers, Fall 2019
Cryptography 101 for_java_developers, Fall 2019
 
Crypto Wallets: A Technical Perspective (Nakov at OpenFest 2018)
Crypto Wallets: A Technical Perspective (Nakov at OpenFest 2018)Crypto Wallets: A Technical Perspective (Nakov at OpenFest 2018)
Crypto Wallets: A Technical Perspective (Nakov at OpenFest 2018)
 
How does cryptography work? by Jeroen Ooms
How does cryptography work?  by Jeroen OomsHow does cryptography work?  by Jeroen Ooms
How does cryptography work? by Jeroen Ooms
 
Eusecwest
EusecwestEusecwest
Eusecwest
 
Hitcon badge 2018
Hitcon badge 2018 Hitcon badge 2018
Hitcon badge 2018
 
How to Use Cryptography Properly: The Common Mistakes People Make When Using ...
How to Use Cryptography Properly: The Common Mistakes People Make When Using ...How to Use Cryptography Properly: The Common Mistakes People Make When Using ...
How to Use Cryptography Properly: The Common Mistakes People Make When Using ...
 
Tranning-2
Tranning-2Tranning-2
Tranning-2
 
Exploiting null byte vm
Exploiting null byte vmExploiting null byte vm
Exploiting null byte vm
 
Feasibility of Security in Micro-Controllers
Feasibility of Security in Micro-ControllersFeasibility of Security in Micro-Controllers
Feasibility of Security in Micro-Controllers
 
Using Cryptography Properly in Applications
Using Cryptography Properly in ApplicationsUsing Cryptography Properly in Applications
Using Cryptography Properly in Applications
 
JavaOne 2016 - JVM assisted sensitive data
JavaOne 2016 - JVM assisted sensitive dataJavaOne 2016 - JVM assisted sensitive data
JavaOne 2016 - JVM assisted sensitive data
 
Cryptography 101 for Java Developers - Devoxx 2019
Cryptography 101 for Java Developers - Devoxx 2019Cryptography 101 for Java Developers - Devoxx 2019
Cryptography 101 for Java Developers - Devoxx 2019
 
Cryptography and PKI
Cryptography and PKICryptography and PKI
Cryptography and PKI
 
Cryptography 101 for Java Developers - JavaZone2019
Cryptography 101 for Java Developers - JavaZone2019Cryptography 101 for Java Developers - JavaZone2019
Cryptography 101 for Java Developers - JavaZone2019
 
Bitcoin Keys, Addresses & Wallets
Bitcoin Keys, Addresses & WalletsBitcoin Keys, Addresses & Wallets
Bitcoin Keys, Addresses & Wallets
 
0x4841434b45525a – H4x0r presentation for n00bs
0x4841434b45525a – H4x0r presentation for n00bs0x4841434b45525a – H4x0r presentation for n00bs
0x4841434b45525a – H4x0r presentation for n00bs
 
Advanced SOHO Router Exploitation XCON
Advanced SOHO Router Exploitation XCONAdvanced SOHO Router Exploitation XCON
Advanced SOHO Router Exploitation XCON
 

More from Graham Lee

Object-Oriented Programming in Functional Programming in Swift
Object-Oriented Programming in Functional Programming in SwiftObject-Oriented Programming in Functional Programming in Swift
Object-Oriented Programming in Functional Programming in SwiftGraham Lee
 
Cross platform Objective-C Strategy
Cross platform Objective-C StrategyCross platform Objective-C Strategy
Cross platform Objective-C StrategyGraham Lee
 
Taking a Test Drive: iOS Dev UK guide to TDD
Taking a Test Drive: iOS Dev UK guide to TDDTaking a Test Drive: iOS Dev UK guide to TDD
Taking a Test Drive: iOS Dev UK guide to TDDGraham Lee
 
Taking a Test Drive
Taking a Test DriveTaking a Test Drive
Taking a Test DriveGraham Lee
 
Smartphone security and privacy: you're doing it wrong
Smartphone security and privacy: you're doing it wrongSmartphone security and privacy: you're doing it wrong
Smartphone security and privacy: you're doing it wrongGraham Lee
 
Unit testing for Cocoa developers
Unit testing for Cocoa developersUnit testing for Cocoa developers
Unit testing for Cocoa developersGraham Lee
 
Security and Encryption on iOS
Security and Encryption on iOSSecurity and Encryption on iOS
Security and Encryption on iOSGraham Lee
 

More from Graham Lee (7)

