start	end	text
3700	7820	Very good afternoon, good evening, or even good morning,
7820	11500	depending on which time zone you are listening to this talk from.
11960	17020	Isn't it interesting how we all are so very well virtually connected through this platform?
17020	24840	And for this to happen, I'd like to give a huge shout-out to the Crypto Village organizing community for making this happen.
24920	31460	I know it has been hard in the middle of this global pandemic, but we are still connected. That's great.
32840	37220	It's always a good idea to introduce yourself. I'm Manasi Sheth.
37220	43860	I work as a principal security researcher for a leading static analysis company called Veracode.
43860	46820	We are located just outside Boston.
47420	54660	We have over 2,000 unique customers across different verticals using all kinds of programming languages.
54660	63680	What my job is there is to be on top of all the latest and greatest happenings in the security domain,
63680	66800	more specifically in the application security domain,
66800	71800	see how those things are implemented by different languages and frameworks,
72240	78480	and then translate all that knowledge into finding anti-patterns in our customers' code bases.
78840	83540	I'm not a cryptologist or a crypto analyst or even a mathematician.
83540	89020	I'm just a huge crypto enthusiast like a lot of people here.
89020	93180	I like to be on top of all the practical aspects of cryptography.
93180	103340	I've spent a lot of time understanding details of different crypto primitives and crypto mini systems.
103680	108960	I've seen a lot of crypto implementations across languages.
108960	115240	And I try to use all this information to make sure our customers' code bases are secure.
118040	120120	So why cryptography?
120660	123480	Well, I think cryptography is everywhere.
124600	129220	It's the basis of a lot of things you are currently seeing around you.
129220	133980	You would be connected through Wi-Fi. You would be having some Bluetooth devices.
133980	137780	You might be using e-wallets to buy coffee or something.
137780	145320	You might be looking at emails. You are listening to this through a video conferencing software which is supposed to be secure.
145780	148740	You might be doing some Bitcoin mining.
148740	154000	What I'm trying to say is it's everywhere. It's used right now by you, your family, your friends.
154560	160900	Everyone you know and care about and hope are secure enough from any kind of online threats.
162260	168240	In this hyper-connected world, we rely a lot on crypto to keep us secure.
168240	179100	We rely on a lot of crypto services like confidentiality of our digital assets or authenticity and integrity of our digital transactions.
179100	183060	Like maybe e-banking or e-wallets or whatever.
183640	189180	Or maybe code signing of a software we are trying to buy.
189180	197020	We need cryptography to help us be secure for all these things and much, much more than that.
197740	200600	Then why are we seeing so many crypto failures?
201460	207980	Well, I'm sure a lot of people would be having this reaction like, oh no, not again. Why are things failing now?
207980	216880	This is going to break so many new protocols and so many different protocols across different systems and how to mitigate it.
217640	219060	It's like this.
219880	225880	Thinking a little deeper while looking at different use cases of crypto failures.
225900	230160	What I feel is cryptography is hard.
230460	238120	Only more than a couple of dozens of people across decades completely understand all aspects of cryptography.
238120	253140	And then how it is being interpreted by people who actually implement the APIs or libraries for further usage in larger systems.
253140	255580	Well, I have all respect for these implementers.
255580	259060	They have to understand the hardest parts of cryptography.
259060	263760	They have to use their domain development experience to write these libraries.
263760	272120	And then even worry about, and then we expect them to even put some more weightage into how these APIs are designed.
272120	278300	How it will be well understood by the most well-meaning security conscious developers.
278300	285740	So that they don't make any mishaps of using these implementations.
287340	293060	I wish the implementers took it a little bit ahead than that.
293060	300480	And took some responsibility of writing much cleaner documentation, much cleaner APIs.
300480	308380	Secure defaults, deprecating legacy or insecure algorithms right out of the sight of developers.
308960	313780	Maybe we might be seeing a few lesser crypto failures at that point.
313780	316260	In my opinion, it's almost undebatable.
316260	321800	85% of crypto failures we see are coming from not bad implementations.
321800	325080	But bad usages of those implementations.
325240	334140	So hopefully we all share some responsibility in educating users of these crypto APIs.
336200	341940	Before going any further, I would like to make some cryptographic disclaimers.
341980	347240	No matter how tempting it is, please don't roll your own crypto.
347240	355360	All these great implementers have spent way too much time understanding all different aspects of a crypto algorithm.
355360	361740	And provided us with the implementation which a lot of times is time-tested, crypto-analyzed.
361740	366040	Please use that. It's for us to use it and be safe.
366940	372000	I understand not always we have an option to choose an implementation.
