JVM Encryption Boot Camp 0.4.3

TI
YP P ON
C R AM
EN T C
B OOurity
is th e mi ssion
Sec

© Matthew McCullough, Ambient Ideas, LLC
Sunday, April 25, 2010

SECURITY
What’s ON THE J
your po VM
sition?


HACK ATT
EMPTS PE
in R the bi
llions D AY


G? ot
TINbly n
YP oba
ENCR pr
say
st atis tics


delicious.com/matthew.mccullough/encryption

ANCIENT HISTORY
Everything old is new again


new
this oss”
over uff b
all n st
“I’m yptio
encr


44 B.C.

44 B.C.
That’s 2,054 years ago...


Julius Caesar


Caesar Cipher
a.k.a.
ROT(2)
Shift Cipher

A B C D E F G

A B C D E F G


Caesar Cipher
a.k.a.
ROT(2)
Shift Cipher


Caesar Cipher


Caesar Cipher

Z M S R


Caesar Cipher

Z M S R

30s 25s 20s 15s 10s 5s Stop

Caesar Cipher

Z M S R
A N T S if encrypted with ROT(-1)


Caesar Cipher

Z M S R
A N T S if encrypted with ROT(-1)
B O U T if encrypted with ROT(-2)


/**
* A naively simple rotation cipher implementation.
* USAGE: groovy RotateWord.groovy <yourword>
*/
public class RotateWord {

/**
* Rotate one character by the specified amount
*/
private static char rotateChar(char c, int rotationAmount) {
//a == 97, z == 122
int num = (int)c
int rotated = num + rotationAmount
int adjusted

//Handle roll-around wrapping

/**
* A naively simple rotation cipher implementation.
* USAGE: groovy RotateWord.groovy <yourword>
*/

/**
*/
//a == 97, z == 122
int num = (int)c
int adjusted

if (rotated > 122)
adjusted = rotated - 26
else if (rotated < 97)
adjusted = rotated + 26
else
adjusted = rotated


/**
*/
//a == 97, z == 122
int num = (int)c
int adjusted

if (rotated > 122)
else
adjusted = rotated

char adjustedChar = (char)adjusted
return adjustedChar
}

/**

//a == 97, z == 122
int num = (int)c
int adjusted

if (rotated > 122)
else
adjusted = rotated

return adjustedChar
}

/**
* Rotate the entire String by the specified rotation amount.
*/
public static String rotateAllChars(String plainText, int rotationAmount) {
String encodedMessage = ""

else
adjusted = rotated

return adjustedChar
}

/**
*/

//Loop through each character in the plaintext
for (int i = 0; i < plainText.length(); i++) {
//TODO: Improve to handle upper and lower case letters
char c = plainText.toLowerCase().charAt(i)
encodedMessage += rotateChar(c, rotationAmount)
}

return encodedMessage
}

return adjustedChar
}

/**
*/

//Loop through each character in the plaintext
for (int i = 0; i < plainText.length(); i++) {
//TODO: Improve to handle upper and lower case letters
char c = plainText.toLowerCase().charAt(i)
encodedMessage += rotateChar(c, rotationAmount)
}

return encodedMessage
}

public static void main (String[] args) {
String originalword = args[0]
println "Rot(-3) Word: " + rotateAllChars(originalword, -3)

public static void main (String[] args) {
String originalword = args[0]
println "Original Word: ${originalword}"
println "Rot(1) Word: " + rotateAllChars(originalword, 1)
println "Rot(2) Word: " + rotateAllChars(originalword, 2)
}
}


BROKEN
Perfectly safe data is a myth


Compromised


Compromised
! Every algorithm is vulnerable


Compromised
! Crack by brute force


Compromised
! Crack by rainbow tables


Compromised
! Crack by rainbow tables
! Function of time + money +
hardware


$2000

$ 50


$2000

Whic
h wo
uld y
ou hit
$ 50 ?


