Using Git and GitHub Effectively at Emerge InteractiveMatthew McCullough
Matthew presented on some lesser-known Git and GitHub tactics at Emerge Interactive in Portland, OR on 2012-09-04.
Detailed notes are in a Gist on GitHub: https://gist.github.com/gists/3642254
Delivered on September 4, 2012
Pull Requests are a core part of the GitHub site and many modern Git version control workflows. This free class given by Matthew McCullough of GitHub provides a demo-centric review of Pull Request use and positive co-behavioral impacts.
A presentation given at UberConf 2012 in Broomfield, Colorado, USA.
Further game theory resources an be found at https://gist.github.com/matthewmccullough/2721876 and http://ambientideas.com/blog/index.php/2011/04/game-theory-and-softwaredev/
If you've worked with Git long enough to wish you could modify the history of a repository, this talk is for you. Git's filter-branch command lets you re-write history in an automated way, changing usernames, removing certain commits, or restructuring repositories to have nested folders become the top level folder for potential use as submodules.
Delivered on June 25, 2012
Git is a version control system. We can look at it from that high level. Git is a content tracking system. Some teachers advise us to look at it from that lowered elevation. But I will take you to the very bottom. The floor. The code. The algorithms. The directed acyclic graph of hashed bit sequences made efficient through LZW compression and deferred garbage collection determined by node reachability via hash relationships.
“But why?”, you may ask. “Why go this deep?”" Git is a tool that works so well for so many. It mystically corrects anticipated `merge` conflicts. It’s “where did code come from” results from `blame` are impressive. The ability to re-write history through `rebase` is awesome. The globally unique identifier nature of a hash-produced ref is revolutionary.
Uber-geeks are magic-slayers. We want and need to know precisely how things work. Like a hard 50 push-up workout, this study will make working with Git at the daily developer level a fraction of the effort — like a mere ten push-ups. Join Matthew McCullough of GitHub and let’s dig into the guts of Git.
Delivered on June 17, 2012
Matthew McCullough of GitHub presented on why Java developers have so many reasons to explore Git and Git, including productivity gains, easy OSS contributions, the eGit Eclipse plugin, and JGit, the underlying Java cleanroom implementation that powers https://android.googlesource.com.
Delivered on June 9, 2012
Using Git and GitHub Effectively at Emerge InteractiveMatthew McCullough
Matthew presented on some lesser-known Git and GitHub tactics at Emerge Interactive in Portland, OR on 2012-09-04.
Detailed notes are in a Gist on GitHub: https://gist.github.com/gists/3642254
Delivered on September 4, 2012
Pull Requests are a core part of the GitHub site and many modern Git version control workflows. This free class given by Matthew McCullough of GitHub provides a demo-centric review of Pull Request use and positive co-behavioral impacts.
A presentation given at UberConf 2012 in Broomfield, Colorado, USA.
Further game theory resources an be found at https://gist.github.com/matthewmccullough/2721876 and http://ambientideas.com/blog/index.php/2011/04/game-theory-and-softwaredev/
If you've worked with Git long enough to wish you could modify the history of a repository, this talk is for you. Git's filter-branch command lets you re-write history in an automated way, changing usernames, removing certain commits, or restructuring repositories to have nested folders become the top level folder for potential use as submodules.
Delivered on June 25, 2012
Git is a version control system. We can look at it from that high level. Git is a content tracking system. Some teachers advise us to look at it from that lowered elevation. But I will take you to the very bottom. The floor. The code. The algorithms. The directed acyclic graph of hashed bit sequences made efficient through LZW compression and deferred garbage collection determined by node reachability via hash relationships.
“But why?”, you may ask. “Why go this deep?”" Git is a tool that works so well for so many. It mystically corrects anticipated `merge` conflicts. It’s “where did code come from” results from `blame` are impressive. The ability to re-write history through `rebase` is awesome. The globally unique identifier nature of a hash-produced ref is revolutionary.
Uber-geeks are magic-slayers. We want and need to know precisely how things work. Like a hard 50 push-up workout, this study will make working with Git at the daily developer level a fraction of the effort — like a mere ten push-ups. Join Matthew McCullough of GitHub and let’s dig into the guts of Git.
Delivered on June 17, 2012
Matthew McCullough of GitHub presented on why Java developers have so many reasons to explore Git and Git, including productivity gains, easy OSS contributions, the eGit Eclipse plugin, and JGit, the underlying Java cleanroom implementation that powers https://android.googlesource.com.
Delivered on June 9, 2012
Learn how to use searching, logging, bisecting and pick-axing in Git.
Command history for this event is published at https://gist.github.com/2579381
Delivered on May 2nd, 2012
A Boulder private-event presentation that will additionally be given at DOSUG. Covers the basics of Git tooling, techniques, and the GitHub platform.
Delivered on April 30, 2012
Git is a compelling version control system, but it is useful to talk about it in the context of a destination, made possible by migration tools from previous version control systems like Subversion. This talk offers a set of motivations, tools, and techniques on the Subversion to Git and GitHub migration process.
Delivered on April 21, 2012
Git has a little used feature called Notes that is an excellent support to traditional commit messages. Not surprisingly, this feature also has a great visual rendering on the GitHub.com site when Notes are pushed to a Git repository.
Build Lifecycle Craftsmanship for the Transylvania JUGMatthew McCullough
Matthew McCullough presenting Build Lifecycle Craftsmanship to the Transylvania Java Users Group in October of 2011.