372000	377200	But if you do, I would highly suggest you use this implementation called NSEL.
377200	381180	It's written by cryptographers. Documentation is very clean.
381180	385760	They have all kinds of secure defaults just out of the box.
385760	388840	Everything else is not even visible to us.
389180	399700	And most importantly, a lot of modern programming languages, I'm sure Python, PHP, they have some kind of a wrapper implementation of this library.
399700	404480	Even Lipsodium, another favorite, is a fork of NSEL.
404480	408460	So use one of that and you will go a long way.
409520	415480	Crypto is crucial to be secured, but that does not mean we ignore everything else in the system.
415480	421100	We still have to worry about all kinds of application security attacks, all kinds of networking.
421100	423280	We have to make sure our endpoints are secure.
423280	425340	We have to take care of all those things.
425340	430100	We should not be relaxing the moment we got our crypto right.
431140	434000	Let's see what we are going to talk about today.
434080	446280	Any crypto system you come across will usually have some kind of basic crypto primitives, which is a cryptographically secured random number generator.
446280	450620	It's quite a mouthful. I'm just going to call as CSPRNG going ahead.
450620	455920	There will be some kind of an encryption scheme going, usually symmetric encryptions.
456640	460020	Maybe some kind of one-way hash functions.
460600	465780	And no crypto system works, none of these crypto primitives work in isolation.
465780	477320	So most of the crypto applications are a mix or match of these basics crypto primitives and those ultimately become building blocks to have a complete crypto system.
478120	493520	So we will be spending some time into looking into some of the most common crypto applications, namely message authentication codes, how to actually store any kind of secure information and digital signatures.
494240	499620	OK, let's start by first looking at CSPRNG, which is used almost everywhere.
499620	501660	So what is CSPRNG?
501660	511200	It's like this huge set of digits or zeros and ones, which needs to execute few, which needs to exhibit few properties.
511240	514900	Namely, it should appear completely random.
515060	521900	We should not be able to locate any kind of pattern in the way those digits are.
521980	527220	Secondly, it should be completely, it should be unpredictable.
527220	534780	So knowing or looking at the current digit, we should not be able to predict which is the next digit, which is going to come out of this generator.
535300	539960	And lastly, we should never be able to reproduce the same set of digits again.
540620	543860	Now, where is this used or where is it required?
543860	550540	Well, it's everywhere. It's like any kind of keying material you would be generating for any kind of cryptographic algorithm.
550540	556660	Namely, you would need keys to be generated for your encryption, for your message authentication codes.
557220	568600	Depending on the mode and the algorithms being used for your initialization vectors or nonces or like for storing secrets, you would need it for soil generation.
568600	571940	Basically, it's going to be used every single place.
571940	575900	Now, how to actually generate this?
576940	582340	There are three main blocks or three main areas.
583720	588480	There are three main parts of any CSPRNG algorithm.
588480	592070	Obviously, the output which you most care about.
592900	597800	And the algorithm which basically churns and gives you this output.
597800	603940	But knowing the algorithm, it's extremely trivial to get the output.
603940	616980	What makes the output actually CSPRNG or cryptographically secure random is the way this algorithm is actually initialized or seeded, the way it is called.
617480	626940	For the seeding to happen, the input to the seeding part of the algorithm should be of the highest entropy possible.
626940	636760	Basically, the output is depending on how high the entropy or the source of randomness of this seeding sources.
637500	644820	Well, it would have been ideal if we could get the randomness from external thermal elements and stuff, but that's not practical.
644820	648940	So we had to rely on what the computer is going to offer us.
649220	654220	So right now, the highest source of entropy is what the operating system is going to provide us.
654220	662220	And what it does is it picks up all kinds of different entropy elements going on in your system at a particular time.
662220	673720	Like there could be interrupts in your programs or disk IO or the way your mouse and keyboards are moving or even your kernel or user level entropy in their programming land.
673720	678520	All these things are collected and then fed into the algorithm.
678520	686360	And that's what makes your CSPRNG output extremely secure or extremely random.
686360	697020	It's almost safe to say that the entropy provided to this seeding algorithm is what makes your entire crypto system secure.
697020	699820	Or it's directly proportional, at least that way.
701420	704420	So what are some of the do's and don'ts around it?
704420	710120	Well, since the source of entropy is most important, let's start talking about that first.
710420	714320	Always go with what your operating system provides us.
715300	723240	There are different mechanisms which the operating system provides.
723240	728940	Most importantly, either you go with a blocking source of entropy or a non-blocking.
728940	739860	What does that mean is non-blocking is till a sufficient quantity of entropy is reached, the algorithm is not seeded.
