- The document discusses cryptographic storage for smartphone data, specifically the aescrypt format and software which allows encrypted storage of secret files on phones and across backups. - Aescrypt uses a randomly generated initialization vector and password hashes to encrypt the bulk of files with AES-256, and includes metadata and integrity checks without revealing secret information. - The key derived from hashing the password is used to encrypt an actual encryption key, to provide an additional layer of protection in case the derived key is compromised.

2. Cryptographic storage
for people in a hurry
Graham Lee
Smartphone security boffin, Fuzzy Aliens Ltd.
fuzzyaliens.com

3. Cryptographic storage
for people in a hurry
Graham Lee
Smartphone security boffin, Fuzzy Aliens Ltd.

4. From App to Crap

5. From App to Crap

6. Nut[the problem]shell

7. Nut[the problem]shell
• Want to store data

8. Nut[the problem]shell
• Want to store data
• But it must be secret

9. Nut[the problem]shell
• Want to store data
• But it must be secret
• if the phone is stolen

10. Nut[the problem]shell
• Want to store data
• But it must be secret
• if the phone is stolen
• if the iTunes backup is stolen

11. Nut[the problem]shell
• Want to store data
• But it must be secret
• if the phone is stolen
• if the iTunes backup is stolen
• It must be tamper-proof

12. Nut[the problem]shell
• Want to store data
• But it must be secret
• if the phone is stolen
• if the iTunes backup is stolen
• It must be tamper-proof
• …to some extent

13. Solution: aescrypt

14. Solution: aescrypt
• Unencumbered (public domain) format and
freeware implementation at http://
aescrypt.org

15. Solution: aescrypt
• Unencumbered (public domain) format and
freeware implementation at http://
aescrypt.org
• Not just you using it

16. Solution: aescrypt
• Unencumbered (public domain) format and
freeware implementation at http://
aescrypt.org
• Not just you using it
• Mac, iOS, more

17. Solution: aescrypt
• Unencumbered (public domain) format and
freeware implementation at http://
aescrypt.org
• Not just you using it
• Mac, iOS, more
• Let’s start at byte 0 :-)

18. ‘AES0020’
• Magic number
• Tells you the version of the crypto format

19. Meet a Data

22. Metadata

23. Metadata
• Arbitrary ‘extensions’ section

24. Metadata
• Arbitrary ‘extensions’ section
• Creator ID, creation date…

25. Metadata
• Arbitrary ‘extensions’ section
• Creator ID, creation date…
• …as long as that stuff isn’t a secret

26. What’s our vector,
Victor?
// We will use an initialization vector comprised of the
current time
// process ID, and random data, all hashed together
with SHA-256.
source: wikipedia

27. You can’t come in here unless
you say “Swordfish”
// Hash the IV and password 8192 times
memset(digest, 0, 32);
memcpy(digest, IV, 16);
for(i=0; i<8192; i++)
{
sha256_starts( &sha_ctx);
sha256_update( &sha_ctx, digest, 32);
sha256_update( &sha_ctx,
(unsigned char*)passwd,
(unsigned long)passlen);
sha256_finish( &sha_ctx,
digest);
}

28. Cutty say 'e can't HANG!

29. Cutty say 'e can't HANG!
• The key we just derived is not used to
encrypt the plaintext file
• Instead, it’s used to encrypt a key, which is
itself used to encrypt the file.
• …why?

30. Irony: Eminem tribute act
singing “the real slim shady”
…
16 Octets - Initialization Vector (IV) used for encrypting the
IV and symmetric key that is actually used to encrypt
the bulk of the plaintext file.
48 Octets - Encrypted IV and 256-bit AES key used to encrypt the
bulk of the file
16 octets - initialization vector
32 octets - encryption key
32 Octets - HMAC
nn Octets - Encrypted message (2^64 octets max)
1 Octet - File size modulo 16 in least significant bit positions
32 Octets - HMAC
…

31. Filler material
…
16 Octets - Initialization Vector (IV) used for encrypting the
IV and symmetric key that is actually used to encrypt
the bulk of the plaintext file.
48 Octets - Encrypted IV and 256-bit AES key used to encrypt the
bulk of the file
16 octets - initialization vector
32 octets - encryption key
32 Octets - HMAC
nn Octets - Encrypted message (2^64 octets max)
1 Octet - File size modulo 16 in least significant bit positions
32 Octets - HMAC
…

32. To the Question Pit!
@iamleeg

33. To the Question Pit!
@iamleeg
fuzzyaliens.com