Resources that correspond to this presentation are include:
Maven:
http://delicious.com/matthew.mccullough/maven
https://github.com/matthewmccullough/opensourcedebuggingjava
Gradle:
http://delicious.com/matthew.mccullough/gradle
https://github.com/gradle/
https://github.com/gradleware/oreilly-gradle-book-examples
Sonar:
http://delicious.com/matthew.mccullough/sonar
http://sonarsource.org
BTrace:
http://kenai.com/projects/btrace
VisualVM:
http://visualvm.java.net/
Overarching examples:
https://github.com/matthewmccullough/opensourcedebuggingjava
Delivered on October 20, 2011
Game Theory for Software Developers at the Boulder JUGMatthew McCullough
Game Theory, a segment of economics, can effectively be applied to software development for achieving better financial and decision making outcomes.
Delivered on October 13, 2011
Acetabularia Information For Class 9 .docxvaibhavrinwa19
Acetabularia acetabulum is a single-celled green alga that in its vegetative state is morphologically differentiated into a basal rhizoid and an axially elongated stalk, which bears whorls of branching hairs. The single diploid nucleus resides in the rhizoid.
Learn how to use searching, logging, bisecting and pick-axing in Git.
Command history for this event is published at https://gist.github.com/2579381
Delivered on May 2nd, 2012
A Boulder private-event presentation that will additionally be given at DOSUG. Covers the basics of Git tooling, techniques, and the GitHub platform.
Delivered on April 30, 2012
Git is a compelling version control system, but it is useful to talk about it in the context of a destination, made possible by migration tools from previous version control systems like Subversion. This talk offers a set of motivations, tools, and techniques on the Subversion to Git and GitHub migration process.
Delivered on April 21, 2012
Git has a little used feature called Notes that is an excellent support to traditional commit messages. Not surprisingly, this feature also has a great visual rendering on the GitHub.com site when Notes are pushed to a Git repository.
Build Lifecycle Craftsmanship for the Transylvania JUGMatthew McCullough
Matthew McCullough presenting Build Lifecycle Craftsmanship to the Transylvania Java Users Group in October of 2011.
Resources that correspond to this presentation are include:
Maven:
http://delicious.com/matthew.mccullough/maven
https://github.com/matthewmccullough/opensourcedebuggingjava
Gradle:
http://delicious.com/matthew.mccullough/gradle
https://github.com/gradle/
https://github.com/gradleware/oreilly-gradle-book-examples
Sonar:
http://delicious.com/matthew.mccullough/sonar
http://sonarsource.org
BTrace:
http://kenai.com/projects/btrace
VisualVM:
http://visualvm.java.net/
Overarching examples:
https://github.com/matthewmccullough/opensourcedebuggingjava
Delivered on October 20, 2011
Game Theory for Software Developers at the Boulder JUGMatthew McCullough
Game Theory, a segment of economics, can effectively be applied to software development for achieving better financial and decision making outcomes.
Delivered on October 13, 2011
Acetabularia Information For Class 9 .docxvaibhavrinwa19
Acetabularia acetabulum is a single-celled green alga that in its vegetative state is morphologically differentiated into a basal rhizoid and an axially elongated stalk, which bears whorls of branching hairs. The single diploid nucleus resides in the rhizoid.
June 3, 2024 Anti-Semitism Letter Sent to MIT President Kornbluth and MIT Cor...Levi Shapiro
Letter from the Congress of the United States regarding Anti-Semitism sent June 3rd to MIT President Sally Kornbluth, MIT Corp Chair, Mark Gorenberg
Dear Dr. Kornbluth and Mr. Gorenberg,
The US House of Representatives is deeply concerned by ongoing and pervasive acts of antisemitic
harassment and intimidation at the Massachusetts Institute of Technology (MIT). Failing to act decisively to ensure a safe learning environment for all students would be a grave dereliction of your responsibilities as President of MIT and Chair of the MIT Corporation.
This Congress will not stand idly by and allow an environment hostile to Jewish students to persist. The House believes that your institution is in violation of Title VI of the Civil Rights Act, and the inability or
unwillingness to rectify this violation through action requires accountability.
Postsecondary education is a unique opportunity for students to learn and have their ideas and beliefs challenged. However, universities receiving hundreds of millions of federal funds annually have denied
students that opportunity and have been hijacked to become venues for the promotion of terrorism, antisemitic harassment and intimidation, unlawful encampments, and in some cases, assaults and riots.
The House of Representatives will not countenance the use of federal funds to indoctrinate students into hateful, antisemitic, anti-American supporters of terrorism. Investigations into campus antisemitism by the Committee on Education and the Workforce and the Committee on Ways and Means have been expanded into a Congress-wide probe across all relevant jurisdictions to address this national crisis. The undersigned Committees will conduct oversight into the use of federal funds at MIT and its learning environment under authorities granted to each Committee.
• The Committee on Education and the Workforce has been investigating your institution since December 7, 2023. The Committee has broad jurisdiction over postsecondary education, including its compliance with Title VI of the Civil Rights Act, campus safety concerns over disruptions to the learning environment, and the awarding of federal student aid under the Higher Education Act.
• The Committee on Oversight and Accountability is investigating the sources of funding and other support flowing to groups espousing pro-Hamas propaganda and engaged in antisemitic harassment and intimidation of students. The Committee on Oversight and Accountability is the principal oversight committee of the US House of Representatives and has broad authority to investigate “any matter” at “any time” under House Rule X.