JCE PRIMER
The world of Java crypto


Java Cryptography Extension

Known as JCE
Included in all JREs Since Java 1.2
Pluggable provider architecture
JCE extends Java Cryptography
Architecture (JCA)


JCE Providers

Default Sun JRE Providers
SUN
SunJCE
SunJSSE
SunRsaSign
BouncyCastle Provider
Adds AES capabilities


Registering a Provider

Static
<java-home>/lib/security/java.security
security.provider.n=masterClassName


Registering a Provider

Dynamic
! java.security.Security class
addProvider()
insertProviderAt()
! Not persistent across VM instances


Encryption &
the Law
country borders stop bits


JCE Strength

! Jurisdiction Policy Files
! Two variants
! Algorithm strength differences


Unlimite
d


JCE Strength


JCE Strength

Strong strength included in all JREs


JCE Strength

Strong strength included in all JREs
Unlimited strength is a separate download
available based on US export rules


Worldwide Policy
// File: default_local.policy
// Some countries have import limits on crypto strength.
// This policy file is worldwide importable.
grant {
permission javax.crypto.CryptoPermission "DES", 64;
permission javax.crypto.CryptoPermission "DESede", *;
permission javax.crypto.CryptoPermission "RC2", 128,
"javax.crypto.spec.RC2ParameterSpec", 128;
permission javax.crypto.CryptoPermission "RC4", 128;
permission javax.crypto.CryptoPermission "RC5", 128,
"javax.crypto.spec.RC5ParameterSpec", *, 12, *;
permission javax.crypto.CryptoPermission "RSA", 2048;
permission javax.crypto.CryptoPermission *, 128;
};


Max Key Sizes
Algorithm Max Key Size
DES 64
DESede 168
3des

RC2 128
RC4 128
RC5 128
RSA 2048
Others 128


Digests &
Hashes
One way functions


What is a Digest?

Small set of bytes representing a large
message
Small change in message = large change in
digest
Integrity check for large data
Password storage mechanism


MessageDigest


MessageDigest

! java.security.MessageDigest


MessageDigest

! Multiple algorithms available


MessageDigest

! MD5 (128 bit)


MessageDigest

! MD5 (128 bit)
! SHA-1 (160 bit)


MessageDigest

! MD5
! U. S. Department of Homeland Security
said MD5
"considered cryptographically broken and
unsuitable for further use"


System.out.println("Message1 SHA1 digest: "
+ shaAndBase64Encode(message1));
}

/**
* Helper function to both SHA-1 hash and
* base64 encode the resulting bytes to a String
*/
public static String shaAndBase64Encode(String message)
throws NoSuchAlgorithmException {
MessageDigest sha = MessageDigest.getInstance("SHA-1");

//Salt could be applied here
//Integer salt = <some random number generator>
//sha.update(salt.getBytes());

byte[] digest = sha.digest(message.getBytes());
return new sun.misc.BASE64Encoder().encode(digest);
}
}


*
* Demonstrate that very similar messages
* have radically different hashes.
*/
public class MessageDigestSHA
{
public static void main( String[] args )
throws NoSuchAlgorithmException
{
//Set up the message to be encoded
String message1 = "Four score and seven years ago";
String message2 = "Four score and seven tears ago";

}

/**
* Helper function to both SHA-1 hash and
* base64 encode the resulting bytes to a String
*/
public static String shaAndBase64Encode(String message)
throws NoSuchAlgorithmException {
MessageDigest sha = MessageDigest.getInstance("SHA-1");

Input
String message2 = "Four score and seven tears ago";

Result
Message1 SHA1 digest: DmCJIg4Bq/xpGIxVXxo3IB0vo38=
Message2 SHA1 digest: oaLHt8tr31ttngCDjyYuWowF5Mc=


SYMMETRIC
My key is your key


Sensitive
Data

ht
Sig
ain
Pl

Sensitive
Data

Recipient
or
Storage

ht
Sig
ain
Pl

Sensitive
Data

Recipient
or
Storage

ht
Sig r ed
cu

ain ts
O
b s

Pl C
on
te
n

Sensitive
Data

Why Symmetric?


