Andy Watson Ionic Security - Lead Developer POSSCON 2015 4/14/2015 Security Track - 11:00 AM Talk

1. Using Cryptography
Properly in Applications
POSSCON 2015
Andy Watson
Ionic Security

2. About:
Name: Andy Watson
Occupation: Byte Mangler
Employer: Ionic Security
http://ionicsecurity.com/

3. Why:
I’ve seen too many people not using
cryptography or using it incorrectly.
This information may help you not be one of
them.

4. Agenda:
● Random
● Salt
● Hash
● Key Derivation
● Symmetric Encryption
● Famous Mistakes

5. Random

6. Random Number Generators
RNG: A computational or physical device designed to
generate a sequence of numbers that lack any pattern
High quality generators depend on an entropy source like
radioactive decay or radio frequency noise
For cryptographic functions, higher levels of entropy are
required to work properly

7. Pseudo
Computational RNG are known as Pseudo RNG
PRNG are “seeded” with a value to generate a
series of numbers

8. SALT

9. What is a Salt?
Random data added to your input to create
better output from one way functions
Useful for defending against dictionary and rainbow table
attacks.

10. Hash

11. HASH!

12. Hashing Function (n.)
A Function that represents data of arbitrary size as data of
a fixed size.
$ echo 'Hello POSSCON 2015!' | md5
81ad0b0ba5f98e0f584c1cd9a2c324a3
$ echo 'Hello POSSCON 2015' | md5
0c9c470f340aedaba625908939ba3c7b

13. When to Hash
Use hashing functions when saving the original data
would be a liability you have no business dealing with
For Example: Linux Passwords
$6$pWVzxN/iFRstrZ/.$TNBvzXhc8b9SBkl1q36YNvF2DwuS
4/7LsICepYgaWCKzM1MS.OBK5TvxrUQ4.
I5x5NtqidhBTGobQLOqxBAFe1

14. Don’t Store The Clear
Credentials should be salted and hashed when
stored
During login, salt and hash the password
entered and check it against the result you
stored

15. When Hashes Collide
These two blocks have the same md5 hash of
79054025255fb1a26e4bc422aef54eb4
This is called a collision
d131dd02c5e6eec4693d9a0698aff95c 2fcab58712467eab4004583eb8fb7f89
55ad340609f4b30283e488832571415a 085125e8f7cdc99fd91dbdf280373c5b
d8823e3156348f5bae6dacd436c919c6 dd53e2b487da03fd02396306d248cda0
e99f33420f577ee8ce54b67080a80d1e c69821bcb6a8839396f9652b6ff72a70
d131dd02c5e6eec4693d9a0698aff95c 2fcab50712467eab4004583eb8fb7f89
55ad340609f4b30283e4888325f1415a 085125e8f7cdc99fd91dbd7280373c5b
d8823e3156348f5bae6dacd436c919c6 dd53e23487da03fd02396306d248cda0
e99f33420f577ee8ce54b67080280d1e c69821bcb6a8839396f965ab6ff72a70

16. Taste the Rainbow Table
A rainbow table is a precomputed table for reversing
cryptographic hash functions, usually for cracking
password hashes.
Password MD5 Hash
123456 e10adc3949ba59abbe56e057f20f883e
password 5f4dcc3b5aa765d61d8327deb882cf99

17. You. Must. Hash. Securely.
Cryptographically Secure Hash Function (n.)
A hash function which is infeasible to reverse back to the
original message and not subject to collisions
$ echo "hello POSSCON 2015" | shasum -a 512
0d294c5140972735a80131eca426da4838cf5de1b3eb1c8cb51c4bb24823e389
d22a36be76be597a5c5a934dd5fada8b75e0986fb6e89329a820c22d96c4be17

18. Key Derivation

19. Key Derivation Functions
KDF create new secret keys from a secret
value and a known value - like a password
Key Derivation Functions can be used in a “key stretching”
routing to enhance hashing functions to provide much
more protection from rainbow tables and brute force
attacks

20. Original KDF: crypt
● Invented in 1978 to protect UNIX
passwords
● Used only a 12 bit salt
● Limited passwords to 8 characters

21. Modern KDFs
PDKDF2
● 64 bit random salt
● 5000 iterations of SHA1 (hashing function)
SCRYPT
● Consumes large amounts of memory on
purpose

22. PBKDF2 In A Nutshell™
Password
SALT +
Password
Prepend SALT
Intermediate
Hash
SHA1
REPEAT SHA1
5000 TIMES
Final Hash

23. Save the Salt
Store the salt, the resulting hash and the
number of iterations in your datastore
You’ll have to calculate the derived key of the
credential again to verify it is correct

24. Symmetric Encryption

25. Symmetric Encryption
Used when your application needs to protect data at rest
(on disk etc) but will need to use those values later
The most common algorithm for symmetric encryption is
AES (Advanced Encryption Standard)
It can operate in multiple modes like ECB, CBC, CTR and
GCM - each suited to different uses

26. ECB Mode
Electronic Code Book
Operates on blocks of plaintext

27. Comparing ECB to other modes
http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation

28. Galois Counter Mode (GCM)
Authenticates and Encrypts Messages
Reduces the opportunity for interference with
messages to go undetected

29. It’s Complicated
Use a well known, well tested cryptographic
library / framework - do not write your own!
Do research before shipping your code - make
sure you’re using the right primitives / modes
for your application

30. Let’s point and laugh
Some Mistakes Were
Made

31. The Stupid. It Hurts.

32. Le Sigh.
My password is stored in their
database.
It was not hashed or they could
not have emailed it to me!

33. Which is bad because...
A lot of people use the same password
everywhere and use their email address as
their login!

34. So...
An attacker that gets this password list can try
to log in to all kinds of things as you!
1. email
2. banks
3. credit reporting
4. even NetFlix!

35. Adobe Hack
Millions of “encrypted” passwords stolen
Hashed with MD5
Large numbers of them found in rainbow tables
Most Common Password: 123456
http://stricture-group.com/files/adobe-top100.txt

37. Beware The Default Settings
Default settings for Android Bouncy Castle
starting in 2.1 were not good
Defaulted to ECB mode!

38. Empirical Study of Android Apps
11,748 applications analyzed
5,656 used ECB mode by default
3,644 used a constant symmetric key
2,000 used ECB mode EXPLICITLY!
1,932 used a constant IV
1,629 seeded PRNG with static value

39. Seeding the Pseudo
In 2006 a bug in Debian and Ubuntu caused
the PID to be used as the output of the PRNG -
only 32,768 possible values!
(hint: that’s not enough!)

40. UnSalted Hashes
In 2012, LinkedIn password hashes were
stolen
They were not salted so 60% of them were
cracked

41. Crisis Averted at Slack
User profile data stolen in February 2015
Passwords hashed with bcrypt and random
salts
Change your password anyway...

42. Unlocking Your Prius
System uses rotating codes in a small range
Some built in (pre-shared) keys for repair use
No protection from replaying codes
Brute force attacks possible
Still under investigation...

43. Yay!

44. More Resources For You
https://bitly.com/bundles/andrewwatson/2

45. @andrewwatson
http://andywatson.space/
http://www.ionicsecurity.com/
Thank You