• The Committee on Ways and Means has been investigating several universities since November 15, 2023, when the Committee held a hearing entitled From Ivory Towers to Dark Corners: Investigating the Nexus Between Antisemitism, Tax-Exempt Universities, and Terror Financing. The Committee followed the hearing with letters to those institutions on January 10, 202
A Strategic Approach: GenAI in EducationPeter Windle
Artificial Intelligence (AI) technologies such as Generative AI, Image Generators and Large Language Models have had a dramatic impact on teaching, learning and assessment over the past 18 months. The most immediate threat AI posed was to Academic Integrity with Higher Education Institutes (HEIs) focusing their efforts on combating the use of GenAI in assessment. Guidelines were developed for staff and students, policies put in place too. Innovative educators have forged paths in the use of Generative AI for teaching, learning and assessments leading to pockets of transformation springing up across HEIs, often with little or no top-down guidance, support or direction.
This Gasta posits a strategic approach to integrating AI into HEIs to prepare staff, students and the curriculum for an evolving world and workplace. We will highlight the advantages of working with these technologies beyond the realm of teaching, learning and assessment by considering prompt engineering skills, industry impact, curriculum changes, and the need for staff upskilling. In contrast, not engaging strategically with Generative AI poses risks, including falling behind peers, missed opportunities and failing to ensure our graduates remain employable. The rapid evolution of AI technologies necessitates a proactive and strategic approach if we are to remain relevant.
Model Attribute Check Company Auto PropertyCeline George
In Odoo, the multi-company feature allows you to manage multiple companies within a single Odoo database instance. Each company can have its own configurations while still sharing common resources such as products, customers, and suppliers.
2024.06.01 Introducing a competency framework for languag learning materials ...Sandy Millin
http://sandymillin.wordpress.com/iateflwebinar2024
Published classroom materials form the basis of syllabuses, drive teacher professional development, and have a potentially huge influence on learners, teachers and education systems. All teachers also create their own materials, whether a few sentences on a blackboard, a highly-structured fully-realised online course, or anything in between. Despite this, the knowledge and skills needed to create effective language learning materials are rarely part of teacher training, and are mostly learnt by trial and error.
Knowledge and skills frameworks, generally called competency frameworks, for ELT teachers, trainers and managers have existed for a few years now. However, until I created one for my MA dissertation, there wasn’t one drawing together what we need to know and do to be able to effectively produce language learning materials.
This webinar will introduce you to my framework, highlighting the key competencies I identified from my research. It will also show how anybody involved in language teaching (any language, not just English!), teacher training, managing schools or developing language learning materials can benefit from using the framework.
Unit 8 - Information and Communication Technology (Paper I).pdfThiyagu K
This slides describes the basic concepts of ICT, basics of Email, Emerging Technology and Digital Initiatives in Education. This presentations aligns with the UGC Paper I syllabus.
Macroeconomics- Movie Location
This will be used as part of your Personal Professional Portfolio once graded.
Objective:
Prepare a presentation or a paper using research, basic comparative analysis, data organization and application of economic information. You will make an informed assessment of an economic climate outside of the United States to accomplish an entertainment industry objective.
Biological screening of herbal drugs: Introduction and Need for
Phyto-Pharmacological Screening, New Strategies for evaluating
Natural Products, In vitro evaluation techniques for Antioxidants, Antimicrobial and Anticancer drugs. In vivo evaluation techniques
for Anti-inflammatory, Antiulcer, Anticancer, Wound healing, Antidiabetic, Hepatoprotective, Cardio protective, Diuretics and
Antifertility, Toxicity studies as per OECD guidelines
A workshop hosted by the South African Journal of Science aimed at postgraduate students and early career researchers with little or no experience in writing and publishing journal articles.
Safalta Digital marketing institute in Noida, provide complete applications that encompass a huge range of virtual advertising and marketing additives, which includes search engine optimization, virtual communication advertising, pay-per-click on marketing, content material advertising, internet analytics, and greater. These university courses are designed for students who possess a comprehensive understanding of virtual marketing strategies and attributes.Safalta Digital Marketing Institute in Noida is a first choice for young individuals or students who are looking to start their careers in the field of digital advertising. The institute gives specialized courses designed and certification.
for beginners, providing thorough training in areas such as SEO, digital communication marketing, and PPC training in Noida. After finishing the program, students receive the certifications recognised by top different universitie, setting a strong foundation for a successful career in digital marketing.
26. Caesar Cipher
Z M S R
A N T S if encrypted with ROT(-1)
Sunday, April 25, 2010
27. Caesar Cipher
Z M S R
A N T S if encrypted with ROT(-1)
B O U T if encrypted with ROT(-2)
Sunday, April 25, 2010
28. /**
* A naively simple rotation cipher implementation.
* USAGE: groovy RotateWord.groovy <yourword>
*/
public class RotateWord {
/**
* Rotate one character by the specified amount
*/
private static char rotateChar(char c, int rotationAmount) {
//a == 97, z == 122
int num = (int)c
int rotated = num + rotationAmount
int adjusted
//Handle roll-around wrapping
Sunday, April 25, 2010
29. /**
* A naively simple rotation cipher implementation.