Why Symmetric?

! Fast


Why Symmetric?

! Fast
! Well suited for bulk data


Using Symmetric


Using Symmetric

Secure network for passing keys
or


Using Symmetric

Secure network for passing keys
or
Never decrypted at remote end


Symmetric Problems


Symmetric Problems

Keys vulnerable to capture


Symmetric Problems

Eavesdropping on future communications
after key compromise


Symmetric Problems

Key distribution challenges


Symmetric Problems

Key distribution challenges
Triangular number key growth


Symmetric Problems
! Triangular number key growth


Symmetric

A B


Symmetric

A Message/File B


Symmetric
A’s
256 bit
symmetric
key

A Message/File B


Symmetric
Encrypted with
256 bit symmetric key
A’s
256 bit
symmetric
key

A Message/File B


SYMMETRIC
Block versus Stream Algorithms


Stream vs. Block


Stream vs. Block

Specific algorithms for each


SYMMETRIC (BLOCK)


Block


Block

Predefined content length


Block

Well-known end to the content


Block

Files on disk


Block

Files on disk
Inefficient when padding


DES

Data Encryption Standard
Block cipher
Banking industry
DES is known to be broken


3DES

Data Encryption Standard
Block cipher
a.k.a DESede
Basically three passes of DES
Reasonably strong


Blowfish

Block cipher
Unpatented (intentionally)
Secure replacement for DES
Faster than DES
32 to 448 bit keys
Overshadowed by AES


AES

Advanced Encryption Standard
Block cipher
Government standard
Rijndael algorithm
(Joan Daemen, Vincent Rijmen)
4 years of evaluation
Final in December 2000
Very Secure


SYMMETRIC (STREAM)


Stream


Stream

Unknown content length


Stream

Streaming video


Stream

Streaming video
Streaming voice


Stream

Streaming video
Streaming voice
Similar to One-Time Pads


RC4


RC4

Rivest’s Code 4


RC4

Rivest’s Code 4
Stream cipher


RC4

Rivest’s Code 4
Stream cipher
Trademarked (name, but not algorithm)


RC4

Rivest’s Code 4
Stream cipher
Used by


RC4

Rivest’s Code 4
Stream cipher
Used by
Browsers in SSL, TLS


RC4

Rivest’s Code 4
Stream cipher
Used by
WiFi in WEP WPA
,


RC4

Rivest’s Code 4
Stream cipher
Used by
WiFi in WEP WPA
,
BitTorrent


RC4

Rivest’s Code 4
Stream cipher
Used by
WiFi in WEP WPA
,
BitTorrent
ssh


RC4

Rivest’s Code 4
Stream cipher
Used by
WiFi in WEP WPA
,
BitTorrent
ssh
Microsoft RDP


RC4

Rivest’s Code 4
Stream cipher
Used by
WiFi in WEP WPA
,
BitTorrent
ssh
Microsoft RDP
PDF


A5/1


A5/1

A5/1


A5/1

A5/1
Secret, unpublished


A5/1

A5/1
Secret, unpublished
Reverse engineered


A5/1

A5/1
Secret, unpublished
Reverse engineered
Used by GSM phones


import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;

import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.KeyGenerator;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.SecretKey;

import sun.misc.BASE64Encoder;

/**
* Use the SecureRandom java security class to generate
* a more expensive, but cryptographically secure random number.
*/
public class SymmetricEncrypt
{
throws NoSuchAlgorithmException, NoSuchProviderException,
NoSuchPaddingException, InvalidKeyException,
IllegalBlockSizeException, BadPaddingException
{
final String message1 = "Four score and seven years ago";


/**
*/
public class SymmetricEncrypt
{
throws NoSuchAlgorithmException, NoSuchProviderException,
NoSuchPaddingException, InvalidKeyException,
{

