Anastasia Vixentael - Don't Waste Time on Learning Cryptography: Better Use It Properly
Report
OWASP KyivFollow
OWASP KyivMar. 4, 2018•0 likes•693 views
Anastasia Vixentael - Don't Waste Time on Learning Cryptography: Better Use It Properly
Mar. 4, 2018•0 likes•693 views
Download to read offline
Report
Technology
Anastasia Vixentael - Don't Waste Time on Learning Cryptography: Better Use It Properly
OWASP KyivFollow
OWASP KyivRecommended
Avoiding damage, shame and regrets data protection for mobile client-server a...Stanfy
LambHack: A Vulnerable Serverless ApplicationJames Wickett
DevSecCon Singapore 2018 - Maginot Line – 6 Common AppSec Anti-Patterns Preve...DevSecCon
OSX/Pirrit: The blue balls of OS X adwareAmit Serper
OWASP Poland Day 2018 - Frans Rosen - Attacking modern web technologiesOWASP
REST API Pentester's perspectiveSecuRing
More Related Content
Slideshows for you
New Farming Methods in the Epistemological Wasteland of Application SecurityJames Wickett
Hunting for the secrets in a cloud forestSecuRing
Testing iOS apps without jailbreak in 2018SecuRing
Batten Down the Hatches: A Practical Guide to Securing Kubernetes - RMISC 2019Lacework
Automated Infrastructure Security: Monitoring using FOSSSonatype
Prepare to defend thyself with Blue/GreenSonatype
![[CB16] Facebook Malware: Tag Me If You Can by Ido Naor & Dani Goland](https://cdn.slidesharecdn.com/ss_thumbnails/cb16idoen-161109041834-thumbnail.jpg?width=2048&height=1162&fit=bounds)
Similar to Anastasia Vixentael - Don't Waste Time on Learning Cryptography: Better Use It Properly
The Emergent Cloud Security Toolchain for CI/CDJames Wickett
Anastasiia Vixentael: 10 things you need to know before implementing cryptogr...mdevtalk
How to hide your browser 0-daysZoltan Balazs
Threat stack awsJen Andre
The Razors Edge - Cutting your TLS BaggageJan Schaumann
Anatomy of Java Vulnerabilities - NLJug 2018Steve Poole
Similar to Anastasia Vixentael - Don't Waste Time on Learning Cryptography: Better Use It Properly(20)
More from OWASP Kyiv
Is there a penetration testing within PCI DSS certification? (Dmytro Diordiyc...OWASP Kyiv
Software Supply Chain Security та компоненти з відомими вразливостямиOWASP Kyiv
Cloud Security Hardening та аудит хмарної безпеки за допомогою Scout SuiteOWASP Kyiv
Threat Modeling with OWASP Threat DragonOWASP Kyiv
Vlad Styran - Cyber Security Economics 101OWASP Kyiv
Pavlo Radchuk - OWASP SAMM: Understanding Agile in SecurityOWASP Kyiv
Recently uploaded
Artificial Intelligence (AI).pptxSharifulShishir
GDSC23 - Info Session GDSC KIET (1).pptxSnehaAggarwal40
Common - Concerns Around OpenAI.pptxAlok Ranjan
Daily Scrum, Sprint Review & Retrospective.pptxMd. Rakib Trofder
AI and ML Series - Generative Extraction and Classification of Documents in S...DianaGray10
Mitigating Common CloudStack Instance Deployment FailuresShapeBlue
Anastasia Vixentael - Don't Waste Time on Learning Cryptography: Better Use It Properly
- DON’T WASTE TIME ON LEARNING CRYPTOGRAPHY: BETTER USE IT PROPERLY #owaspkyiv @vixentael
- @vixentael Product Engineer Feel free to reach me with any mobile security questions. I do check my inbox :)
- We want to protect our users’ data
- We want developers to protect data
- We want to protect our users’ data HOW? We want developers to protect data
- WE HAVE USER DATA. WHAT SHALL WE DO?