* USAGE: groovy RotateWord.groovy <yourword>
*/
public class RotateWord {
/**
* Rotate one character by the specified amount
*/
private static char rotateChar(char c, int rotationAmount) {
//a == 97, z == 122
int num = (int)c
int rotated = num + rotationAmount
int adjusted
//Handle roll-around wrapping
if (rotated > 122)
adjusted = rotated - 26
else if (rotated < 97)
adjusted = rotated + 26
else
adjusted = rotated
Sunday, April 25, 2010
30. public class RotateWord {
/**
* Rotate one character by the specified amount
*/
private static char rotateChar(char c, int rotationAmount) {
//a == 97, z == 122
int num = (int)c
int rotated = num + rotationAmount
int adjusted
//Handle roll-around wrapping
if (rotated > 122)
adjusted = rotated - 26
else if (rotated < 97)
adjusted = rotated + 26
else
adjusted = rotated
char adjustedChar = (char)adjusted
return adjustedChar
}
/**
Sunday, April 25, 2010
31. private static char rotateChar(char c, int rotationAmount) {
//a == 97, z == 122
int num = (int)c
int rotated = num + rotationAmount
int adjusted
//Handle roll-around wrapping
if (rotated > 122)
adjusted = rotated - 26
else if (rotated < 97)
adjusted = rotated + 26
else
adjusted = rotated
char adjustedChar = (char)adjusted
return adjustedChar
}
/**
* Rotate the entire String by the specified rotation amount.
*/
public static String rotateAllChars(String plainText, int rotationAmount) {
String encodedMessage = ""
Sunday, April 25, 2010
32. adjusted = rotated + 26
else
adjusted = rotated
char adjustedChar = (char)adjusted
return adjustedChar
}
/**
* Rotate the entire String by the specified rotation amount.
*/
public static String rotateAllChars(String plainText, int rotationAmount) {
String encodedMessage = ""
//Loop through each character in the plaintext
for (int i = 0; i < plainText.length(); i++) {
//TODO: Improve to handle upper and lower case letters
char c = plainText.toLowerCase().charAt(i)
encodedMessage += rotateChar(c, rotationAmount)
}
return encodedMessage
}
Sunday, April 25, 2010
33. return adjustedChar
}
/**
* Rotate the entire String by the specified rotation amount.
*/
public static String rotateAllChars(String plainText, int rotationAmount) {
String encodedMessage = ""
//Loop through each character in the plaintext
for (int i = 0; i < plainText.length(); i++) {
//TODO: Improve to handle upper and lower case letters
char c = plainText.toLowerCase().charAt(i)
encodedMessage += rotateChar(c, rotationAmount)
}
return encodedMessage
}
public static void main (String[] args) {
String originalword = args[0]
println "Rot(-3) Word: " + rotateAllChars(originalword, -3)
Sunday, April 25, 2010
38. Compromised
! Every algorithm is vulnerable
Sunday, April 25, 2010
39. Compromised
! Every algorithm is vulnerable
! Crack by brute force
Sunday, April 25, 2010
40. Compromised
! Every algorithm is vulnerable
! Crack by brute force
! Crack by rainbow tables
Sunday, April 25, 2010
41. Compromised
! Every algorithm is vulnerable
! Crack by brute force
! Crack by rainbow tables
! Function of time + money +
hardware
Sunday, April 25, 2010
44. $2000
Whic
h wo
uld y
ou hit
$ 50 ?
Sunday, April 25, 2010
45. JCE PRIMER
The world of Java crypto
Sunday, April 25, 2010
46. JCE PRIMER
The world of Java crypto
Sunday, April 25, 2010
47. Java Cryptography Extension
Known as JCE
Included in all JREs Since Java 1.2
Pluggable provider architecture
JCE extends Java Cryptography
Architecture (JCA)
Sunday, April 25, 2010
48. JCE Providers
Default Sun JRE Providers
SUN
SunJCE
SunJSSE
SunRsaSign
BouncyCastle Provider
Adds AES capabilities
Sunday, April 25, 2010
49. Registering a Provider
Static
<java-home>/lib/security/java.security
security.provider.n=masterClassName
Sunday, April 25, 2010
50. Registering a Provider
Dynamic
! java.security.Security class
addProvider()
insertProviderAt()
! Not persistent across VM instances
Sunday, April 25, 2010
51. Encryption &
the Law
country borders stop bits
Sunday, April 25, 2010
52. JCE Strength
! Jurisdiction Policy Files
! Two variants
! Algorithm strength differences
Sunday, April 25, 2010
58. JCE Strength
Strong strength included in all JREs
Sunday, April 25, 2010
59. JCE Strength
Strong strength included in all JREs
Unlimited strength is a separate download
available based on US export rules
Sunday, April 25, 2010
63. Worldwide Policy
// File: default_local.policy
// Some countries have import limits on crypto strength.
// This policy file is worldwide importable.
grant {
permission javax.crypto.CryptoPermission "DES", 64;
permission javax.crypto.CryptoPermission "DESede", *;
permission javax.crypto.CryptoPermission "RC2", 128,
"javax.crypto.spec.RC2ParameterSpec", 128;
permission javax.crypto.CryptoPermission "RC4", 128;
permission javax.crypto.CryptoPermission "RC5", 128,
"javax.crypto.spec.RC5ParameterSpec", *, 12, *;
permission javax.crypto.CryptoPermission "RSA", 2048;
permission javax.crypto.CryptoPermission *, 128;
};
Sunday, April 25, 2010
64. Max Key Sizes
Algorithm Max Key Size
DES 64
DESede 168
3des
RC2 128
RC4 128
RC5 128
RSA 2048
Others 128
Sunday, April 25, 2010
65. Digests &
Hashes
One way functions
Sunday, April 25, 2010
66. What is a Digest?
Small set of bytes representing a large
message
Small change in message = large change in
digest
Integrity check for large data
Password storage mechanism
Sunday, April 25, 2010
74. MessageDigest
! MD5
! U. S. Department of Homeland Security
said MD5
"considered cryptographically broken and
unsuitable for further use"
Sunday, April 25, 2010
75. System.out.println("Message1 SHA1 digest: "
+ shaAndBase64Encode(message1));
System.out.println("Message2 SHA1 digest: "
+ shaAndBase64Encode(message2));
}
/**
* Helper function to both SHA-1 hash and
* base64 encode the resulting bytes to a String
*/
public static String shaAndBase64Encode(String message)
throws NoSuchAlgorithmException {
MessageDigest sha = MessageDigest.getInstance("SHA-1");
//Salt could be applied here
//Integer salt = <some random number generator>
//sha.update(salt.getBytes());
byte[] digest = sha.digest(message.getBytes());
return new sun.misc.BASE64Encoder().encode(digest);
}
}
Sunday, April 25, 2010
76. *
* Demonstrate that very similar messages
* have radically different hashes.