Object-Oriented Programming in Functional Programming in Swift
Object-Oriented Programming in Functional Programming in SwiftObject-Oriented Programming in Functional Programming in Swift
Object-Oriented Programming in Functional Programming in Swift
 
Cross platform Objective-C Strategy
Cross platform Objective-C StrategyCross platform Objective-C Strategy
Cross platform Objective-C Strategy
 
Taking a Test Drive: iOS Dev UK guide to TDD
Taking a Test Drive: iOS Dev UK guide to TDDTaking a Test Drive: iOS Dev UK guide to TDD
Taking a Test Drive: iOS Dev UK guide to TDD
 
Taking a Test Drive
Taking a Test DriveTaking a Test Drive
Taking a Test Drive
 
Smartphone security and privacy: you're doing it wrong
Smartphone security and privacy: you're doing it wrongSmartphone security and privacy: you're doing it wrong
Smartphone security and privacy: you're doing it wrong
 
Unit testing for Cocoa developers
Unit testing for Cocoa developersUnit testing for Cocoa developers
Unit testing for Cocoa developers
 
Security and Encryption on iOS
Security and Encryption on iOSSecurity and Encryption on iOS
Security and Encryption on iOS
 

Recently uploaded

Design Guidelines for Passkeys 2024.pptx
Design Guidelines for Passkeys 2024.pptxDesign Guidelines for Passkeys 2024.pptx
Design Guidelines for Passkeys 2024.pptxFIDO Alliance
 
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Jeffrey Haguewood
 
2024 May Patch Tuesday
2024 May Patch Tuesday2024 May Patch Tuesday
2024 May Patch TuesdayIvanti
 
JohnPollard-hybrid-app-RailsConf2024.pptx
JohnPollard-hybrid-app-RailsConf2024.pptxJohnPollard-hybrid-app-RailsConf2024.pptx
JohnPollard-hybrid-app-RailsConf2024.pptxJohnPollard37
 
Introduction to FIDO Authentication and Passkeys.pptx
Introduction to FIDO Authentication and Passkeys.pptxIntroduction to FIDO Authentication and Passkeys.pptx
Introduction to FIDO Authentication and Passkeys.pptxFIDO Alliance
 
Design and Development of a Provenance Capture Platform for Data Science
Design and Development of a Provenance Capture Platform for Data ScienceDesign and Development of a Provenance Capture Platform for Data Science
Design and Development of a Provenance Capture Platform for Data SciencePaolo Missier
 
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024Victor Rentea
 
Intro to Passkeys and the State of Passwordless.pptx
Intro to Passkeys and the State of Passwordless.pptxIntro to Passkeys and the State of Passwordless.pptx
Intro to Passkeys and the State of Passwordless.pptxFIDO Alliance
 
WSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering DevelopersWSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering DevelopersWSO2
 
The Ultimate Prompt Engineering Guide for Generative AI: Get the Most Out of ...
The Ultimate Prompt Engineering Guide for Generative AI: Get the Most Out of ...The Ultimate Prompt Engineering Guide for Generative AI: Get the Most Out of ...
The Ultimate Prompt Engineering Guide for Generative AI: Get the Most Out of ...SOFTTECHHUB
 
UiPath manufacturing technology benefits and AI overview
UiPath manufacturing technology benefits and AI overviewUiPath manufacturing technology benefits and AI overview
UiPath manufacturing technology benefits and AI overviewDianaGray10
 
DBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor PresentationDBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor PresentationDropbox
 
Event-Driven Architecture Masterclass: Challenges in Stream Processing
Event-Driven Architecture Masterclass: Challenges in Stream ProcessingEvent-Driven Architecture Masterclass: Challenges in Stream Processing
Event-Driven Architecture Masterclass: Challenges in Stream ProcessingScyllaDB
 
Continuing Bonds Through AI: A Hermeneutic Reflection on Thanabots
Continuing Bonds Through AI: A Hermeneutic Reflection on ThanabotsContinuing Bonds Through AI: A Hermeneutic Reflection on Thanabots
Continuing Bonds Through AI: A Hermeneutic Reflection on ThanabotsLeah Henrickson
 
AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)
AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)
AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)Samir Dash
 
ChatGPT and Beyond - Elevating DevOps Productivity
ChatGPT and Beyond - Elevating DevOps ProductivityChatGPT and Beyond - Elevating DevOps Productivity
ChatGPT and Beyond - Elevating DevOps ProductivityVictorSzoltysek
 
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Victor Rentea
 
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptxHarnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptxFIDO Alliance
 
