Upload
priyanka-aash
View
478
Download
0
Embed Size (px)
Citation preview
SESSION ID:
Crypto 101: Encryption, Codebreaking, SSL and Bitcoin
BAS-M06
Benjamin HVF Labs@BenjaminJun
Some material adapted from Ivan Ristic, Qualys (RSAC 2011)
`
2
Crypto 101
Cryptography is the art and science of keeping messages secure.
Cryptography building blocksCryptographic protocols
SSL / TLSBitcoin
Attacks on cryptography
`
3
Security \si-ˈkyu̇r-ə-tē\
Cryptography terms ConfidentialityIntegrityAuthenticationAccess controlNon-repudiation
the state of being free from danger or threat
Other Criteria InteroperabilityPerformanceUsability
`
#RSAC
Crypto Building Blocks
`
5
Encryption
Obfuscation that is fast when you know the secrets, but impossible or slow when you don’t.
Scytale300BC
Image credit: Luringen, Sobebunny, R Booth
Enigma Machine1920s
Jefferson Wheel (M94)1900s
`
6
Symmetric encryption
Use shared key to encrypt/decryptAlgorithm does not need to be secretKey must be agreed and communicated in advance
Convenient and fastExamples: RC4, 3DES, AES
`
Asymmetric encryption
Two related keys: one private, one public Anyone with the public key can encrypt the messageOnly the private key holder can decrypt messageEnables encryption, key exchange, and authentication
Examples: RSA, Diffie-Hellman, ElGamal, DSA, Elliptic curve (ECDH / ECDSA)Significantly slower than symmetric encryption
`
8
Authentication
Confirm data integrity and message origin
Mark of the Fisherman (1200AD)
British Museum, flikr:favoritethings
Egyptian signet ring (500BC)
US nuclear “football” (present day)
On death, Cardinal Camerlengo to destroy
Keys roll at noon on inauguration day
`
9
Digital signatures
Asymmetric cryptography can authenticate messagesOnly the private key holder can generate a signatureAnyone with the public key can validate the signatureSignatures protect digital certificates from modification or forgery
sign verifySigneddocumen
t
`
10
Digital certificates
Digital ID can include public/private keypair
Digital certificate conveys identityCredential holder info (name, address, etc.) Identity’s public keyValidity periodDigital signature of Certificate Authority (CA)
Authentication has 3 stepsCA signature confirms data is authentic, vouched forDo we approve of data in the certificate?Identity keypair validated to confirm ID holder has the private key
`
11
Randomness matters
Random numbers at heart of cryptoUsed for key generationWeak keys = weak encryption
Random number generatorsTrue random (TRNG) – truly randomPseudorandom (PRNG) – look random
PRNGs fine if properly seeded, properly designed
NIST SP 800-90A, Rev 1 Dual_EC_DRBG January 2012
60
10.3 DRBG Mechanisms Based on Number Theoretic Problems
A DRBG can be designed to take advantage of number theoretic problems (e.g., the discrete logarithm problem). If done correctly, such a generator’s properties of randomness and/or unpredictability will be assured by the difficulty of finding a solution to that problem. This section specifies a DRBG mechanism that is based on the elliptic curve discrete logarithm problem.
10.3.1 Dual Elliptic Curve Deterministic RBG (Dual_EC_DRBG)
Dual_EC_DRBG is based on the following hard problem, sometimes known as the “elliptic curve discrete logarithm problem” (ECDLP): given points P and Q on an elliptic curve of order n, find a such that Q aP.
Dual_EC_DRBG uses an initial seed that is 2 * security_strength bits in length to initiate the generation of outlen-bit pseudorandom strings by performing scalar multiplications on two points in an elliptic curve group, where the curve is defined over a field approximately 2m in size. For all the NIST curves given in this Recommendation, m is at least twice the security_strength, and never less than 256. Throughout this DRBG mechanism specification, m will be referred to as seedlen; the term “seedlen” is appropriate because the internal state of Dual_EC_DRBG is used as a “seed” for the random block it produces. Figure 13 depicts the Dual_EC_DRBG.
The instantiation of this DRBG mechanism requires the selection of an appropriate elliptic curve and curve points specified in Appendix A.1 for the desired security strength. The seed used to determine the initial value (s) of the DRBG mechanism shall have at least security_strength bits of entropy. Further requirements for the seed are provided in Section 8.6. This DRBG mechanism uses the derivation function specified in Section 10.4.1 during instantiation and reseeding.
The maximum security strength that can be supported by the Dual_EC_DRBG is the security strength of the curve used; the security strengths for the curves are provided in [SP 800-57].
seed
0
Instant. orreseed only
+ (x (t*P)) (x (s*Q))t
P Q
s r
If additional input = Null
ExtractBits
PseudorandomBits
[Optional]additional input
Figure 13: Dual_EC_DRBG
NIST SP 800-90A, Rev 1 January 2012
77
Appendix A: (Normative) Application-Specific Constants
A.1 Constants for the Dual_EC_DRBG
The Dual_EC_DRBG requires the specifications of an elliptic curve and two points on the elliptic curve. One of the following NIST approved curves with associated points shall be used in applications requiring certification under [FIPS 140]. More details about these curves may be found in [FIPS 186]. If alternative points are desired, they shall be generated as specified in Appendix A.2.