*/
public class MessageDigestSHA
{
public static void main( String[] args )
throws NoSuchAlgorithmException
{
//Set up the message to be encoded
String message1 = "Four score and seven years ago";
String message2 = "Four score and seven tears ago";
System.out.println("Message1 SHA1 digest: "
+ shaAndBase64Encode(message1));
System.out.println("Message2 SHA1 digest: "
+ shaAndBase64Encode(message2));
}
/**
* Helper function to both SHA-1 hash and
* base64 encode the resulting bytes to a String
*/
public static String shaAndBase64Encode(String message)
throws NoSuchAlgorithmException {
MessageDigest sha = MessageDigest.getInstance("SHA-1");
Sunday, April 25, 2010
77. Input
String message1 = "Four score and seven years ago";
String message2 = "Four score and seven tears ago";
Result
Message1 SHA1 digest: DmCJIg4Bq/xpGIxVXxo3IB0vo38=
Message2 SHA1 digest: oaLHt8tr31ttngCDjyYuWowF5Mc=
Sunday, April 25, 2010
78. SYMMETRIC
My key is your key
Sunday, April 25, 2010
79. SYMMETRIC
My key is your key
Sunday, April 25, 2010
93. Symmetric Problems
Keys vulnerable to capture
Eavesdropping on future communications
after key compromise
Sunday, April 25, 2010
94. Symmetric Problems
Keys vulnerable to capture
Eavesdropping on future communications
after key compromise
Key distribution challenges
Sunday, April 25, 2010
95. Symmetric Problems
Keys vulnerable to capture
Eavesdropping on future communications
after key compromise
Key distribution challenges
Triangular number key growth
Sunday, April 25, 2010
96. Symmetric Problems
! Triangular number key growth
Sunday, April 25, 2010
109. Block
Predefined content length
Sunday, April 25, 2010
110. Block
Predefined content length
Well-known end to the content
Sunday, April 25, 2010
111. Block
Predefined content length
Well-known end to the content
Files on disk
Sunday, April 25, 2010
112. Block
Predefined content length
Well-known end to the content
Files on disk
Inefficient when padding
Sunday, April 25, 2010
113. DES
Data Encryption Standard
Block cipher
Banking industry
DES is known to be broken
Sunday, April 25, 2010
114. 3DES
Data Encryption Standard
Block cipher
a.k.a DESede
Basically three passes of DES
Reasonably strong
Sunday, April 25, 2010
115. Blowfish
Block cipher
Unpatented (intentionally)
Secure replacement for DES
Faster than DES
32 to 448 bit keys
Overshadowed by AES
Sunday, April 25, 2010
116. AES
Advanced Encryption Standard
Block cipher
Government standard
Rijndael algorithm
(Joan Daemen, Vincent Rijmen)
4 years of evaluation
Final in December 2000
Very Secure
Sunday, April 25, 2010
126. RC4
Rivest’s Code 4
Stream cipher
Trademarked (name, but not algorithm)
Sunday, April 25, 2010
127. RC4
Rivest’s Code 4
Stream cipher
Trademarked (name, but not algorithm)
Used by
Sunday, April 25, 2010
128. RC4
Rivest’s Code 4
Stream cipher
Trademarked (name, but not algorithm)
Used by
Browsers in SSL, TLS
Sunday, April 25, 2010
129. RC4
Rivest’s Code 4
Stream cipher
Trademarked (name, but not algorithm)
Used by
Browsers in SSL, TLS
WiFi in WEP WPA
,
Sunday, April 25, 2010
130. RC4
Rivest’s Code 4
Stream cipher
Trademarked (name, but not algorithm)
Used by
Browsers in SSL, TLS
WiFi in WEP WPA
,
BitTorrent
Sunday, April 25, 2010
131. RC4
Rivest’s Code 4
Stream cipher
Trademarked (name, but not algorithm)
Used by
Browsers in SSL, TLS
WiFi in WEP WPA
,
BitTorrent
ssh
Sunday, April 25, 2010
132. RC4
Rivest’s Code 4
Stream cipher
Trademarked (name, but not algorithm)
Used by
Browsers in SSL, TLS
WiFi in WEP WPA
,
BitTorrent
ssh
Microsoft RDP
Sunday, April 25, 2010
133. RC4
Rivest’s Code 4
Stream cipher
Trademarked (name, but not algorithm)
Used by
Browsers in SSL, TLS
WiFi in WEP WPA
,
BitTorrent
ssh
Microsoft RDP
PDF
Sunday, April 25, 2010
138. A5/1
A5/1
Secret, unpublished
Reverse engineered
Used by GSM phones
Sunday, April 25, 2010
139. import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.KeyGenerator;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.SecretKey;
import sun.misc.BASE64Encoder;
/**
* Use the SecureRandom java security class to generate
* a more expensive, but cryptographically secure random number.
