Upload
nick-sullivan
View
10.124
Download
2
Embed Size (px)
Citation preview
What’s new in Go Crypto?Nick Sullivan (@grittygrease)
GothamGo
October 2, 2015
Go’s Crypto Packages
AES, DES, RC4 RSA, ECDSA
SHA-1, SHA-2
HMAC2
Go’s Crypto Packages
X.509
TLS
3
Who gits the blame?
21202 Adam Langley 5099 David Crawshaw 3901 Russ Cox 1576 Yasuhiro Matsumoto 1542 Vlad Krasnov 1216 Joel Sing 1190 Robert Griesemer 653 Nan Deng 641 Dave Cheney 610 Mikkel Krautz 560 Kyle Isom 557 Rob Pike 553 Jonathan Rodenberg 499 Shenghou Ma 397 Gautham Thambidorai 395 Brad Fitzpatrick 389 Nevins Bartolomeo 351 Jacob H. Haven 345 Han-Wen Nienhuys 330 Luit van Drongelen 317 Rémy Oudompheng 282 Conrad Meyer 281 Taru Karttunen 280 Paul van Brouwershaven 260 David Leon Gil 241 Roger Peppe 233 Nick Craig-Wood 219 Benjamin Black 211 Jeff Wendling 196 Anthony Martin 167 Andy Davis 159 Peter Mundy 153 Jeff R. Allen 152 Josh Bleecher Snyder 151 Shawn Smith 123 Nick Sullivan
4
Who gits the blame?
21202 Adam Langley 5099 David Crawshaw 3901 Russ Cox 1576 Yasuhiro Matsumoto 1542 Vlad Krasnov 1216 Joel Sing 1190 Robert Griesemer 653 Nan Deng 641 Dave Cheney 610 Mikkel Krautz 560 Kyle Isom 557 Rob Pike 553 Jonathan Rodenberg 499 Shenghou Ma 397 Gautham Thambidorai 395 Brad Fitzpatrick 389 Nevins Bartolomeo 351 Jacob H. Haven 345 Han-Wen Nienhuys 330 Luit van Drongelen 317 Rémy Oudompheng 282 Conrad Meyer 281 Taru Karttunen 280 Paul van Brouwershaven 260 David Leon Gil 241 Roger Peppe 233 Nick Craig-Wood 219 Benjamin Black 211 Jeff Wendling 196 Anthony Martin 167 Andy Davis 159 Peter Mundy 153 Jeff R. Allen 152 Josh Bleecher Snyder 151 Shawn Smith 123 Nick Sullivan
5
1542 Vlad Krasnov 560 Kyle Isom 351 Jacob H. Haven
123 Nick Sullivan
1.0
2012 2013 2014 2015
1.11.2
2016
1.31.4
1.5
1.0
2012 2013 2014 2015
1.11.2
2016
1.31.4
1.5
rrdnscfssl
gokeyless
railgun
RAILGUNDefying Physics on the Web
1.0
2012 2013 2014 2015
1.11.2
2016
1.31.4
1.5
railgun
Encrypted with TLS…huge CPU hog
1.0
2012 2013 2014 2015
1.11.2
2016
1.31.4
1.5
Go Crypto RC4
railgun
Vlad The Compiler
• Assembly implementation of AES-GCM
• In Go master in time for 1.6
Vlad The Compiler
AES-GCM Performance
benchmark old MB/s new MB/s speedup
BenchmarkAESGCMSeal8K 89.31 2559.62 28.66x
BenchmarkAESGCMOpen8K 89.54 2463.78 27.52x
BenchmarkAESGCMSeal1K 86.24 1872.49 21.71x
BenchmarkAESGCMOpen1K 86.53 1721.78 19.90x
AES-GCM Assembly
if hasGCMAsm() {
return &aesCipherGCM{c}, nil
}
src/crypto/aes/gcm_amd64.s
1.0
2012 2013 2014 2015
1.11.2
2016
1.31.4
1.5
Go Crypto RC4
MorsingTime
Go Crypto AES-GCM
Use CSRs
railgunECDSA Certs
CFSSLFull-featured CA
X.509 Certificate Chain Bundler TLS configuration scanner
1.0
2012 2013 2014 2015
1.11.2
2016
1.31.4
1.5
CFSSL
How Railguns Get Keys
22
PKI the whole internal infrastructure
1.0
2012 2013 2014 2015
1.11.2
2016
1.31.4
1.5
CFSSL ECDSA support in x509
CSR Support
Open Source
crypto.Signer: a private key interface
type Signer interface {
Public() PublicKey
Sign(rand io.Reader, msg []byte, opts SignerOpts) (signature []byte, err error)
}
rsa.PrivateKey and ecdsa.PrivateKey both implement Signer
25
PKCS#11github.com/cloudflare/cfssl/crypto/pkcs11key
type PKCS11Key struct {
module *pkcs11.Ctx
slotDescription string
pin string
publicKey rsa.PublicKey
privateKeyHandle pkcs11.ObjectHandle
}
26
PKCS#11
27
func (ps *PKCS11Key) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts) (signature []byte, err error) {
// Verify that the length of the hash is as expectedhash := opts.HashFunc()hashLen := hash.Size()if len(msg) != hashLen {
err = errors.New("input size does not match hash function output size")
return}
// Add DigestInfo prefixmechanism :=
[]*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_RSA_PKCS, nil)}prefix, ok := hashPrefixes[hash]if !ok {
err = errors.New("unknown hash function")return
}signatureInput := append(prefix, msg...)