Each of following curves is given by the equation:
y2 = x3- 3x + b (mod p)
Notation:
p - Order of the field Fp , given in decimal
n - Order of the Elliptic Curve Group, in decimal . a – (-3) in the above equation
b - Coefficient above
The x and y coordinates of the base point, i.e., generator G, are the same as for the point P.
A.1.1 Curve P-256
p = 11579208921035624876269744694940757353008614\ 3415290314195533631308867097853951
n = 11579208921035624876269744694940757352999695\ 5224135760342422259061068512044369
b = 5ac635d8 aa3a93e7 b3ebbd55 769886bc 651d06b0 cc53b0f6 3bce3c3e 27d2604b
Px = 6b17d1f2 e12c4247 f8bce6e5 63a440f2 77037d81 2deb33a0 f4a13945 d898c296
Py = 4fe342e2 fe1a7f9b 8ee7eb4a 7c0f9e16 2bce3357 6b315ece cbb64068 37bf51f5
Qx = c97445f4 5cdef9f0 d3e05e1e 585fc297 235b82b5 be8ff3ef ca67c598 52018192
Qy = b28ef557 ba31dfcb dd21ac46 e2a91e3c 304f44cb 87058ada 2cb81515 1e610046
NIST SP800-90A: Dual EC DRBG with NIST NSA*
constants
* NYT Snowden memos, September 2013
(don’t use these)
`
12
Hash functions
One-way transformation to generate data fingerprints for:
Digital signatures Integrity validationTokenization (e.g., storing passwords)
ExamplesMD5 considered brokenSHA-1 (160) some concernsSHA-2 (256) okKeccak and SHA-3
SHA2 (SHA-256) compression function
◆Desirable qualitiesPreimage resistance (one-wayness)Collision resistance and birthday
`
13
Stay humble
Don’t roll your own cryptoFailure modes subtle, catastrophicStandard crypto has been strongly vetted
Avoid unnecessary complexitySystem only as strong as its weakest linkComplexity = more stuff to go wrong
Never rely on obscurity“If I can barely understand it, then it must be strong!”Kerckhoffs's principle: only the key should be secure
Auguste Kerckhoffs (1835-1903)
`
#RSAC
Putting It All Together - SSL / TLS - Bitcoin
`
15
TLS
Transport Layer SecurityWorld’s most widely used cryptographic protocolFrom Netscape SSL3 (Kocher, 1995)
Security requirementsSecurely connect with someone you have never metData privacy, data integrity, no site impersonation, no man-in-middle
`
16
Getting to https
1. Webserver provides digital certificate to browser
• “Amazon.com’s passport”
2. TLS layer + browser “authenticates passport”
• Confirms data fields in cert • Confirms digital signature
3. TLS layer confirms that webserver holds private key
• Sends encrypted data that can only be decrypted w/private key
Cert. Authority signature
Amazon public RSA key
Amazon info
Certificate Authority info
`
17
TLS: Connection
TLS 1.2 protocol forsecure socket & session mgmt
Certificate check passed!
AES_128_GCM for bulk data• Symmetric crypto• AES128 block cipher (privacy)• Galois authentication
(integrity)
ECDHE_RSA for key exchange• Asymmetric crypto• Confidentiality: Elliptic curve
Diffie-Hellman• Authentication: RSA2048• “Perfect forward secrecy”
`
18
Bitcoin (1/2)
Peer-to-peer, decentralized currency
Not underwritten by any entity“Satoshi Nakamoto” paper (2008)
180K transactions/day (Jan ‘16)
$6.5B in circulation (Jan ’16)(US M0 Supply: $4,007B, Nov ‘15)
Diagrams from blockchain.info
Bitcoin: A Peer-to-Peer Electronic Cash System
Satoshi Nakamoto
www.bitcoin.org
Abstract. A purely peer-to-peer version of electronic cash would allow online
payments to be sent directly from one party to another without going through a
financial institution. Digital signatures provide part of the solution, but the main
benefits are lost if a trusted third party is still required to prevent double-spending.
We propose a solution to the double-spending problem using a peer-to-peer network.
The network timestamps transactions by hashing them into an ongoing chain of
hash-based proof-of-work, forming a record that cannot be changed without redoing
the proof-of-work. The longest chain not only serves as proof of the sequence of
events witnessed, but proof that it came from the largest pool of CPU power. As
long as a majority of CPU power is controlled by nodes that are not cooperating to
attack the network, they'll generate the longest chain and outpace attackers. The
network itself requires minimal structure. Messages are broadcast on a best effort
basis, and nodes can leave and rejoin the network at will, accepting the longest
proof-of-work chain as proof of what happened while they were gone.