*/
public class SymmetricEncrypt
{
public static void main( String[] args )
throws NoSuchAlgorithmException, NoSuchProviderException,
NoSuchPaddingException, InvalidKeyException,
IllegalBlockSizeException, BadPaddingException
{
final String message1 = "Four score and seven years ago";
Sunday, April 25, 2010
140. import sun.misc.BASE64Encoder;
/**
* Use the SecureRandom java security class to generate
* a more expensive, but cryptographically secure random number.
*/
public class SymmetricEncrypt
{
public static void main( String[] args )
throws NoSuchAlgorithmException, NoSuchProviderException,
NoSuchPaddingException, InvalidKeyException,
IllegalBlockSizeException, BadPaddingException
{
final String message1 = "Four score and seven years ago";
//Build a new encryption key
final KeyGenerator keyGen = KeyGenerator.getInstance("DESede");
keyGen.init(168);
final SecretKey desKey = keyGen.generateKey();
//Set up the cipher
final Cipher desCipher = Cipher.getInstance("DESede/ECB/PKCS5Padding");
//////////////////////////////////////
//Put the cipher in encryption mode
desCipher.init(Cipher.ENCRYPT_MODE, desKey);
//Encrypt and output the base64 data
byte[] clearText = message1.getBytes();
byte[] encryptedBytes = desCipher.doFinal(clearText);
BASE64Encoder b64e = new sun.misc.BASE64Encoder();
Sunday, April 25, 2010
141. final String message1 = "Four score and seven years ago";
//Build a new encryption key
final KeyGenerator keyGen = KeyGenerator.getInstance("DESede");
keyGen.init(168);
final SecretKey desKey = keyGen.generateKey();
//Set up the cipher
final Cipher desCipher = Cipher.getInstance("DESede/ECB/PKCS5Padding");
//////////////////////////////////////
//Put the cipher in encryption mode
desCipher.init(Cipher.ENCRYPT_MODE, desKey);
//Encrypt and output the base64 data
byte[] clearText = message1.getBytes();
byte[] encryptedBytes = desCipher.doFinal(clearText);
BASE64Encoder b64e = new sun.misc.BASE64Encoder();
String base64Encrypted = b64e.encode(encryptedBytes);
System.out.println("Encrypted text: " + base64Encrypted);
//////////////////////////////////////
//Put the cipher in decryption mode
desCipher.init(Cipher.DECRYPT_MODE, desKey);
//Decrypt and output the original string
byte[] decryptedBytes = desCipher.doFinal(encryptedBytes);
String decryptedText = new String(decryptedBytes);
System.out.println("Decrypted text: " + decryptedText);
}
}
Sunday, April 25, 2010
142. //Set up the cipher
final Cipher desCipher = Cipher.getInstance("DESede/ECB/PKCS5Padding");
//////////////////////////////////////
//Put the cipher in encryption mode
desCipher.init(Cipher.ENCRYPT_MODE, desKey);
//Encrypt and output the base64 data
byte[] clearText = message1.getBytes();
byte[] encryptedBytes = desCipher.doFinal(clearText);
BASE64Encoder b64e = new sun.misc.BASE64Encoder();
String base64Encrypted = b64e.encode(encryptedBytes);
System.out.println("Encrypted text: " + base64Encrypted);
//////////////////////////////////////
//Put the cipher in decryption mode
desCipher.init(Cipher.DECRYPT_MODE, desKey);
//Decrypt and output the original string
byte[] decryptedBytes = desCipher.doFinal(encryptedBytes);
String decryptedText = new String(decryptedBytes);
System.out.println("Decrypted text: " + decryptedText);
}
}
Sunday, April 25, 2010
143. Input
String message1 = "Four score and seven years ago";
Result
Encrypted text: P0FT6N3XXrohtsz7OLh3FGYY0wErkPIur1DP6Csbj4g=
Decrypted text: Four score and seven years ago
Sunday, April 25, 2010
144. ENCRYPTED = SAFE,
RIGHT?
information leakage from encrypted data
Sunday, April 25, 2010
145. ENCRYPTED = SAFE,
RIGHT?