739860	745280	So basically, our algorithm is blocked till the entropy is filled out.
745280	749000	And non-blocking is whatever entropy is available, just feed the algorithm.
750400	753120	That's what operating system gives us.
753120	756940	Well, most of the cryptographers are pessimistic people.
756940	762260	They'll say, oh my god, you have to use blocking source, you have to have some level of entropy.
762780	770420	Well, I beg to differ. 80% of the applications don't really need that high level of entropy.
770420	776340	You would be fine with using a non-blocking source for most part.
777780	787620	Second thing is, you should just be aware of, in this virtual machine era, where all the applications are deployed on virtual machines,
787940	793360	even the source of entropy is coming from the guest operating system and not the actual host,
793360	799100	which has a far longer list of entropy sources, which even the operating system provides.
799100	805120	What I'm trying to say is, the entropy provided in an application deployed in a guest operating system
805120	809780	might not be at par with what a host can provide.
810720	815380	It's better to go for non-blocking, otherwise the applications might never really start,
815380	819860	because they are just sitting and waiting for a desired set of entropy.
821100	824480	It's an active area of research, there are mechanisms to avoid it,
824480	828120	but the most important step is first to be aware of that situation.
828120	832420	And lastly, I've seen countless examples, even some implementations,
832420	837780	which rely on the milliseconds and microseconds as a source of entropy.
838260	841040	Just don't do that, please.
841920	846040	There are obviously some attacks because of a lower source of entropy.
846040	851620	One which comes to my mind is the Sony PlayStation attack.
851620	860540	The digital signature used for signing that particular piece of game was used,
860540	867900	the entropy used to generate the digital signature was of very low randomness.
867900	871660	So this is out there, it happens all the time.
871980	875060	The next is, what algorithm to use?
875060	883240	Well, it's always better to rely on algorithms which are based on hashing or hash-based MACs,
883240	886720	or even good symmetric ciphers.
886980	891600	Government standards approved only these ones, it's better to use that.
891860	896260	Unfortunately, not a lot of implementations provide this out of the box,
896260	899680	but please use that if they are actually being provided.
899680	906760	If not these, then usually there are some good library-specific algorithms.
906760	912960	But make sure those library-specific mechanisms are using operating system source of entropy,
912960	916040	and not anything other than that.
916240	924780	If you are using that, be a little more conscious and Google around if there is anything wrong with the library implementation.
924780	935800	For example, SHA-1 PRNG, a few versions of Java ago, it was okay as long as it was not seeded initially before use.
935800	941980	But if it was seeded initially, it used to just go in some initial state and always give that output.
941980	946660	It's fixed now, but there could be such idiosyncrasies lying somewhere.
946660	955840	And there are different algorithms based on mercery twisters, like the older dual EC1s, again the classic Sony hack.
956600	963620	Even some insecure symmetric cipher based, just don't use any of that anymore.
963760	969380	And finally, I just had to put it on the website, on this slide, please don't use random math,
969380	976060	there is nothing cryptographically secure about that, it does not exhibit all the properties we require for CSPRNG.
977060	985700	Next, let's talk about one of the most famous crypto primitive called encryption, almost synonymous to cryptography.
985820	992100	Well, we obviously need our data which is stored at rest or in transit to be confidential.
992200	994800	So that is one of the biggest property we expect.
995260	1003000	But over time, we realized that our data, whenever it is online, which is as we saw 95% of the times,
1003000	1009380	we needed some kind of authenticity as well as integrity out of that data in transit.
1009480	1018480	And why so? To avoid or to safeguard or to mitigate against all kinds of padding oracle attacks
1018480	1027240	where an adversary can just sit in between the sender and receiver and start tampering with the data being sent to the receiver
1027240	1031100	and get all kinds of information back from the receiver.
1031800	1041580	We all are aware of all kinds of issues with TLS protocols, most notably Beast and Poodle, which had all these issues.
1042080	1046880	Well, historically, what used to happen is for authenticity and integrity,
1046880	1051660	they will use another primitive called MAC in conjunction with encrypting the data.
1051940	1059480	It used to work, but there are a lot of issues with that. It was slow, it had a lot more crypto systems going on.
1059480	1063380	So the crypto analysis became difficult. It was much more fragile.
1063600	1072920	So what the greater crypto community came up with was providing an authenticated encryption right out of the box.
1072960	1082060	And this is another property we expect out of AE, which is authenticated encryption.
1082380	1084720	We need authenticity as well as integrity.
1084720	1091160	So these are the three properties we expect out of any modern symmetric encryption scheme.
