This document discusses common security anti-patterns and cargo cult programming practices related to cryptography. It describes how using cryptographic primitives incorrectly or for the wrong purposes can significantly weaken security. For example, using non-cryptographic random number generators, reusing initialization vectors, or rolling your own encryption when libraries are available. The document advocates identifying true security goals, using the correct cryptographic primitive, and relying on proven libraries instead of writing custom crypto code whenever possible.

1. Cargo Cult Security
- Utah Java User Group 2015
https://github.com/disaacson/cargo-cult-security
by Derrick Isaacson

2. http://en.wikipedia.org/wiki/Cargo_cult

3. Richard Feynman

4. Cargo Cult Programming
Ritualistic inclusion of code or patterns that are
unnecessary for the task at hand.
• Design patterns
• Factory
• Wrapper
• Dependency injection
• Cryptography
• Encryption
• Hashing

5. The Big Picture

6. Crypto Primitives & Goals
Hash MAC
HMAC
Symmetric
Key Crypto
Asymmetric
Key Crypto
Digital
Signature
Digital
Certificates
Data Integrity
Data
Authentication
Non-repudiation
Confidentiality
Trust

7. Classic Encryption
Hash MAC
HMAC
Symmetric
Key Crypto
Asymmetric
Key Crypto
Digital
Signature
Digital
Certificates
Data Integrity
Data
Authentication
Non-repudiation
Confidentiality
Trust

8. PlaintextCiphertext Cipher

9. Symmetric Key
Cryptography
(Private-key Cryptography)
• Blowfish
• Twofish
• Serpent
• AES (Rijndael)
• CAST5
• RC4
• 3DES
• IDEA
HTTPS (TLS)
SSH (SSL)
LUKS Disk Encryption
KeePass

10. Anti-pattern: Authentication
/private_image?secure_id=573146feb41e

11. Anti-pattern: Authentication
/private_image?secure_id=573146feb41e
import javax.crypto.*
public static String getPrivateURL(String plainTextId) {
Cipher cipher = Cipher.getInstance("Blowfish/OFB/NoPadding");
cipher.init(Cipher.ENCRYPT_MODE, key, initVector);
byte[] cipherBytes = cipher.doFinal(plainTextId.getBytes());
return bytesToHex(cipherBytes);
}
String plainTextId = "100000";
String cipherTextId = Auth.getPrivateURL(plainTextId);

12. /private_image?secure_id=573146feb41e
public static String getSecretImg(String cipherTextId) {
cipher = Cipher.getInstance("Blowfish/OFB/NoPadding");
cipher.init(Cipher.DECRYPT_MODE, key, initVector);
byte[] plainBytes =
cipher.doFinal(hexToBytes(cipherTextId));
String plainTextId = new String(plainBytes, "UTF-8");
return getImage(plainTextId);
}
573146feb41e
100000
Team Photo

13. /private_image?secure_id=573146feb41e
/private_image?secure_id=573146feb41f
public static String getSecretImg(String cipherTextId) {
cipher = Cipher.getInstance("Blowfish/OFB/NoPadding");
cipher.init(Cipher.DECRYPT_MODE, key, initVector);
byte[] plainBytes =
cipher.doFinal(hexToBytes(cipherTextId));
String plainTextId = new String(plainBytes, "UTF-8");
return new String(plainBytes, "UTF-8");
}
573146feb41f
100001
Attack Plan

14. Crypto Primitives & Goals
Hash MAC
HMAC
Symmetric
Key Crypto
Asymmetric
Key Crypto
Digital
Signature
Digital
Certificates
Data Integrity
Data
Authentication
Non-repudiation
Confidentiality
Trust

15. Message Authentication Codes
HMAC(key, message)
HMAC: RFC 2104
• HMAC-MD5
• HMAC-SHA1
• HMAC-SHA256
Message MAC

16. HMAC
SecretKeySpec signingKey =
new SecretKeySpec(key.getBytes(), "HmacSHA1");
Mac mac = Mac.getInstance("HmacSHA1");
mac.init(signingKey);
byte[] hmacBytes = mac.doFinal(message.getBytes());
return bytesToHex(hmacBytes);

17. Anti-pattern: Authentication 2
/private_image?user_id=3d90e
http://aes.online-domain-tools.com/
224 search space with a valid URL density of
1
16,777
String plainTextId = “834";
String cipherTextId = Auth.getPrivateURL(plainTextId);
public static String getPrivateURL(String plainTextId) {
Cipher cipher = Cipher.getInstance("Blowfish/OFB/NoPadding");
cipher.init(Cipher.ENCRYPT_MODE, key, initVector);
byte[] cipherBytes = cipher.doFinal(plainTextId.getBytes());
return bytesToHex(cipherBytes);
}

18. Crypto Primitives & Goals
Hash MAC
HMAC
Symmetric
Key Crypto
Asymmetric
Key Crypto
Digital
Signature
Digital
Certificates
Data Integrity
Data
Authentication
Non-repudiation
Confidentiality
Trust

19. Anti-pattern: Bank Deposit

20. cipher = Cipher.getInstance(“AES/CBC/NoPadding");
…
return cipher.doFinal(plainText.getBytes());
msg[45] = (byte)(msg[45] ^ “0".getBytes()[0] ^ "t".getBytes()[0]);
cipher = Cipher.getInstance(“AES/CBC/NoPadding");
…
return cipher.doFinal(cipherText);

21. Or…
Replay it 1000 times

22. Crypto Primitives & Goals
Hash MAC
HMAC
Symmetric
Key Crypto
Asymmetric
Key Crypto
Digital
Signature
Digital
Certificates
Data Integrity
Data
Authentication
Non-repudiation
Confidentiality
Trust