//Build a new encryption key
final KeyGenerator keyGen = KeyGenerator.getInstance("DESede");
keyGen.init(168);
final SecretKey desKey = keyGen.generateKey();

//Set up the cipher
final Cipher desCipher = Cipher.getInstance("DESede/ECB/PKCS5Padding");

//////////////////////////////////////
//Put the cipher in encryption mode
desCipher.init(Cipher.ENCRYPT_MODE, desKey);

//Encrypt and output the base64 data
byte[] clearText = message1.getBytes();
byte[] encryptedBytes = desCipher.doFinal(clearText);
BASE64Encoder b64e = new sun.misc.BASE64Encoder();


//Build a new encryption key
final KeyGenerator keyGen = KeyGenerator.getInstance("DESede");
keyGen.init(168);
final SecretKey desKey = keyGen.generateKey();

//Set up the cipher

//////////////////////////////////////

String base64Encrypted = b64e.encode(encryptedBytes);
System.out.println("Encrypted text: " + base64Encrypted);

//////////////////////////////////////
//Put the cipher in decryption mode
desCipher.init(Cipher.DECRYPT_MODE, desKey);

//Decrypt and output the original string
byte[] decryptedBytes = desCipher.doFinal(encryptedBytes);
String decryptedText = new String(decryptedBytes);
System.out.println("Decrypted text: " + decryptedText);
}
}

//Set up the cipher

//////////////////////////////////////


//////////////////////////////////////
//Put the cipher in decryption mode
desCipher.init(Cipher.DECRYPT_MODE, desKey);

//Decrypt and output the original string
byte[] decryptedBytes = desCipher.doFinal(encryptedBytes);
}
}


Input

Result
Encrypted text: P0FT6N3XXrohtsz7OLh3FGYY0wErkPIur1DP6Csbj4g=
Decrypted text: Four score and seven years ago


ENCRYPTED = SAFE,
RIGHT?
information leakage from encrypted data


Encrypted isn’t enough?

http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation

SECURE KEY EXCHANGE
securely swapping symmetric keys


Diffie-Hellman


Diffie-Hellman

Key Agreement Protocol


Diffie-Hellman

Alice & Bob independently generate the shared
(session) key


Diffie-Hellman

(session) key
Published 1976, but invented earlier


Diffie-Hellman

(session) key
Vulnerable to MITM attack


Diffie-Hellman

(session) key
Fixed by PKI


Diffie-Hellman

(session) key
Fixed by PKI
and signing the agreed key


DH Diagrammed

A B


DH Diagrammed
predetermined and openly shared

A B


DH Diagrammed
g = random
g = 11

A B


DH Diagrammed
g = random p = prime
g = 11 p = 23

A B


DH Diagrammed
g = 11 p = 23

picks a = 6 picks b = 4
A B


DH Diagrammed
g = 11 p = 23

A A= ga mod p B B= gb mod p


DH Diagrammed
g = 11 p = 23

9=116 mod 23 13=114 mod 23


DH Diagrammed
g = 11 p = 23

9=116 mod 23 13=114 mod 23

B=13 A=9


DH Diagrammed
g = 11 p = 23

9=116 mod 23 13=114 mod 23

B=13 A=9

K= Ba mod p K= Ab mod p


DH Diagrammed
g = 11 p = 23

9=116 mod 23 13=114 mod 23

B=13 A=9

6= 136 mod 23 6= 94 mod 23


DH Diagrammed
g = 11 p = 23

9=116 mod 23 13=114 mod 23

B=13 A=9

6= 136 mod 23 6= 94 mod 23
Encryption can begin

RANDOM NUMBERS
Seed the machine


SecureRandom

java.security.SecureRandom
Cryptographically strong random number
generator (RNG)
“Unable to distinguish from a true random
source”
Used in combination with many ciphers


package com.ambientideas;

import java.security.SecureRandom;