1091400	1097940	And how is this achieved? Well, at the core of it, we still have a symmetric block cipher running.
1097940	1103000	It takes a symmetric key, it takes plain text, it throws away ciphertext.
1103000	1111440	But there was yet another detail, yet another information, which was like a nice to have feature called associated data.
1112120	1120260	What that is, it would be nice to have some plain text being transferred as plain text on the receiver side.
1120260	1123640	But it still takes part in the authenticity of it.
1123640	1128840	So for example, imagine a sender is sending a packet to a receiver.
1128840	1134940	So the IP address of the receiver needs to be in plain text, but the payload needs to be encrypted.
1134940	1142960	So that kind of a scheme is what is the most common thing or you should, that's what you should be using going ahead.
1143660	1147840	It is called as authenticated encryption with associated data.
1148120	1151080	So just coming back to this block diagram.
1152540	1163300	Authenticity and integrity is provided by this authentication tag, which is computed based on associated data, which is plain text as well as plain text data.
1163300	1168900	And obviously the symmetric key. Authenticated data comes out as plain text.
1168900	1172160	And we obviously get the ciphertext.
1172160	1185740	And similarly, on the opposite side, we have decryption, which takes care, which takes the same symmetric key, the ciphertext, the authentication tag, and the plain text of associated data.
1185740	1198740	If nothing of the keys or the ciphers or the AAD is tampered, then the output of this decryption is going to be plain text.
1198820	1201700	That's how simply it all works.
1203880	1205480	Do's and don'ts.
1205480	1208480	Well, you can use any good block cipher.
1208760	1214800	AES is one of the most commonly used safe block cipher here in the United States.
1214800	1218980	If we talk more globally, we have ARIA, Camellia, and CAST6 too.
1219700	1226260	There are only few block cipher modes which provide authenticity and integrity services.
1226260	1228380	GCM being the most famous.
1228380	1232960	The rest of the modes are either expensive or patented.
1233160	1236720	Patents expire at different times in different countries.
1236780	1240180	So AES-GCM is the most famous scheme.
1241100	1243480	And hopefully you would be using GCM.
1243480	1255180	Just be very careful you are not using the same key and initialization vector for GCM modes more than twice to encrypt different sets of data.
1256460	1264600	I'd like to introduce you to a new kid on the block, which is based on a stream cipher called Chacha.
1264660	1271720	And it comes with its own authenticity scheme called Poly1305.
1271720	1279220	It's a promising alternative or a backup plan if AES-GCM fails.
1279320	1283860	If it fails, the world cannot all of a sudden be insecure.
1283860	1293540	So our great cryptographers have already come up and it has already been implemented in a lot of modern programming languages.
1293600	1301180	And to go a little further, I think Google and Cloudflare are already using this in their TLS implementation.
1301180	1308140	So knowingly or unknowingly, right now even 30% of our websites use this anyways.
1308800	1311820	It's three times faster than AES-GCM scheme.
1311820	1320300	So a lot of slower hardware, even your Android phones or IoT devices needed an authentication scheme.
1320300	1323300	And this is a promising alternative for that.
1323920	1328600	So embrace that. There is no harm in using that already.
1330560	1336480	And lastly, stay away from all other block ciphers, all other stream ciphers and all other modes.
1336480	1339560	There are just way too many to list on the slide.
1339680	1343560	I've just listed the most common ones out there.
1345480	1349760	Okay, let's see how both these primitives work in action.
1349760	1353860	And for that, let's go into our development environment.
1353860	1359780	I'm choosing to show these API usages in Java for two main reasons.
1359780	1364740	One, Java is one of the most chaotic crypto implementation I have seen.
1364740	1369740	And second thing is, it's one of the most commonly used enterprise programming language.
1369740	1375160	So it's extremely important that we pass the message on how to use it securely.
1376380	1383840	Okay, I have done nothing more than setting up a simple Java Griddle project with some of the dependencies we might be using.
1385260	1404060	Let's just start with first creating a mandatory crypto driver class where we will be using all different APIs through.
1406520	1411580	Simple HelloWorld, where we are going to say hello to CryptoVillage.
1414350	1416610	And let's see if this works.
1417270	1418550	Super!
1418750	1425170	Okay, let's start building an authenticated encryption scheme.
1425170	1427010	And for that, what all do we need?
1427010	1431570	We need a SIM key used in encryption as well as decryption.
1431570	1436450	Use a CSPRNG ID for the GCM mode.
1436870	1440390	We need the plain text to be encrypted.
1440410	1444410	We need a plain text A associated data.
1444410	1449470	And finally, the actual encryption and decryption APIs.
1450190	1457350	For that, let's do a little bit of designing before we go into the coding session.