How to Check CNIC Information Online with Pakdata cf
How to Check CNIC Information Online with Pakdata cfHow to Check CNIC Information Online with Pakdata cf
How to Check CNIC Information Online with Pakdata cfdanishmna97
 
Navigating Identity and Access Management in the Modern Enterprise
Navigating Identity and Access Management in the Modern EnterpriseNavigating Identity and Access Management in the Modern Enterprise
Navigating Identity and Access Management in the Modern EnterpriseWSO2
 

Recently uploaded (20)

Design Guidelines for Passkeys 2024.pptx
Design Guidelines for Passkeys 2024.pptxDesign Guidelines for Passkeys 2024.pptx
Design Guidelines for Passkeys 2024.pptx
 
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
 
2024 May Patch Tuesday
2024 May Patch Tuesday2024 May Patch Tuesday
2024 May Patch Tuesday
 
JohnPollard-hybrid-app-RailsConf2024.pptx
JohnPollard-hybrid-app-RailsConf2024.pptxJohnPollard-hybrid-app-RailsConf2024.pptx
JohnPollard-hybrid-app-RailsConf2024.pptx
 
Introduction to FIDO Authentication and Passkeys.pptx
Introduction to FIDO Authentication and Passkeys.pptxIntroduction to FIDO Authentication and Passkeys.pptx
Introduction to FIDO Authentication and Passkeys.pptx
 
Design and Development of a Provenance Capture Platform for Data Science
Design and Development of a Provenance Capture Platform for Data ScienceDesign and Development of a Provenance Capture Platform for Data Science
Design and Development of a Provenance Capture Platform for Data Science
 
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
 
Intro to Passkeys and the State of Passwordless.pptx
Intro to Passkeys and the State of Passwordless.pptxIntro to Passkeys and the State of Passwordless.pptx
Intro to Passkeys and the State of Passwordless.pptx
 
WSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering DevelopersWSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering Developers
 
The Ultimate Prompt Engineering Guide for Generative AI: Get the Most Out of ...
The Ultimate Prompt Engineering Guide for Generative AI: Get the Most Out of ...The Ultimate Prompt Engineering Guide for Generative AI: Get the Most Out of ...
The Ultimate Prompt Engineering Guide for Generative AI: Get the Most Out of ...
 
UiPath manufacturing technology benefits and AI overview
UiPath manufacturing technology benefits and AI overviewUiPath manufacturing technology benefits and AI overview
UiPath manufacturing technology benefits and AI overview
 
DBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor PresentationDBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor Presentation
 
Event-Driven Architecture Masterclass: Challenges in Stream Processing
Event-Driven Architecture Masterclass: Challenges in Stream ProcessingEvent-Driven Architecture Masterclass: Challenges in Stream Processing
Event-Driven Architecture Masterclass: Challenges in Stream Processing
 
Continuing Bonds Through AI: A Hermeneutic Reflection on Thanabots
Continuing Bonds Through AI: A Hermeneutic Reflection on ThanabotsContinuing Bonds Through AI: A Hermeneutic Reflection on Thanabots
Continuing Bonds Through AI: A Hermeneutic Reflection on Thanabots
 
AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)
AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)
AI+A11Y 11MAY2024 HYDERBAD GAAD 2024 - HelloA11Y (11 May 2024)
 
ChatGPT and Beyond - Elevating DevOps Productivity
ChatGPT and Beyond - Elevating DevOps ProductivityChatGPT and Beyond - Elevating DevOps Productivity
ChatGPT and Beyond - Elevating DevOps Productivity
 
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
 
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptxHarnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
Harnessing Passkeys in the Battle Against AI-Powered Cyber Threats.pptx
 
How to Check CNIC Information Online with Pakdata cf
How to Check CNIC Information Online with Pakdata cfHow to Check CNIC Information Online with Pakdata cf
How to Check CNIC Information Online with Pakdata cf
 
Navigating Identity and Access Management in the Modern Enterprise
Navigating Identity and Access Management in the Modern EnterpriseNavigating Identity and Access Management in the Modern Enterprise
Navigating Identity and Access Management in the Modern Enterprise
 