1. Introduction
Commerce on the Internet has come to rely almost exclusively on financial institutions serving as
trusted third parties to process electronic payments. While the system works well enough for
most transactions, it still suffers from the inherent weaknesses of the trust based model.
Completely non-reversible transactions are not really possible, since financial institutions cannot
avoid mediating disputes. The cost of mediation increases transaction costs, limiting the
minimum practical transaction size and cutting off the possibility for small casual transactions,
and there is a broader cost in the loss of ability to make non-reversible payments for non-
reversible services. With the possibility of reversal, the need for trust spreads. Merchants must
be wary of their customers, hassling them for more information than they would otherwise need.
A certain percentage of fraud is accepted as unavoidable. These costs and payment uncertainties
can be avoided in person by using physical currency, but no mechanism exists to make payments
over a communications channel without a trusted party.
What is needed is an electronic payment system based on cryptographic proof instead of trust,
allowing any two willing parties to transact directly with each other without the need for a trusted
third party. Transactions that are computationally impractical to reverse would protect sellers
from fraud, and routine escrow mechanisms could easily be implemented to protect buyers. In
this paper, we propose a solution to the double-spending problem using a peer-to-peer distributed
timestamp server to generate computational proof of the chronological order of transactions. The
system is secure as long as honest nodes collectively control more CPU power than any
cooperating group of attacker nodes.
1
`
19
Bitcoin (2/2)Characteristic What happens Cryptography
Value creation Mined by searching for magic values KWh —> BTC!
Proof-of-work method uses SHA-256 hash function
Coin transfers Digital signatures ECDSA digital signature
Recordkeeping(no double-spending)
Distributed ledger with financial incentive for a “single view”
Block chain uses SHA-256 hash function
Backing entity NONE! Everything regulated by market forces + math!
Great technical resource: Bitcoin Developer Reference by Krzysztof Okupski
`
#RSAC
Attacks on Cryptography
`
21
Brute force
DES Keysearch Machine, 1998 Tests 90 billion keys/sec, average time to crack 56-bit DES: 5 days
(Cryptography Research, AWT, EFF)
US Navy Bombe, 1943 Contains 16 four-rotor Enigma equivalents to perform exhaustive key search.
`
22
Cryptanalysis
HDCP = “High bandwidth Digital Copy Protection”
Protects digital content, interoperabilityFast, offline, any-to-any negotiationEncryption and authentication
“Clever” key managementNo one device contains global secretHDCP master key published (2010)Unlicensed implementations cannot be revoked
A Cryptanalysis of the High-bandwidth Digital Content Protection System
(Crosby, Goldberg, Johnson, Song, Wagner)
image from www.hdmi.org
But keys from ~40 devices can
reveal the master key
`
23
Implementation: Side Channel (1/2)Simple EM attack with radio at distance of 10 feet
DevicesAntennas
Receiver ($350)
Digitizer, GNU Radio peripheral ($1000)
Signal Processing (demodulation, filtering)
Images from Cryptography Research
`
24
Implementation: Side Channel (2/2)Focus on Mpdp mod p calculation (Mqdq mod q similar)
For each bit i of secret dp perform “Square” if (bit i == 1) perform “Multiply” endif endfor
SM S S S S S S S SM S SM SM S S S SM SM S S S S S S S S SImages from Cryptography Research
`
25
Crypto necessary, but not sufficient
Game King poker (2014)Bug allows user to adjust bet
after hand played
Siemens Simatic S7-315Target of Stuxnet
Operation Olympic Games
http://www.wired.com/2014/10/cheating-video-poker/
`
#RSAC
Learn More!
`
27
Resources
Understanding Cryptography Christof Paar and Jan Pelzl(Springer, 2009)
Cryptography online course Dan Boneh, Stanford University
Dan$Boneh$
Genera7ng$keys:$a$toy$protocol$Alice$wants$a$shared$key$with$Bob.$$$$$Eavesdropping$security$only.$$Bob#(kB) $ $Alice#(kA) $ $ $ $TTP#
7cket$
kAB## kAB##
“Alice$wants$key$with$Bob”$
(E,D)$a$CPANsecure$cipher$
choose$$random$kAB$
Dan$Boneh$
Insecure$against$manNinNtheNmiddle$As$described,$the$protocol$is$insecure$against$acJve$aFacks$
Alice# Bob#MiTM#
`
28
How to apply what you have learned
In the first three months:Identify where cryptography is used in your organizationIdentify infrastructure required (key management, certificates)
Within six months: Know what crypto can do. Explain the different security properties. Know what crypto can’t do. Understand basic implementation security issues.
`
29
@ Benjamin Jun
Friday March 4, 10:10am
Our Road Ahead: Today’s Tech Developments, Tomorrow’s Security Challenges
Fireside chat with Benjamin Jun and Hugh ThompsonIndustry Experts EXP-F02
Questions?