1457510	1469830	And for that, I have opened this particular link which gives us all details about all algorithms coming out of the box of JDK in the latest Java version.
1470530	1475110	What all do we need here is, let's start with symmetric keys.
1475110	1476550	How to generate a symmetric key.
1476550	1481670	And for that, we need to rely on this algorithm class called KeyGenerator.
1481770	1484210	And look at the options it provides us.
1484210	1491210	We just have to be safe and secure and use the AES algorithm because we are going to use AES GCM scheme here.
1491490	1494470	Next, we need to generate a CSPRNG.
1494470	1505490	And for that, we need to go into the secure random class, pick up the right algorithm and go by the default OS entropy for the seeding of that algorithm.
1505810	1518690	And the actual encryption and decryption scheme is defined by the Cypher class where we have to configure it with the scheme we plan to use in terms of transformation.
1518690	1520450	What does that scheme mean?
1520450	1524590	To use the right block Cypher out of all these options.
1524590	1527490	Use the right authentication mode.
1527490	1529490	All these are unauthenticated mode.
1529490	1533490	Use just the GCM and the required padding.
1533510	1542490	GCM underneath is mainly just a counter mode, which is a stream Cypher, which does not need any padding.
1542590	1546470	So that's how we will be defining our Cypher scheme.
1546470	1549470	See the amount of moving blocks here.
1549470	1552450	So let's get into coding.
1552930	1554270	Symmetric keys.
1554270	1562330	For that, let's go and create a symmetric class we are going to use for other primitives as well.
1563330	1567530	A dedicated package for it.
1570010	1578170	We'll return a secret key, which is nothing but a holder class to hold your symmetric keys to be transported around.
1582810	1585490	Which takes the algorithm.
1591540	1597180	And we can decide the size of the key we plan to generate.
1598380	1600460	I choose 256.
1600460	1603420	Even for whatever reason, you need to choose 128.
1603420	1605580	Don't lose sleep over it. It's fine.
1605580	1610540	This just puts us all the more ahead to be future compliant.
1610540	1612340	Or future safe.
1612460	1613880	Or future proof us.
1616540	1619840	Key generator algorithm as we saw.
1619840	1624020	Let's create an instance of it based on the algorithm.
1625020	1627860	Initialize it with the right key size.
1629460	1631920	And just generate it actually.
1635890	1636990	Okay.
1637590	1641210	Nothing in Java works without some kind of exceptional handling.
1641210	1644950	Please don't do this. This is just to keep the demo shorter.
1645710	1649170	So this is how a symmetric key would be generated.
1649170	1650890	Let's use it here.
1660980	1665480	And let's define the algorithm we plan to use this with.
1666340	1670860	String a-algo is going to be a-es.
1674240	1677120	Okay. Let's use this.
1681270	1684050	With a-algo.
1684050	1688450	Perfect. This should give us a nice looking safe, secure key.
1688730	1691350	Next is generating IV.
1691350	1696410	For that, let's first decide the size of the IV we plan to generate.
1699910	1703410	Well, a good IV is anything above 128.
1703410	1706890	I'll go for 256 because, hey, why not?
1706890	1709630	It's defined in bytes, so 32.
1710550	1717490	First, I'll initialize an array which will hold this IV for me.
1718710	1721430	Of the IV size.
1722070	1727390	Secondly, the more important one is actually generating it correctly.
1728450	1736390	We decided to use drbg which provides us with 128 bits of security strength.
1738350	1741110	Default is based out of hash.
1742050	1744730	And just populate this guy.
1745010	1749850	I want a secret key. SecureRandom.
1751370	1754570	This should give us a good CSPR engine.
1754570	1757010	And let's do some exceptional handling here.
1760960	1765300	Perfect. The message we want to encrypt.
1772500	1774600	Associated data.
1776560	1780500	We can specify the IP address.
1783880	1785760	And pass that around.
1785760	1790110	A more common thing to do is actually do something like this.
1790740	1793940	But in the interest of time.
1795540	1800100	Finally, let's get to the most interesting part, which is how to write an encryption scheme.
1810240	1817100	We'll return a ciphertext from the encryption function.
1817180	1820940	Think about the block diagram.
1820940	1824600	We'll take the plain text message.
1824600	1827520	The associated data.
1827520	1829800	The secret key.
1830800	1833900	And the IV.
1834660	1840300	Similarly, decryption will return a plain text byte array.
1841440	1848180	It will take the ciphertext in byte array.
1849720	1857100	If you again need the associated data, the secret key and the IV.
1861770	1868370	The first steps for doing any encryption or decryption is initializing the cipher object as we saw.
