midterm recap misuse of crypto and future work clipper
play

Midterm Recap Misuse of Crypto and Future Work Clipper chip A - PowerPoint PPT Presentation

Midterm Recap Misuse of Crypto and Future Work Clipper chip A lesson in poorly designed protocols Clipper Clipper Goal: Support encrypted communication Confidentiality between devices Goal: Permit law enforcement


  1. 
 
 Midterm Recap 
 Misuse of Crypto 
 and Future Work

  2. Clipper chip A lesson in poorly designed protocols Clipper Clipper Goal: 
 Support encrypted communication 
 Confidentiality between devices Goal: 
 Permit law enforcement to obtain 
 Key escrow “session keys” with a warrant

  3. Clipper chip: Design Tamper-proof hardware Hardware that is difficult to introspect (e.g., extract keys), Skipjack 
 alter (change the algorithms), or impersonate encryption algorithm Skipjack Keys 
 Unit key 
 Global family key Diffie-Hellman 
 key exchange LEAF generation & validation

  4. 
 Clipper chip: Design Tamper-proof hardware Skipjack 
 Block cipher designed by the 
 encryption algorithm NSA, originally classified 
 SECRET. Skipjack Keys 
 (Violates Kirchhoff’s principle) Unit key 
 Global family key Broken within one day of declassification. Diffie-Hellman 
 key exchange 80-bit key; similar algorithm to DES (also broken) LEAF generation & validation

  5. Clipper chip: Design Tamper-proof hardware Skipjack 
 Assigned when the hardware 
 encryption algorithm is manufactured. Unit key is unique to this unit 
 Skipjack Keys 
 in particular (each Clipper chip 
 Unit key 
 also has a unit ID ). Global family key Global family key is the same 
 Diffie-Hellman 
 across many units. key exchange LEAF generation & validation

  6. Clipper chip: Design Tamper-proof hardware Skipjack 
 Used for establishing a 
 encryption algorithm (symmetric) session key Session keys are ephemeral Skipjack Keys 
 (e.g., last only for a given Unit key 
 connection, transaction, etc.) Global family key General properties about Diffie-Hellman 
 session keys: key exchange • Compromising one session key 
 does not compromise others • Compromising a long-term key 
 LEAF generation should not compromise past 
 & validation session keys ( forward secrecy )

  7. Clipper chip: Design Tamper-proof hardware LEAF 
 Skipjack 
 (Law Enforcement Access Field) encryption algorithm To permit wiretapping, law 
 enforcement needs to be able 
 Skipjack Keys 
 to extract session keys, but 
 Unit key 
 only has access to what is sent 
 Global family key during communication Diffie-Hellman 
 key exchange Idea : send data that has enough 
 info to allow law enforcement 
 to extract keys (but not any 
 LEAF generation other eavesdropper). & validation

  8. LEAF protocol design 1. DH key exchange 2. Each send LEAF packet Clipper Clipper 3. Send data encrypted 
 with the session key The Clipper chips will not decrypt until 
 it has received a valid LEAF packet Law enforcement sees all packets. • Cannot infer key from DH key exchange • Can infer it from the LEAF packet

  9. LEAF message structure Session key 80 bits Other 
 variables Unit Key Skipjack Hash algorithm 16 bits Unit ID Encrypted session key Hash Global family key Skipjack LEAF

  10. LEAF message structure Session key 80 bits Other 
 variables The other Clipper chip also has the Global Family key Unit Key Skipjack Hash algorithm => Can decrypt the LEAF to obtain this triple 16 bits Unit ID Encrypted session key Hash Global family key Skipjack LEAF

  11. LEAF message structure Session key 80 bits Other 
 variables Unit Key Skipjack Hash algorithm 16 bits The other Clipper chip “verifies” the LEAF by making sure that 
 Unit ID Encrypted session key Hash the hash is correct Global family key Skipjack LEAF

  12. LEAF message structure Session key 80 bits Other 
 variables Law enforcement also has the Global Family Key Unit Key Skipjack Hash algorithm => Can decrypt the LEAF to obtain this triple 16 bits Unit ID Encrypted session key Hash Global family key Skipjack LEAF

  13. LEAF message structure Session key 80 bits Other 
 variables Unit Key Skipjack Hash algorithm 16 bits Unit ID Encrypted session key Hash Law enforcement does not have direct access 
 Global family key Skipjack to all unit keys; needs a warrant to get them Unit keys are split across two locations LEAF (one location gets a OTP, the other gets the XOR)

  14. LEAF: failure Session key 80 bits Other 
 variables Unit Key Skipjack Hash algorithm To verify the LEAF, 
 the otherClipper chip 
 16 bits only checks the hash Unit ID Encrypted session key Hash Clipper chips also allow you to 
 test a LEAF locally Global family key Skipjack LEAF