- #owaspkyiv @vixentael 1. DEFINING THE DATA SCOPE sensitive user data GDPR / HIPAA / PCI DSS tech data (keys, logs)
- #owaspkyiv @vixentael 1. DEFINING THE DATA SCOPE sensitive user data GDPR / HIPAA / PCI DSS tech data (keys, logs) mistake 1. wrong scope definition
- #owaspkyiv @vixentael 2. SELECTING ALGORITHM twofish sha1 des md5
- twofish sha1 des md5 #owaspkyiv @vixentael 2. SELECTING ALGORITHM mistake 2. bad algo selection
- #owaspkyiv @vixentael THINGS TO DECIDE ON KEY LENGTHDATA SCOPE ALGORITHM
- #owaspkyiv @vixentaelhttps://wiki.openssl.org/index.php/EVP_Symmetric_Encryption_and_Decryption 3. USING ALGORITHM
- #owaspkyiv @vixentaelhttps://wiki.openssl.org/index.php/EVP_Symmetric_Encryption_and_Decryption 3. USING ALGORITHM
- #owaspkyiv @vixentaelhttps://wiki.openssl.org/index.php/EVP_Symmetric_Encryption_and_Decryption 3. USING ALGORITHM mistake 3. wrong params
- #owaspkyiv @vixentael THINGS TO DECIDE ON PADDING KEY LENGTH MODE DATA SCOPE ALGORITHM IV
- #owaspkyiv @vixentael 4. KEY MANAGEMENT user password keys KDF
- #owaspkyiv @vixentael 4. KEY MANAGEMENT user password keys KDF mistake 4. bad key management
- #owaspkyiv @vixentael THINGS TO DECIDE ON PADDING KEY LENGTH KEY ROTATION MODE KEY DERIVATION KEY STORAGE KEY EXCHANGE DATA SCOPE ALGORITHM IV KEY REVOCATION
- #owaspkyiv @vixentael 5. INFRASTRUCTURE
- #owaspkyiv @vixentael PADDING KEY LENGTH KEY ROTATION MODE KEY DERIVATION KEY STORAGE THINGS TO DECIDE ON KEY EXCHANGE BACKUPSPLATFORMS DATA SCOPE ALGORITHM IV KEY REVOCATION
- #owaspkyiv @vixentaelhttps://pdos.csail.mit.edu/papers/cryptobugs:apsys14.pdf 269 CVEs from 2011-2014 17% 83% bugs inside crypto libs misuses of crypto libs by individual apps
- AS USERS WE WANT… more ciphers? #owaspkyiv @vixentael
- AES DES 3DES CBC CFB SEAL Salsa20 RSA DSA #owaspkyiv @vixentael
- AES DES 3DES CBC CFB SEAL Salsa20 RSA DSA OFB SHARK RC4 DSS ECB CTR SEED #owaspkyiv @vixentael Blowfish
- AES DES 3DES CBC CFB SEAL Salsa20 RSA DSA OFB Blowfish SHARK RC4 DSS ECB CTR Twofish Camelia SEED Rabbit ECDSA #owaspkyiv @vixentael
- AS USERS WE WANT… more ciphers! more vulnerabilities! more side channel attacks! more attacks! more constant time checks :) more protocols! more patches! #owaspkyiv @vixentael
- EXCITING, BUT FOR CRYPTO RESEARCHERS ONLY
- AS USERS WE WANT… more ciphers! BORING CRYPTO #owaspkyiv @vixentael
- BORING CRYPTO #owaspkyiv @vixentael — crypto that simply works, solidly resists attacks, never needs any upgrades https://cr.yp.to/talks/2015.10.05/slides-djb-20151005-a4.pdf Daniel J. Bernstein
- BORING CRYPTO #owaspkyiv @vixentael PLUG & PLAY
- WHAT DO WE WANT? instead of adjusting our resources — SOLVE USE-CASES!
- WHAT DO WE WANT? — HIGH-LEVEL FUNCTIONS I want to store data securely I want to send data securely I want to verify data integrity #owaspkyiv @vixentael
- WHAT DO WE WANT? store data securely send data securely verify data integrity key derivation key exchange key rotation sign/verify ephemeral keys encr / decr #owaspkyiv @vixentael — HIGH-LEVEL FUNCTIONS
- NOBODY READS DOCS #owaspkyiv @vixentael
- NOBODY READS DOCS #owaspkyiv @vixentael “docs are for experts” “I just want to try” “gimme code!”
- 1. HOW TO START? #owaspkyiv @vixentael pod try BoringSSL cmake -DANDROID_ABI=armeabi-v7a -DCMAKE_TOOLCHAIN_FILE=../third_party/ android-cmake/android.toolchain.cmake -DANDROID_NATIVE_API_LEVEL=16 -GNinja .. https://boringssl.googlesource.com/boringssl/+/HEAD/BUILDING.md
- #owaspkyiv @vixentael easy, architecture-independent installation 1. HOW TO START?
- 2. SUPPORTED PLATFORMS? #owaspkyiv @vixentael *nix OSX web browsers embedded iOS Android Windows minimum expected:
- #owaspkyiv @vixentael cross-platform is not an option anymore cross-platform is a must have 2. SUPPORTED PLATFORMS?