1868510	1872310	And which is common for both encryption as well as decryption.
1872310	1875070	Let's do some code reuse here.
1875070	1882650	And create a private method which will return an initialized cipher object.
1884770	1888190	For both our encryption as well as decryption.
1888190	1892910	For that, we'll first need the mode which is either encryption or decryption.
1892910	1901990	It will take the associated data, the secret key as well as the byte array for your GCM.
1902490	1907510	First, we will define the transformation which we saw.
1910420	1917900	AES with GCM and no padding. Perfect.
1919020	1924600	Next, we need to further define how the GCM mode is going to work.
1924600	1930880	And for that, we need to go into the details of configuring the algorithm.
1931540	1934020	And you have to trust me here.
1935400	1942620	I am defining the output size of the authentication bit we expect and the IV it needs.
1943980	1951360	Finally, we are just going to initialize the cipher algorithm with the mode.
1952520	1956400	Sorry, this is the mode which is going to be passed here.
1957340	1960640	Then, the next is the secret key.
1961040	1963980	The algorithm spec we defined.
1964140	1970020	And finally, some amount of randomness for the underneath algorithm to work.
1970020	1983600	And this uses the default secure random algorithm which is native PRNG in non-blocking mode
1983600	1990440	which is fine for most of the applications we are going to write encryption schemes for.
1990780	1995560	Finally, just adding the associated data to it.
1995560	2005920	And this should give us a nice configured cipher algorithm for use in both encryption as well as decryption.
2006580	2009940	After some exceptional handling, obviously.
2016380	2020000	Super. Let's go back to our encryption scheme.
2021000	2027240	This passing on the mode which is the encryption mode here.
2027800	2033040	The associated data, secret key and IV.
2034340	2036420	Sorry, this is in caps.
2037900	2040220	Next is we are going to...
2042760	2048540	We are going to make the cipher object ready to start encrypting our message.
2048540	2054800	For that, we are just going to take the message and convert it into bytes.
2055740	2063540	But we are going to store this in a byte array to be returned properly to the driver class.
2063540	2064540	And for that...
2070440	2072760	And return this.
2078380	2081260	This should do the encryption for us.
2081260	2088460	And similarly, in the decryption side, we are going to set it in the decrypt mode.
2088460	2094420	Pass on the associated data, the secret key and the initialization vector.
2094420	2102460	Get back a nicely initialized ciphertext just which is used in... exactly as it would be used in the encryption mode.
2102460	2112260	And prepare yourself for getting the plain text in a byte array to be returned back to the driver program.
2116670	2119070	Ciphertext array to be...
2119610	2125270	Let's store it in the plain text because there would be some exception handling.
2128610	2133330	Okay, this should do the decryption for us.
2133330	2137110	Let's put all these things together in the driver class.
2137350	2143710	Let's prepare it to hold the ciphertext array from the authentication code.
2143710	2146690	Before that, we have to use this class.
2163120	2166220	First, let's encrypt the message.
2166240	2172660	Pass on the associated data, the secret key and the IV.
2173640	2176280	And get back plain.
2178920	2190980	Plain text array, passing the ciphertext, associated data, secret key and the IV.
2191680	2194920	And let's hope everything works.
2195260	2199060	To preprint the byte array of plain text.
2203120	2208100	And we got back the decrypted version of the message we encrypted.
2208100	2209520	Super!
2210260	2219280	Okay, after going through this frantic coding session, let's take a look at a little more simpler crypto primitive.
2219500	2222720	It does not involve any keys, which is great news.
2222720	2228460	This is called as hash functions or message digests or even checksums.
2228460	2240320	And how it works is it takes a message, goes through this hash function and depending on the hash function is used, it will generate an output of fixed size.
2240760	2242100	Where is it used?
2242100	2253520	It's used in a lot of different crypto applications, most famously in generating machine authentication code for providing us with the authenticity and the integrity services.
2253520	2257460	It's also used in digital signatures for similar services.
2257460	2269220	It's used for any kinds of integrity checks or checksums, file integrity checks or even hard disk integrity checks and those kind of stuff.
2269880	2273720	What kind of properties do we expect out of it?
2273920	2275780	Well, it should be collision resistant.
2275780	2281240	We should never be able to get hold of two different messages, which results in the same hash.
2281240	2294280	It should be one-way, also called as a first-permise, which means that knowing the hash output, we should never be able to go back to the original message which generated that hash.
2294460	2304420	And finally, it should be unpredictable, meaning we should never be coming up with two... knowing one message, we should not be able to generate second message to generate the same output.