  15. LEAF: failure Session key 80 bits Other 
 variables Unit Key Skipjack Hash algorithm 16 bits Generate a random LEAF => 
 Unit ID Encrypted session key Hash 1/2 16 chance of a valid hash Unit ID Encrypted session key Hash Global family key Skipjack Validates at the other 
 But law enforcement will just 
 Clipper chip (so it will 
 see random ID & key LEAF decrypt messages)

  16. Misusing crypto Avoid shooting yourself in the foot: • Do not roll your own cryptographic mechanisms • Takes peer review • Apply Kerkhoff’s principle • Do not misuse existing crypto • Do not even implement the underlying crypto

  17. A paper from 2013 that looked at how Android 
 apps use crypto, as a function of 6 “rules” that reflect 
 the bare minimum a secure programmer should know:

  18. A paper from 2013 that looked at how Android 
 apps use crypto, as a function of 6 “rules” that reflect 
 the bare minimum a secure programmer should know: 1. Do not use ECB mode for encryption. Period.

  19. A paper from 2013 that looked at how Android 
 apps use crypto, as a function of 6 “rules” that reflect 
 the bare minimum a secure programmer should know: 1. Do not use ECB mode for encryption. Period. 2. Do not use a non-random IV for CBC encryption.

  20. A paper from 2013 that looked at how Android 
 apps use crypto, as a function of 6 “rules” that reflect 
 the bare minimum a secure programmer should know: 1. Do not use ECB mode for encryption. Period. 2. Do not use a non-random IV for CBC encryption. 3. Do not use constant encryption keys .

  21. A paper from 2013 that looked at how Android 
 apps use crypto, as a function of 6 “rules” that reflect 
 the bare minimum a secure programmer should know: 1. Do not use ECB mode for encryption. Period. 2. Do not use a non-random IV for CBC encryption. 3. Do not use constant encryption keys . 4. (see paper)

  22. A paper from 2013 that looked at how Android 
 apps use crypto, as a function of 6 “rules” that reflect 
 the bare minimum a secure programmer should know: 1. Do not use ECB mode for encryption. Period. 2. Do not use a non-random IV for CBC encryption. 3. Do not use constant encryption keys . 4. (see paper) 5. (see paper)

  23. A paper from 2013 that looked at how Android 
 apps use crypto, as a function of 6 “rules” that reflect 
 the bare minimum a secure programmer should know: 1. Do not use ECB mode for encryption. Period. 2. Do not use a non-random IV for CBC encryption. 3. Do not use constant encryption keys . 4. (see paper) 5. (see paper) 6. Do not use static seeds to seed SecureRandom(.)

  24. Crypto misuse in Android apps 15,134 apps from Google play used crypto; Analyzed 11,748 of them

  25. Crypto misuse in Android apps 15,134 apps from Google play used crypto; Analyzed 11,748 of them 48% 31% 17% 16% 14% 12%

  26. Crypto misuse in Android apps 15,134 apps from Google play used crypto; Analyzed 11,748 of them 48% 31% 17% 16% 14% 12%

  27. 
 BouncyCastle defaults • BouncyCastle is a library that conforms to Java’s Cipher interface: Cipher c = 
 Cipher.getInstance(“AES/CBC/PKCS5Padding”); // Ultimately end up wrapping a ByteArrayOutputStream 
 // in a CipherOutputStream • Java documentation specifies:

  28. Crypto misuse in Android apps 15,134 apps from Google play used crypto; Analyzed 11,748 of them 48% 31% 17% 16% 14% 12%

  29. Crypto misuse in Android apps 15,134 apps from Google play used crypto; Analyzed 11,748 of them 48% 31% 17% 16% 14% 12% A failure of the programmers to know the tools they use A failure of library writers to provide safe defaults

  30. Misusing crypto Avoid shooting yourself in the foot: • Do not roll your own cryptographic mechanisms • Takes peer review • Apply Kerkhoff’s principle • Do not misuse existing crypto • Do not even implement the underlying crypto

  31. Why not implement AES/RSA/etc. yourself? • Not talking about creating a brand new crypto scheme, just implementing one that’s already widely accepted and used. • Kerkhoff’s principle: these are all open standards; should be implementable. • Potentially buggy/incorrect code, but so might be others’ implementations (viz. OpenSSL bugs, poor defaults in Bouncy castles, etc.) • So why not implement it yourself?

  32. Side-channel attacks • Cryptography concerns the theoretical difficulty in breaking a cipher Input 
 Output 
 Cryptographic processing 
 message message (Encrypt/decrypt/sign/etc.) Secret keys

  33. Side-channel attacks • Cryptography concerns the theoretical difficulty in breaking a cipher Input 
 Output 
 Cryptographic processing 
 message message (Encrypt/decrypt/sign/etc.) Secret keys • But what about the information that a particular implementation could leak? • Attacks based on these are “ side-channel attacks ”

Recommend


More recommend