- OPTIONS WE HAVE
- #owaspkyiv @vixentael HSM
- #owaspkyiv @vixentael HARDWARE SECURITY MODULE key generation provides cryptoprocessing key storage portable
- #owaspkyiv @vixentael TRUSTED PLATFORM MODULE key management disk protection trust anchor built-in remote attestation provides cryptoprimitives
- #owaspkyiv @vixentael HSM & TPM: PROS fast hardware crypto! trusted environment known security guarantees keys calculations
- #owaspkyiv @vixentael HSM & TPM: CONS vendor lock / vendor trust bad for interactive encryption complicated to maintain (install, upgrade, support, not cross-platform)
- #owaspkyiv @vixentael HSM & TPM: PRO & CONS HSM app plaintext data plaintext data is far away from the place it is used
- #owaspkyiv @vixentael SOFTWARE CRYPTO SYSTEMS https://github.com/sobolevn/awesome-cryptography any kind of encryption plaintext data is closer to its usage cross-platform
- #owaspkyiv @vixentael SOFTWARE CRYPTO SYSTEMS https://github.com/sobolevn/awesome-cryptography any kind of encryption plaintext data is closer to its usage cross-platform NO DEVICE TRUST
- #owaspkyiv @vixentael WEBBROWSER CRYPTO: CONS DOM, XSS, NO CODE TRUST
- #owaspkyiv @vixentael HSM/TPM + SOFTWARE CS keys calculations TPM / HSM own software cross-platform take best from both
- #owaspkyiv @vixentael cross-platform easy to install easy to use USING CRYPTO SHOULD BE LIKE.. audited open source time proven well-documented
- #owaspkyiv @vixentael crypto-libs crypto-systems boxed solutions
- #owaspkyiv @vixentael 1. CRYPTO-LIBS libsodium themis https://github.com/sobolevn/awesome-cryptography implements single or multiple security functions keyczar noise
- #owaspkyiv @vixentael EXAMPLE https://github.com/cossacklabs/themis/wiki/Python-Howto secure messaging with forward secrecy
- #owaspkyiv @vixentael 2. CRYPTO-SYSTEMS axolotl hermes combines security functions for solving exact use-case SSL/TLS ZeroKit
- #owaspkyiv @vixentael EXAMPLE https://github.com/cossacklabs/hermes-core/wiki/Python-tutorial data access control based on crypto-keys python docs/examples/python/hermes_client.py --id user1 --config=docs/examples/python/config.json --private_key user1.priv --doc testfile --read
- #owaspkyiv @vixentael 3. BOXED SOLUTIONS truecrypt ssh acra vault unites crypto-systems and user functions for solving problems
- #owaspkyiv @vixentael EXAMPLE https://github.com/cossacklabs/acra/wiki/Trying-Acra-with-Docker database proxy for encrypting / decrypting go run cmd/acra_genkeys/acra_genkeys.go docker-compose -f docker/docker-compose.yml up -d
- #owaspkyiv @vixentael CAN I SOLVE MY USE-CASE USING… boxed solutions
- #owaspkyiv @vixentael CAN I SOLVE MY USE-CASE USING… crypto-systems boxed solutions no :(
- #owaspkyiv @vixentael CAN I SOLVE MY USE-CASE USING… crypto-libs crypto-systems boxed solutions no :( no :(
- https://www.cossacklabs.com/choose-your-ios-crypto.html
- THE WORLD DOESN’T HAVE A PROBLEM WITH NEW CRYPTO-ALGORITHMS.
- THE WORLD DOESN’T HAVE A PROBLEM WITH NEW CRYPTO-ALGORITHMS. PROBLEM IS THAT THEY ARE NOT BORING ENOUGH
- #owaspkyiv @vixentael
- #owaspkyiv @vixentael VS
- #owaspkyiv @vixentael make the light controllable
- #owaspkyiv @vixentael
- #owaspkyiv @vixentael make the crypto security controllable
- #owaspkyiv @vixentael make the crypto security controllable and booooring
- #owaspkyiv @vixentael
- LINKS 1 Boring crypto, Daniel J. Bernstein https://cr.yp.to/talks/2015.10.05/slides-djb-20151005-a4.pdf Why does cryptographic software fail? https://pdos.csail.mit.edu/papers/cryptobugs:apsys14.pdf API design for cryptography https://2017.hack.lu/archive/2017/hacklu-crypto-api.pdf
- LINKS 2 Encrypting strings in Android: Let’s make better mistakes https://tozny.com/blog/encrypting-strings-in-android-lets-make-better-mistakes/ Awesome crypto papers https://github.com/pFarb/awesome-crypto-papers 12 And 1 Ideas How To Enhance Backend Data Security https://www.cossacklabs.com/backend-data-security-modern-ideas.html Attestation and Trusted Computing https://courses.cs.washington.edu/courses/csep590/06wi/finalprojects/bare.pdf
- MY OTHER SECURITY SLIDES https://github.com/ vixentael/my-talks …and more
- @vixentael Product Engineer Feel free to reach me with any mobile security questions. I do check my inbox :)