2305100	2308580	And what kind of a security strength do we expect?
2308580	2318020	Well, security strength of 112 is going to be soon considered unsafe. Soon meaning after a decade though.
2318100	2324020	So, which is not a lot of time in a cryptographic perspective.
2324540	2333340	So, if we are using it, might as well let's use a hash function which at least exhibits 128 bits of security or even more.
2334060	2344680	And the security strength of a hash depends on actually where it is used and which of these properties is the most important in that application.
2344680	2349180	So, yeah, you have to be a little careful in which thing to use.
2349180	2351940	But I have a simple pseudocode for that.
2351940	2362880	What to do is just worry, just use the safest one which is SHA-3 or one of these three algorithms which has been recently made into the safe hashing list.
2363440	2369160	SHA-224 is okay for MAC as well as digital signatures right now.
2369520	2376720	But for digital signatures, it just provides 112 bits of security which is soon to be deprecated so why not just avoid it.
2376720	2382860	And please don't use message digest anymore, MD family of algorithms for any of the applications.
2382860	2388000	SHA-1 is still okay for HMAC but why bother.
2388180	2396420	So, what I would do is I would just blindly use any SHA-256 or 384 kind of algorithms.
2396420	2408800	Okay, next let's see the first symmetric key-based application called message authentication code.
2408840	2417530	For any crypto systems which needs integrity or authenticity, this is one of the most famously used scheme.
2417530	2430390	Most famously, you might be seeing it used in API authentication in most of the web applications right now providing APIs for usage.
2430390	2440790	How it works? There is a sender and a receiver. There is a message. There is a symmetric key involved which your sender and receiver both has a copy of.
2440790	2452290	The message and the key makes it into a MAC algorithm, generates a MAC and this MAC along with the plaintext is passed on to the receiver where this process is repeated.
2452290	2461530	And if the incoming MAC is same as the MAC computed at the receiver side, well, the message received has authenticity as well as integrity checks in it.
2461590	2467250	Pretty simple, straightforward. Let's see what to do and what not to do.
2468550	2476830	There are a few different kinds of MAC algorithms. Some are based on hash, some are based on block ciphers.
2477650	2489150	Avoid all the block cipher ones. They are a little bit more complicated involving two different keys, one for the actual MAC, one for the actual block cipher underneath.
2489230	2494650	It's just complicated. Avoid using that. Use a hash-based MAC called HMAX.
2494650	2505410	The key used for symmetric key use at least of size over 128 even if you have options to use 96 or 112 bit keys.
2505510	2512850	And the reason being, based on this and the underlying hash, the security strength of your MAC is decided.
2512850	2518050	So, there is a little bit of math here which I don't want to go into detail but just use this.
2518050	2525430	And finally, protect your symmetric key on both the sides. This goes without saying but I still have seen a lot of things failing because of that.
2527010	2530770	Let's see how both of this actually works in action.
2532950	2539230	For that, let's go back in the development environment to see how to use this.
2539230	2549730	Well, guess what? Surprise! I'm not going to do the entire coding here because it's fairly straightforward using the right APIs and making the right algorithmic choices.
2549730	2554930	I'll just point you to the options available and which ones to pick.
2555010	2562030	Let's first look at the way of generating message digest which is happening through this particular class.
2562030	2567530	Look at the amount of options they provide. They provide still the MD family of algorithms.
2567530	2574550	They also obviously provide SHA-1 and SHA-254. It's not out of scope or out of use yet.
2575170	2583410	And it has the good ones, the SHA-2 and the SHA-3 family. Choosing one of these should keep you in safe areas.
2584430	2593790	Similarly, for generating message authentication code, luckily we don't have to write the whole scheme from scratch. We have a corresponding API provided.
2595850	2605610	Java does not at least provide block ciphers which is a good news. It provides a lot of algorithms based for HMAC.
2606230	2618450	You have HMAC schemes using underlying MD5 family of algorithms, SHA-1, SHA-2, SHA-24, all the SHA-2 and SHA-3 family of algorithms.
2618450	2630430	For safely storing your secrets or mainly generating keying material based on low entropy inputs, there are options also provided by the map class.
2630750	2633570	It's good to know if you need to use that.
2634150	2642810	The coding is as straightforward as the cipher object where you just initialize it with the right algorithm.
2642810	2653050	Prepare the initialized object with the data you need to map or find a digest for and just do that with the doFinal method.
2653110	2659070	That's pretty standard. In the interest of time, I'm not going to code that up for you.
2661150	2669590	Going ahead with the applications, let's next look at how to actually store your secrets or the information you want to safeguard,
2669590	2679370	be it your personal identifiable information or some GDPR compliance information, and most importantly, password.