Crypto storage

Editor's Notes

  1. \n
  2. \n
  3. \n
  4. \n
  5. \n
  6. \n
  7. Yes, so there is the NSFileProtection encryption. However, the ability to use that to actually protect data depends on the user having a passcode lock enabled, and you can&amp;#x2019;t test for that in your app. If you can&amp;#x2019;t enforce that all of your users comply with a particular passcode policy, you must implement your own protection mechanism.\n
  8. Yes, so there is the NSFileProtection encryption. However, the ability to use that to actually protect data depends on the user having a passcode lock enabled, and you can&amp;#x2019;t test for that in your app. If you can&amp;#x2019;t enforce that all of your users comply with a particular passcode policy, you must implement your own protection mechanism.\n
  9. Yes, so there is the NSFileProtection encryption. However, the ability to use that to actually protect data depends on the user having a passcode lock enabled, and you can&amp;#x2019;t test for that in your app. If you can&amp;#x2019;t enforce that all of your users comply with a particular passcode policy, you must implement your own protection mechanism.\n
  10. Yes, so there is the NSFileProtection encryption. However, the ability to use that to actually protect data depends on the user having a passcode lock enabled, and you can&amp;#x2019;t test for that in your app. If you can&amp;#x2019;t enforce that all of your users comply with a particular passcode policy, you must implement your own protection mechanism.\n
  11. Yes, so there is the NSFileProtection encryption. However, the ability to use that to actually protect data depends on the user having a passcode lock enabled, and you can&amp;#x2019;t test for that in your app. If you can&amp;#x2019;t enforce that all of your users comply with a particular passcode policy, you must implement your own protection mechanism.\n
  12. Yes, so there is the NSFileProtection encryption. However, the ability to use that to actually protect data depends on the user having a passcode lock enabled, and you can&amp;#x2019;t test for that in your app. If you can&amp;#x2019;t enforce that all of your users comply with a particular passcode policy, you must implement your own protection mechanism.\n
  13. The main problem with creating any new crypto format is the chance that you&amp;#x2019;ll introduce new vulnerabilities by misusing the crypto primitives, even if those primitives themselves are bug-free. Sidestep that risk and reduce development time by choosing an existing solution: but notice that solutions like GPG and OpenPGP have licensing restrictions that are incompatible with the app stores.\n
  14. The main problem with creating any new crypto format is the chance that you&amp;#x2019;ll introduce new vulnerabilities by misusing the crypto primitives, even if those primitives themselves are bug-free. Sidestep that risk and reduce development time by choosing an existing solution: but notice that solutions like GPG and OpenPGP have licensing restrictions that are incompatible with the app stores.\n
  15. The main problem with creating any new crypto format is the chance that you&amp;#x2019;ll introduce new vulnerabilities by misusing the crypto primitives, even if those primitives themselves are bug-free. Sidestep that risk and reduce development time by choosing an existing solution: but notice that solutions like GPG and OpenPGP have licensing restrictions that are incompatible with the app stores.\n
  16. The main problem with creating any new crypto format is the chance that you&amp;#x2019;ll introduce new vulnerabilities by misusing the crypto primitives, even if those primitives themselves are bug-free. Sidestep that risk and reduce development time by choosing an existing solution: but notice that solutions like GPG and OpenPGP have licensing restrictions that are incompatible with the app stores.\n
  17. This basically just exists to let you know you&amp;#x2019;re looking at the correct kind of file.\n
  18. Don&amp;#x2019;t spend too much time on this slide, you cretin :-P\n
  19. Don&amp;#x2019;t spend too much time on this slide, you cretin :-P\n
  20. Don&amp;#x2019;t spend too much time on this slide, you cretin :-P\n
  21. Remember not to leak any information in the metadata that should be a secret. For example: keeping photographs of a protest confidential may not be enough for a user if the photo timestamp and geolocation make their attendance public.\n
  22. Remember not to leak any information in the metadata that should be a secret. For example: keeping photographs of a protest confidential may not be enough for a user if the photo timestamp and geolocation make their attendance public.\n
  23. Remember not to leak any information in the metadata that should be a secret. For example: keeping photographs of a protest confidential may not be enough for a user if the photo timestamp and geolocation make their attendance public.\n
  24. Remember not to leak any information in the metadata that should be a secret. For example: keeping photographs of a protest confidential may not be enough for a user if the photo timestamp and geolocation make their attendance public.\n
  25. \n
  26. \n
  27. \n
  28. The point of the HMAC is to provide integrity checking. There&amp;#x2019;s no real attack against AES in the case of tampered ciphertext - you can replace real data with garbage, but you can&amp;#x2019;t replace real data with other real data. The point of this HMAC is that it&amp;#x2019;s the quickest way to verify that the key was recovered correctly.\n
  29. Notice that this is one of two choices: PKCS#7 padding is the other option.\n
  30. \n