information leakage from encrypted data
Sunday, April 25, 2010
146. Encrypted isn’t enough?
http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation
Sunday, April 25, 2010
152. Diffie-Hellman
Key Agreement Protocol
Sunday, April 25, 2010
153. Diffie-Hellman
Key Agreement Protocol
Alice & Bob independently generate the shared
(session) key
Sunday, April 25, 2010
154. Diffie-Hellman
Key Agreement Protocol
Alice & Bob independently generate the shared
(session) key
Published 1976, but invented earlier
Sunday, April 25, 2010
155. Diffie-Hellman
Key Agreement Protocol
Alice & Bob independently generate the shared
(session) key
Published 1976, but invented earlier
Vulnerable to MITM attack
Sunday, April 25, 2010
156. Diffie-Hellman
Key Agreement Protocol
Alice & Bob independently generate the shared
(session) key
Published 1976, but invented earlier
Vulnerable to MITM attack
Fixed by PKI
Sunday, April 25, 2010
157. Diffie-Hellman
Key Agreement Protocol
Alice & Bob independently generate the shared
(session) key
Published 1976, but invented earlier
Vulnerable to MITM attack
Fixed by PKI
and signing the agreed key
Sunday, April 25, 2010
159. DH Diagrammed
predetermined and openly shared
A B
Sunday, April 25, 2010
160. DH Diagrammed
predetermined and openly shared
g = random
g = 11
A B
Sunday, April 25, 2010
161. DH Diagrammed
predetermined and openly shared
g = random p = prime
g = 11 p = 23
A B
Sunday, April 25, 2010
162. DH Diagrammed
predetermined and openly shared
g = random p = prime
g = 11 p = 23
picks a = 6 picks b = 4
A B
Sunday, April 25, 2010
163. DH Diagrammed
predetermined and openly shared
g = random p = prime
g = 11 p = 23
picks a = 6 picks b = 4
A A= ga mod p B B= gb mod p
Sunday, April 25, 2010
164. DH Diagrammed
predetermined and openly shared
g = random p = prime
g = 11 p = 23
picks a = 6 picks b = 4
A A= ga mod p B B= gb mod p
9=116 mod 23 13=114 mod 23
Sunday, April 25, 2010
165. DH Diagrammed
predetermined and openly shared
g = random p = prime
g = 11 p = 23
picks a = 6 picks b = 4
A A= ga mod p B B= gb mod p
9=116 mod 23 13=114 mod 23
B=13 A=9
Sunday, April 25, 2010
166. DH Diagrammed
predetermined and openly shared
g = random p = prime
g = 11 p = 23
picks a = 6 picks b = 4
A A= ga mod p B B= gb mod p
9=116 mod 23 13=114 mod 23
B=13 A=9
K= Ba mod p K= Ab mod p
Sunday, April 25, 2010
167. DH Diagrammed
predetermined and openly shared
g = random p = prime
g = 11 p = 23
picks a = 6 picks b = 4
A A= ga mod p B B= gb mod p
9=116 mod 23 13=114 mod 23
B=13 A=9
K= Ba mod p K= Ab mod p
6= 136 mod 23 6= 94 mod 23
Sunday, April 25, 2010
168. DH Diagrammed
predetermined and openly shared
g = random p = prime
g = 11 p = 23
picks a = 6 picks b = 4
A A= ga mod p B B= gb mod p
9=116 mod 23 13=114 mod 23
B=13 A=9
K= Ba mod p K= Ab mod p
6= 136 mod 23 6= 94 mod 23
Encryption can begin
Sunday, April 25, 2010
171. SecureRandom
java.security.SecureRandom
Cryptographically strong random number
generator (RNG)
“Unable to distinguish from a true random
source”
Used in combination with many ciphers
Sunday, April 25, 2010
172. package com.ambientideas;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
/**
* Use the SecureRandom java security class to generate
* a more expensive, but cryptographically secure random number.
*/
public class SecureRandomNumber
{
public static void main( String[] args ) throws
NoSuchAlgorithmException
{
//Do the expensive one time setup of the
Sunday, April 25, 2010 // random number generator instance
173. import java.security.SecureRandom;
/**
* Use the SecureRandom java security class to generate
* a more expensive, but cryptographically secure random number.
*/
public class SecureRandomNumber
{
public static void main( String[] args ) throws
NoSuchAlgorithmException
{
//Do the expensive one time setup of the
// random number generator instance
SecureRandom prng = SecureRandom.getInstance("SHA1PRNG");
//Get the next random number
String randomNum = new Integer( prng.nextInt() ).toString();
System.out.println("Random number: " + randomNum);
}
}
Sunday, April 25, 2010
174. * a more expensive, but cryptographically secure random number.
*/
public class SecureRandomNumber
{
public static void main( String[] args ) throws
NoSuchAlgorithmException
{
//Do the expensive one time setup of the
// random number generator instance
SecureRandom prng = SecureRandom.getInstance("SHA1PRNG");
//Get the next random number
String randomNum = new Integer( prng.nextInt() ).toString();
System.out.println("Random number: " + randomNum);
}
}
Sunday, April 25, 2010
175. Result
Random number: 1633471380
Sunday, April 25, 2010
176. ASYMMETRIC
Throwing away keys
faster than an intern locksmith
Sunday, April 25, 2010
177. ASYMMETRIC
Throwing away keys
faster than an intern locksmith
Sunday, April 25, 2010
190. import java.io.IOException;
import java.security.InvalidKeyException;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.SecureRandom;
import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
import sun.misc.BASE64Encoder;
/**
* Use the SecureRandom java security class to generate
* a more expensive, but cryptographically secure random
number.
