L6 - Cryptography Flashcards
Cryptographic failures
- Not properly protecting sensitive data.
– Example
1. No appropriate encryption or hashing for credit cards
and authentication credentials.
2. No SSL to protect sensitive data in transit.
3. Password database uses unsalted hashes to store
passwords.
Impact of cryptographic failures
– Compromises of all data that should be protected
Commo probelms
– Not encrypting sensitive data.
– Using home grown algorithms.
– Insecure use of strong algorithms.
– Continued use of proven weak algorithms.
– Hard coding keys, and storing keys in unprotected stores.
Sensitive data exposure prevention
- Store as little sensitive information as possible.
- Ensure appropriate strong cryptographic algorithms and strong keys are used.
- Ensure proper key management is in place.
- Ensure passwords are hashed with a strong hash algorithm and an appropriate salt is used.
- Disable autocomplete on forms and caches for pages that contain sensitive data.
Cryptographic algorithm type classes
– SymmetricAlgorithm
– AsymmetrickAlogorithm
– HashAlgorithm
Symmetric Alogrithms
- Encryption and decryption use the same secret key
- Primary attack is “brute force” key search –(try every possible key)
- Key distribution and storage is difficult
- Relatively fast
- Advanced Encryption Standard (AES)
– US government standard since 2001 (replaced DES)
– Rijndael algorithm (with 128 bit block size)
Types of symmetric algorithms
- Stream Algorithms (Stream Ciphers) operate directly on a stream of bytes and encrypt the bits of information one bit or 1 byte at a time. These algorithms are faster than block ciphers.
- Block Algorithms (Block Ciphers) encrypt information by breaking it down in fixed-length groups-blocks of bits (usually 64 bits) and encrypting one block at a time. Block algorithms are most commonly used in the IT world today.
Symmetric algorithms classes
DES, TripleDES, RC2, Rijndael, AES
Encryption/Decryption using Symmetric Algorithm
Encrypt
* Generate Random Key
* Generate Initialization Vector (IV)
* Use CreateEncryptor() to produce ciphertext
* Store both the Key and IV into DB
Decrypt
* Retrieve Key and IV from DB
* Use CreateDecryptor() to produce plaintext
Asymmetric Algorithm
– Is also known as public key cryptography.
– Uses two keys instead of one.
– Public key systems typically work using difficult math problems known as trapdoor functions
- Generally 100-1000 times slower than symmetric algorithms
Asymmetric Algorithm classes
RSA, DSA
Encryption and decryption using RSA Algorithm
– Create instance of RSA CSP (new keys generated by default).
– Import keys (if required)
– Convert input string to byte[]
– Encrypt
– Resulting byte[] is cipher text
– Create instance of RSA CSP (new keys generated by default).
– Import keys (private)
– Decrypt
– Resulting byte[] is plain text
- Convert to string
Problems of symmetric algorithm and asymmetric algorithm
- Symmetric algorithm has problem of key distribution.
- Asymmetric is computationally expensive. (slow)
– As asymmetric algorithms are inherently blocking ciphers (RSA), implementations can only encrypt block by block.
Symmetric algorithm vs asymmetric algorithm
Symmetric
◼ Uses ONE key to:
❑ Encrypt data
❑ Decrypt data
◼ Is fast & efficient
Asymmetric
◼ Uses TWO related keys:
❑ Public key to encrypt data
❑ Private key to decrypt data
❑ OR vice versa
◼ Is more secure than symmetric encryption
◼ Is slower than symmetric encryption
Hashing
A hash is a special mathematical function that performs one-way [encryption].
- Creates digest
- Irreversible
