Lecture8 Broken Crypto Flashcards
Broken cryptography results from …
Sensitive data exposure through broken or risky cryptography algorithms, mitigations
Enigma Machine
series of electro-mechanical rotor cipher machines
- when turning a disc, it changes the electrical route through the entire cylinder
Hashing
one way function, meant to protect or keep data such as passwords or file secure.
Hashing is the transformation of a string of characters into a usually shorter fixed-length value or key that represents the original string. (digital fingerprint, for certain input there is a deterministic output
It is used to index and retrieve items in a database.
- nothing in the hash that can get you back to the original item
Encryption
Encryption is the process of transforming information using an algorithm to make it unreadable, only to anyone who expect to know the secret key e.g. Enigma machine, WhatsApp,
e.g. Caesar Cipher (except no key is actually required as we can just try every possible shift)
Encoding
Encoding transforms data into another format using a scheme that is publicly available, can be easily reversed e.g.,Base64: contains A-Z, a-z, 0-9, +,/, =SGF2ZSB5b3Ugbm90aGluZyBiZXR0ZXIgdG8gYmUgYXQ/
Note: Encoding is not encryption, it is easily reversed: no key or password required only knowledge of the algorithm
Symmetric Key Encryption
- the sender and receiver share the same key
- Fast and good for bulk encryption e.g., Share your house key with someone
- No secure way to share the key between multiple systems
- e.g., DES
Asymmetric Key Encryption
Symmetric key encryption was created to address the weakness of symmetric key management and distribution.
- Uses two related, but different keys, public key and private key.
- A public key is made available to anyone who might want to send you an encryption message.
- A private key is kept secret
- e.g. mailbox
Digital certificates
- used for transferring public key, a certificate is file of information that identifies a user or a server, contains the organization name, the user’s email address, country and public key.
- Certificate authorities: issues digital certificates, Symantec, GeoTrust…
- e.g., Certificate generation and destruction
Key management
key storage (where you store the key) and key length (what key length is adequate for the data protection)
Overview of of MD5, SHA,RC4, Blowfish algorithms
- Algorithms vary in key length from 40 bits to 448 bits.
- The longer key length, the stronger the encryption algorithm
- Brute force a key of 40 bits -> 1.4 minutes to 0.2 seconds, 64-bit key -> 50 years to 37 days
- 256 bits is considered uncrackable for now, but probably not in the future.
- MD5 (hashing)–a hashing algorithm that uses a random -length input to generate a 128-bit digest, the length ofMD5 is fixed.
e.g. 6A84D15544B770AC43BAC9491A329556 - SHA (Secure Hash Algorithm) –used for digital signature algorithm. (created by NIST)
RC4 –encryption: a symmetric key algorithm
Blowfish–encryption: a 64-bit block cipher
Broken Cryptography
- OWASP Top 10 (no.6) Sensitive Data Exposure
- Sensitive data that requires extra protection but has not been protected
- Data stored in clear text long term, including backups of data.
- Data transmitted in clear text, internally or externally. Internet traffic is especially dangerous.
- Old / weak cryptographic algorithms being used.
- Weak crypto keys generated, or proper key management or rotation is missing.
- Browser security directives or headers missing when sensitive data is provided by / sent to the browser
Sensitive Data Exposure 1
- Threat Agents: Who could gain access to sensitive data and any backups. Including data at rest, in transit, and even in a users browsers.
- Attack Vectors: Attackers typically don’t break crypto directly. They break something else, such as steal keys, do man-in-the-middle attacks, or steal clear text data off the server, while in transit, or from the user ’s browser.
- Security Weakness: Simply not encrypting sensitive data. Then weak key generation and management, and weak algorithm usage, particularly weak password hashing techniques. Browser weaknesses are very common and easy to detect, but hard to exploit on a largescale.
Sensitive Data Exposure 2
- Technical Impacts: Failure frequently compromises all data that should have been protected. Typically, this information includes sensitive data such as health records, credentials, personal data, credit cards, etc.
- Business Impacts: Consider the business value of the lost data and impact to your reputation. What is your legal liability if this data is exposed? Also consider the damage to your reputation
- Examples:
1) Data stored in plain text, e.g. 100 million passwords in text fromvk.com
2) Lack of HTTPS on authenticated pages
3) Hashed passwords with lack of salt, making the password easily cracked
4) Tokens disclosed in public source code, e.g. slack bot token leakage
Obfuscating or Hiding Data
- Encoding is often mistakenly used as a mean of encrypting data. For example the use of base64.
- Storing the cryptographic key on the client side
such as a cryptographic function in JavaScript. - The use of XOR to try obfuscate the plain text.
- Storing obfuscated coupon code on the client side. JavaScript de-obfuscators can be utilised to view how coupons are generated.
Risk factors
Algorithm Problems:
- Insecure algorithm such as DES, MD5, SHA1, AES,
Blowfish
- Choosing the wrong algorithm
- Inappropriate use of an algorithm -Use hash function for encryption. Use encryption algorithm for hashing.
- Implementation errors: Use non-standard cryptographic implementations/libraries.
Key management problems:
- Weak keys
- Key disclosure (leaked)
- Key updates
Random number generator problems