/**
*/
public class SecureRandomNumber
{
public static void main( String[] args ) throws
NoSuchAlgorithmException
{
//Do the expensive one time setup of the
Sunday, April 25, 2010 // random number generator instance


/**
*/
{
{
// random number generator instance
SecureRandom prng = SecureRandom.getInstance("SHA1PRNG");

//Get the next random number
String randomNum = new Integer( prng.nextInt() ).toString();

System.out.println("Random number: " + randomNum);
}
}


*/
{
{
// random number generator instance
SecureRandom prng = SecureRandom.getInstance("SHA1PRNG");

//Get the next random number
String randomNum = new Integer( prng.nextInt() ).toString();

System.out.println("Random number: " + randomNum);
}
}


Result

Random number: 1633471380


ASYMMETRIC
Throwing away keys
faster than an intern locksmith


RSA

Ron Rivest, Adi Shamir, Leonard Adleman
Published in 1978
M.I.T. Patented in 1983
Patent Expired in 2000


http://xkcd.com/538/

RSA

A B


RSA

A Message/File B


RSA
B’s
2048 bit
public key

A Message/File B


RSA
Encrypted with
2048 bit RSA key

A Message/File B


RSA
Encrypted with
2048 bit RSA key
B’s
2048 bit
private key

A Message/File B


import java.io.IOException;
import java.security.InvalidKeyException;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchProviderException;
import java.security.PrivateKey;
import java.security.PublicKey;

import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;


/**
* a more expensive, but cryptographically secure random
number.

NoSuchAlgorithmException, NoSuchProviderException,
IOException, NoSuchPaddingException, InvalidKeyException,
{

// Generate the Key Pair
final KeyPairGenerator keyGen =
KeyPairGenerator.getInstance("RSA");

final SecureRandom random =
SecureRandom.getInstance("SHA1PRNG", "SUN");
keyGen.initialize(1024, random);

KeyPair pair = keyGen.generateKeyPair();

final PrivateKey privKey = pair.getPrivate();
final PublicKey pubKey = pair.getPublic();

//Encrypt using the private key
Cipher rsa = Cipher.getInstance("RSA/ECB/PKCS1Padding");
rsa.init(Cipher.ENCRYPT_MODE, privKey);
byte[] encryptedBytes = rsa.doFinal(message1.getBytes());

KeyPair pair = keyGen.generateKeyPair();

final PrivateKey privKey = pair.getPrivate();


//Decrypt using the private key
rsa.init(Cipher.DECRYPT_MODE, pubKey);
byte[] decryptedBytes = rsa.doFinal(encryptedBytes);
}
}




//Decrypt using the private key
rsa.init(Cipher.DECRYPT_MODE, pubKey);
byte[] decryptedBytes = rsa.doFinal(encryptedBytes);
}
}


Input

Result
Encrypted text: A8Is+4r7sDn28fD6IQvZiR5JxPs/vh7UnXrF38acJt6R/
ARisj/zLtC7Xn6iJgNQPhc16wkVZhCF
em7oNoim+ooTUDDZQ+E3qP6y/
DZJGkLBoZuZVLeLAW1LUtHSzduRUOg1uMynJz14wxzwfV8wfRwf
atpySkOhGqWS63bPNRs=
Decrypted text: Four score and seven years ago