Sunday, April 25, 2010
191. public static void main( String[] args ) throws
NoSuchAlgorithmException, NoSuchProviderException,
IOException, NoSuchPaddingException, InvalidKeyException,
IllegalBlockSizeException, BadPaddingException
{
final String message1 = "Four score and seven years ago";
// Generate the Key Pair
final KeyPairGenerator keyGen =
KeyPairGenerator.getInstance("RSA");
final SecureRandom random =
SecureRandom.getInstance("SHA1PRNG", "SUN");
keyGen.initialize(1024, random);
KeyPair pair = keyGen.generateKeyPair();
final PrivateKey privKey = pair.getPrivate();
final PublicKey pubKey = pair.getPublic();
//Encrypt using the private key
Cipher rsa = Cipher.getInstance("RSA/ECB/PKCS1Padding");
rsa.init(Cipher.ENCRYPT_MODE, privKey);
byte[] encryptedBytes = rsa.doFinal(message1.getBytes());
BASE64Encoder b64e = new sun.misc.BASE64Encoder();
Sunday, April 25, 2010
192. KeyPair pair = keyGen.generateKeyPair();
final PrivateKey privKey = pair.getPrivate();
final PublicKey pubKey = pair.getPublic();
//Encrypt using the private key
Cipher rsa = Cipher.getInstance("RSA/ECB/PKCS1Padding");
rsa.init(Cipher.ENCRYPT_MODE, privKey);
byte[] encryptedBytes = rsa.doFinal(message1.getBytes());
BASE64Encoder b64e = new sun.misc.BASE64Encoder();
String base64Encrypted = b64e.encode(encryptedBytes);
System.out.println("Encrypted text: " + base64Encrypted);
//Decrypt using the private key
rsa.init(Cipher.DECRYPT_MODE, pubKey);
byte[] decryptedBytes = rsa.doFinal(encryptedBytes);
String decryptedText = new String(decryptedBytes);
System.out.println("Decrypted text: " + decryptedText);
}
}
Sunday, April 25, 2010
193. final PublicKey pubKey = pair.getPublic();
//Encrypt using the private key
Cipher rsa = Cipher.getInstance("RSA/ECB/PKCS1Padding");
rsa.init(Cipher.ENCRYPT_MODE, privKey);
byte[] encryptedBytes = rsa.doFinal(message1.getBytes());
BASE64Encoder b64e = new sun.misc.BASE64Encoder();
String base64Encrypted = b64e.encode(encryptedBytes);
System.out.println("Encrypted text: " + base64Encrypted);
//Decrypt using the private key
rsa.init(Cipher.DECRYPT_MODE, pubKey);
byte[] decryptedBytes = rsa.doFinal(encryptedBytes);
String decryptedText = new String(decryptedBytes);
System.out.println("Decrypted text: " + decryptedText);
}
}
Sunday, April 25, 2010
194. Input
String message1 = "Four score and seven years ago";
Result
Encrypted text: A8Is+4r7sDn28fD6IQvZiR5JxPs/vh7UnXrF38acJt6R/
ARisj/zLtC7Xn6iJgNQPhc16wkVZhCF
em7oNoim+ooTUDDZQ+E3qP6y/
DZJGkLBoZuZVLeLAW1LUtHSzduRUOg1uMynJz14wxzwfV8wfRwf
atpySkOhGqWS63bPNRs=
Decrypted text: Four score and seven years ago
Sunday, April 25, 2010
195. BLENDED
symmetric with a twist of asymmetric
Sunday, April 25, 2010
196. BLENDED
symmetric with a twist of asymmetric
Sunday, April 25, 2010
205. PGP
Random generated
256 bit symmetric key
A B
Message/File
Sunday, April 25, 2010
206. PGP
Random generated
256 bit symmetric key
Encrypted with
256 bit symmetric key
A B
Message/File
Sunday, April 25, 2010
207. PGP
B’s
2048 bit
public key Random generated
256 bit symmetric key
Encrypted with
256 bit symmetric key
A B
Message/File
Sunday, April 25, 2010
208. PGP
Encrypted with
2048 bit RSA key
Random generated
256 bit symmetric key
Encrypted with
256 bit symmetric key
A B
Message/File
Sunday, April 25, 2010
209. PGP
Encrypted with
2048 bit RSA key
Random generated
256 bit symmetric key
Encrypted with
256 bit symmetric key
A B
Message/File
Sunday, April 25, 2010
210. PGP
Encrypted with
2048 bit RSA key
B’s
2048 bit
Random generated private key
256 bit symmetric key
Encrypted with
256 bit symmetric key
A B
Message/File
Sunday, April 25, 2010
211. PGP
Random generated
256 bit symmetric key
Encrypted with
256 bit symmetric key
A B
Message/File
Sunday, April 25, 2010
214. OTHER FRAMEWORKS
and alternative JCE providers
Sunday, April 25, 2010
215. OTHER FRAMEWORKS
and alternative JCE providers
Sunday, April 25, 2010
216. Bouncy Castle
JCE Provider
Many more encryption and digest
algorithms than the Sun provider (AES)
Sunday, April 25, 2010
217. Jasypt
Frictionless Java encryption
Sunday, April 25, 2010
218. Gnu
Open source library
Sunday, April 25, 2010
219. In Summary
Encrypted does not guarantee security
ECB can be leaky
Hash vs. Encrypt
Know when to apply each
Know your algorithm
Key strength
Symmetric versus asymmetric
High Level Libraries
More productive than pure JCE
Sunday, April 25, 2010
220. Th anks in advanc e for
yo ur com pleted evals!
Sunday, April 25, 2010
221. OT CA MP
TI ON BOission
RYPrity is the M
ENC cu
Se
Matthew McCullough
Email matthewm@ambientideas.com
Twitter @matthewmccull
Blog http://ambientideas.com/blog
Sunday, April 25, 2010
229. Major Encryption Types
Pre-agreed Phrases (Concept)
Simplest form of symmetric encryption.
Have to meet in person to pass keys around
DHM Key Exchange (Concept, Algorithm)
Requires both parties to be online
This is a drawback
RSA (Algorithm)
Added asynchronous behavior with pub priv keys
Keys are permanent (not generated each time)
PGP (Concept, Algorithm)
Added speed to RSA by encrypting the payload
Sunday, April 25, 2010
230. Data Integrity
Checksums needed
Harder to maintain with encryption?
Block versus stream cipher
Block: XOR all previous nodes
Stream: XOR some “forward” packets
Recovery once one packet is lost?
Sunday, April 25, 2010
231. Replay Attacks
Consider vulnerability to replay
Problem: ECB (block) mode
Same packet encrypted next time looks
the same
Hardening: XOR to protect
Still vulnerable to entire stream replay
Entire stream hard to capture
Sunday, April 25, 2010