// Open a sessionsession, err := ps.openSession()if err != nil {
return}defer ps.closeSession(session)
// Perform the sign operationerr = ps.module.SignInit(session, mechanism,
ps.privateKeyHandle)if err != nil {
return}
signature, err = ps.module.Sign(session, signatureInput)return
}
1.0
2012 2013 2014 2015
1.11.2
2016
1.31.4
1.5
CFSSL ECDSA support in x509
CSR Support
crypto.Signer interface
PKCS#11 Support
Open Source
RRDNSAuthoritative DNS Server and DNS Proxy
1.0
2012 2013 2014 2015
1.11.2
2016
1.31.4
1.5
rrdns
Authoritative Servers
31
Cache Poisoning (Kaminsky’s attack)
32
Resolver AuthoritativeServer
Q: what is the IP address of cloudflare.com
A: 198.41.213.157
A: 6
.6.6
.6
A: 6
.6.6
.6 A: 6.6.6.6
A: 6.6.6.6A: 6.6.6.6
A: 6.6.6.6A: 6.6.6.6
Man-in-the-middle
33
ResolverAuthoritative
Server
Q: what is the IP address of cloudflare.com
A: 198.41.213.157A: 6.6.6.6
Solution: DNSSEC (done right)Digital signatures in the DNS
Live-signed answers
Elliptic curve keys
34
github.com/cloudflare/go
• Assembly implementation of P256
• In Go: soon… copyright issues with Intel
Vlad The Compiler
P256 Performance Improvement
ECDSA Sign: 21X
ECDSA Verify: 9X
BaseMult (ECDH): 30X
1.0
2012 2013 2014 2015
1.11.2
2016
1.31.4
1.5
rrdns FilippoTime
DNSSEC Prototype
P256 ASM
DNSSEC Beta
crypto.Signer
???
gokeylesstaking the private key out of TLS
TLS in RSA mode
39
Private Key
TLS in RSA mode - Keyless
40
Private Key
Geography of TLS
41
42
Geography of Keyless SSL
1.0
2012 2013 2014 2015
1.11.2
2016
1.31.4
1.5
gokeyless
keyless (C)
HavenTime
New interface: crypto.Decryptertype Signer interface {
Public() PublicKey
Sign(rand io.Reader, msg []byte, opts SignerOpts) (signature []byte, err error)
}
type Decrypter interface {
Public() PublicKey
Decrypt(rand io.Reader, msg []byte, opts DecrypterOpts) (plaintext []byte, err error)
}
44
Using it in TLSreturn &tls.Config{
Certificates: []tls.Certificate{cert},
RootCAs: SystemRoots,
ServerName: host,
CipherSuites: CipherSuites,
MinVersion: tls.VersionTLS12,
}
45
type Certificate struct {
Certificate [][]byte
PrivateKey crypto.PrivateKey
OCSPStaple []byte
SignedCertificateTimestamps [][]byte
Leaf *x509.Certificate
}
github.com/cloudflare/go
• Assembly implementation of RSA
• In Go 1.5
Vlad The Compiler
RSA Performance
benchmark old ns/op new ns/op delta
BenchmarkRSA2048Decrypt 6696649 3073769 -54.10%
New additions to Go 1.5crypto.Decrypter, crypto.Signer support in x509, tls
AES_256_GCM_SHA384 cipher suites
Faster RSA operations
48
1.0
2012 2013 2014 2015
1.11.2
2016
1.31.4
1.5
gokeyless
keyless (C)
opaque keys in TLS
HavenTime
AES 256 RSA ASM
This is now possible in GoTLS load balancer backed by hardware (PKCS#11, TPM coming soon)
Arbitrary RSA/ECDSA Implementations
50
1.0
2012 2013 2014 2015
1.11.2
2016
1.31.4
1.5
rrdnscfssl
gokeyless
railgun
❤Go Crypto
What’s new in Go Crypto?Nick Sullivan (@grittygrease)
GothamGo
October 2, 2015