BLENDED
symmetric with a twist of asymmetric


Key Size & Security


Key Size & Security
160 bit DES

Symmetric
Key Size


Key Size & Security

1024 bit RSA
Asymmetric
Key Size
160 bit DES

Symmetric
Key Size


Key Size & Security

1024 bit RSA
Asymmetric
Key Size
160 bit DES

Symmetric
Key Size
112 bits

Security


Key Size & Security

1024 bit RSA
Asymmetric
Key Size
160 bit DES

Symmetric
Key Size
112 bits

128 bits
Security Security


Encryption Speed

asymmetric can be 1000x slower
than symmetric


PGP

A B


PGP

A B

Message/File


PGP

Random generated

A B

Message/File


PGP

Random generated

Encrypted with

A B

Message/File


PGP
B’s
2048 bit
public key Random generated

Encrypted with

A B

Message/File


PGP
Encrypted with
2048 bit RSA key

Random generated

Encrypted with

A B

Message/File


PGP
Encrypted with
2048 bit RSA key
B’s
2048 bit
Random generated private key

Encrypted with

A B

Message/File


OTHER FRAMEWORKS
and alternative JCE providers


Bouncy Castle
JCE Provider
Many more encryption and digest
algorithms than the Sun provider (AES)


Jasypt
Frictionless Java encryption


Gnu
Open source library


In Summary
Encrypted does not guarantee security
ECB can be leaky
Hash vs. Encrypt
Know when to apply each
Know your algorithm
Key strength
Symmetric versus asymmetric
High Level Libraries
More productive than pure JCE


Th anks in advanc e for
yo ur com pleted evals!


OT CA MP
TI ON BOission
RYPrity is the M
ENC cu
Se

Matthew McCullough
Email matthewm@ambientideas.com
Twitter @matthewmccull
Blog http://ambientideas.com/blog


REFERENCES


References

Sun docs
http://java.sun.com/javase/6/docs/technotes/
guides/security/crypto/CryptoSpec.html
http://java.sun.com/javase/technologies/security/
http://java.sun.com/javase/6/docs/technotes/
guides/security/jsse/JSSERefGuide.html
http://java.sun.com/javase/6/docs/api/java/
security/Security.html

BouncyCastle JCE Provider
http://www.bouncycastle.org/documentation.html


References

Sample Code
http://github.com/matthewmccullough/
encryption-jvm-bootcamp
Miscellaneous
http://www.ietf.org/rfc/rfc3852.txt
http://en.wikipedia.org/wiki/
Abstract_Syntax_Notation_One


Acronyms

CMS
Cryptographic Message Syntax (CMS) objects
RFC 3852
PKCS#7 (formerly RFC 2630, 3369)
http://www.ietf.org/rfc/rfc3852.txt
ASN.1
Abstract Syntax Notation One
1984 X.409, 1988 X.208, 1995 X.680, 2002
http://www.asn1.org/


CREDITS


http://www.ambientideasphotography.com
http://stockfootageforfree.com/
http://xkcd.com/538/
http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation
http://matdonline.free.fr/RSA-Difﬁe-Hellman-explained-in-5-minutes.htm
http://www.isg.rhul.ac.uk/node/329
http://www.isg.rhul.ac.uk/ﬁles/IMG_9819.JPG
http://www.usc.edu/dept/molecular-science/pictures/RSA-2003.jpg
All others, iStockPhoto.com


STUDY NOTES


Major Encryption Types

Pre-agreed Phrases (Concept)
Simplest form of symmetric encryption.
Have to meet in person to pass keys around
DHM Key Exchange (Concept, Algorithm)
Requires both parties to be online
This is a drawback
RSA (Algorithm)
Added asynchronous behavior with pub priv keys
Keys are permanent (not generated each time)
PGP (Concept, Algorithm)
Added speed to RSA by encrypting the payload


Data Integrity

Checksums needed
Harder to maintain with encryption?
Block versus stream cipher
Block: XOR all previous nodes
Stream: XOR some “forward” packets
Recovery once one packet is lost?


Replay Attacks
Consider vulnerability to replay
Problem: ECB (block) mode
Same packet encrypted next time looks
the same
Hardening: XOR to protect
Still vulnerable to entire stream replay
Entire stream hard to capture


JVM Encryption Boot Camp 0.4.3

Recommandé

Recommandé

Contenu connexe

Plus de Matthew McCullough

Plus de Matthew McCullough (20)

Dernier

Dernier (20)

JVM Encryption Boot Camp 0.4.3