23. Encryption Parameters
Cipher (AES, Blowfish, …)
Secret key
Data to encrypt
CBC, ECB, OFB, …
Initialization Vector
Cipher cipher = Cipher.getInstance(“AES/ECB/NoPadding");
cipher.init(Cipher.ENCRYPT_MODE, key, initVector);

24. Anti-pattern: Encryption Modes
cipher = Cipher.getInstance(“AES/ECB/NoPadding");

26. Cipher-block Chaining Mode
cipher = Cipher.getInstance(“AES/CBC/NoPadding");

27. Encryption Parameters
Cipher (AES, Blowfish, …)
Secret key
Data to encrypt
CBC, ECB, OFB, …
Initialization Vector
Cipher cipher = Cipher.getInstance(“AES/ECB/NoPadding");
cipher.init(Cipher.ENCRYPT_MODE, key, initVector);

28. May 20th 1942
Message intercepted
Island “AF”
June 3rd 1942
Battle of Midway

29. Anti-pattern: Initialization Vector
plainText = “Hold";
cryptText = cipher.doFinal(plainText.getBytes());
• Monday: “a8b8f95c4684b3f3”
• Tuesday: “a8b8f95c4684b3f3”
• Wednesday: “a8b8f95c4684b3f3”
• Thursday: “a8b8f95c4684b3f3”
• Friday: “10f32c937a1284db”

30. Modes and IVs
• Cipher-block chaining prevents patterns within messages
• Correct IV prevents patterns across messages

31. Generating Keys & Initialization Vectors
key = “koicy37m8ao2nl07";
iv = new java.util.Random().nextLong();
• How many bits of key entropy can be contained in 16 alphanumeric characters?
• 96 bits
• ~0.00000002% of possible search space
• What initialization vector is really used here?
• “0000000000000000”!
• Warning: The IV parameter must be as long as the blocksize in …
• Use
• javax.crypto
• SecretKey key = KeyGenerator.getInstance("AES").generateKey();
• IvParameterSpec iv = new
javax.crypto.spec.IvParameterSpec(secureRandBytes);

32. Anti-pattern: Random Values
<form action="">
<label>Donation amount</label>
<input type="text" value="10.00">
<%
Long csrfToken = new java.lang.Random().nextLong();
setCookie("csrfToken", csrfToken);
print(String.format("<input type="hidden" value=%s">“,
csrfToken);
%>
<input type="submit" value="Submit">
</form>

33. Finding Linear Congruential Seed
Random random = new Random();
long v1 = random.nextInt();
long v2 = random.nextInt();
for (int i = 0; i < 65536; i++) {
long seed = v1 * 65536 + i;
if (((seed * multiplier + addend) & mask) >>> 16) == v2)
{
System.out.println("Seed found: " + seed);
break;
}
}

34. Anti-pattern: Psuedo-random
Session IDs
<%
uid = "12345678";
sessionId = md5(uid + rand.nextLong() + System.currentTimeMillis());
setCookie(“session_id", sessionId);
%>
Really < 20 bits of entropy.
A modern GPU can calculate that in a second!9,12

35. HMACs and Secure Random
<form action="">
<label>Donation amount</label>
<input type="text" value="10.00">
<%
Long csrfToken = new java.security.SecureRandom().nextLong();
setCookie("csrfToken", csrfToken);
print(String.format("<input type="hidden" value=%s">“, csrfToken));
%>
<input type="submit" value="Submit">
</form>
Do not use sessions! Use HMACs!
Seriously.

36. No Cargo Cult Security!
1. Identify true security goal.
2. Find correct crypto primitive.
3. Spend some time to learn about it.
4. Write as little of your own crypto code as possible.

37. Crypto Primitives & Goals
Hash MAC
HMAC
Symmetric
Key Crypto
Asymmetric
Key Crypto
Digital
Signature
Digital
Certificates
Data Integrity
Data
Authentication
Non-repudiation
Confidentiality
Trust

38. Crypto Primitives & Goals
Hash MAC
HMAC
Symmetric
Key Crypto
Asymmetric
Key Crypto
Digital
Signature
Digital
Certificates
Data Integrity
Data
Authentication
Non-repudiation
Confidentiality
Trust

39. Questions?
derrick@lucidchart.com
https://github.com/disaacson/cargo-cult-security

40. References
1. http://en.wikipedia.org/wiki/Cargo_cult
2. http://neurotheory.columbia.edu/~ken/cargo_cult.html
3. http://en.wikipedia.org/wiki/Post_hoc_ergo_propter_hoc
4. http://en.wikipedia.org/wiki/Cargo_cult_programming
5. http://www.slideshare.net/javagroup2006/data-security-essentials-java-one-2013
6. http://www.scs.stanford.edu/10au-cs144/notes/
7. http://resources.infosecinstitute.com/cbc-byte-flipping-attack-101-approach/
8. http://security.stackexchange.com/questions/18033/how-insecure-are-phps-rand-functions
9. http://crypto.di.uoa.gr/CRYPTO.SEC/Randomness_Attacks_files/paper.pdf
10. http://security.stackexchange.com/questions/17988/how-insecure-are-non-cryptographic-random-number-generators
11. http://jazzy.id.au/default/2010/09/20/cracking_random_number_generators_part_1.html
12. http://thepasswordproject.com/oclhashcat_benchmarking
13. http://www.php.net/manual/en/function.openssl-random-pseudo-bytes.php
14. http://blowfish.online-domain-tools.com/
15. https://github.com/disaacson/cargo-cult-security
16. http://tools.ietf.org/html/rfc2104