2679370	2689470	This application is very famously called as password hashing or password storage, but in my opinion, it can be extended to safeguard any kinds of secrets.
2690270	2695030	Well, it's a well-known fact, don't ever store your data in plain text.
2695030	2700590	It's also a big no-no to store it in a hash or just a simple salted hash.
2700710	2712090	Modern GPUs and A6 hardware are very good at just parallelizing it and just cracking all this information.
2712090	2715430	So, terrible idea in this day and time.
2715430	2726050	What you should be doing is using something called as key derivation functions, which is inbuilt to be more expensive to be computed.
2726410	2731530	There are a few different kinds of key derivation functions.
2731990	2736250	Again, at the core of it, it will take a password, a salt, and then a hash.
2737080	2748550	But there is something called as a work factor, which can be configured to add a way to artificially increase the computation time needed to generate this hash.
2749210	2755350	What kind of work factors are available depends heavily on the algorithm used.
2755350	2772850	There are a few algorithms called as adaptive functions, where we can just configure a repetition of a number of times the core primitive would be computed for thousands, even sometimes a couple of millions of times.
2772890	2782190	And another category of functions are called as memory hard functions, where there is some amount of memory involved in doing this computation.
2782190	2796050	I have another talk later in the day today, which talks extensively about all these kinds of functions. I'll highly encourage if you are interested in this to log in to watch that.
2797770	2804370	Let's move on to talking about public key cryptography or asymmetric encryption.
2805230	2816010	Well, it is still very similar to asymmetric keys, except for there is a private key involved to encrypt your message and a public key involved to actually decrypt back that message.
2816370	2826930	And the core principle or the core property is having the public key, which is a public information, we should never be able to go back and get hold of the private key.
2826930	2838650	Traditionally, these keys were computed based on prime numbers, which over time has proven not to be the best option.
2838650	2847610	The algebra involved or the exponents needed to choose this prime number was getting increasingly fragile.
2847610	2860610	These schemes are constant reasons of padding oracle attacks. And most importantly, we have a more promising option available in terms of elliptic curves.
2860610	2867570	So I would highly encourage us to embrace this. They are much more compact.
2867570	2880170	And most importantly, most of the public key cryptography based applications have a good amount of schemes out of the box available for this usage.
2880330	2884830	So briefly, let's talk about how this elliptic curves work.
2884830	2891290	There is this algebraic equation defined, which basically defines a particular curve.
2891290	2902170	And the public key and the private key is based on the number of points on this curves and actual x and y coefficients of those points.
2902710	2914810	And this expression contains, this algebraic expression contains all these kinds of coefficients, which is important in defining the curve.
2915550	2922290	Everything except the private key, which is the number of points chosen on the curve is a public information.
2922890	2932010	And again, given the public key, we cannot get hold of the private key.
2934250	2941630	Elliptic curves is not such a modern or a newer thing. It is in existence since 1985.
2941630	2947810	And over time, there have been lots of curves which have came into picture or being proposed.
2947810	2953510	Not all of them are secure. I won't get distracted with any of those.
2953510	2963790	What I use is Edward curves with specifically these two ones are specified on the slide 255.19 and 448.
2964430	2976090	NIST has also approved a lot of curves. Not all of them provide security, which is 112 bits.
2976090	2982170	So while picking NIST curves, be careful about the security provided out of the box.
2982310	2987610	And it's NIST, there is always this conspiracy theory going on that there are backdoors.
2987610	2994610	So my preference, stay away from it. But if you have to use it, there is nothing yet wrong about it.
2995090	2997730	And as I said, stay away from everything else.
2998270	3006570	The good thing is most of the public key applications comes with a bundled scheme to use these curves right out of the box.
3006570	3011010	You don't have to deal with choosing key sizes or any of that.
3012630	3020250	For digital signatures, you have an Edward curve based scheme similarly for key exchange.
3020250	3025070	And a symmetric encryption scheme is also available called ECIS.
3025070	3031730	With its own drawback, it can't encrypt more than 256 GB of data.
3031730	3037310	This scheme is not yet very famously used or commonly used, but it's there.
3039770	3048270	Next, let's look at one of the most common public key based application called digital signatures.
3048410	3065430	So just like in a physical world, when we sign a document, you are saying that you are providing authenticity, integrity and a way of not walking away from the document, which is the non-reputation service while putting that simple signature on a piece of document.
3065430	3071870	Similarly, we have a construct in digital world called digital signatures.
3072050	3074110	How does that work?
3074110	3082530	Again, there is a plain text message whose hash is computed, passed through a signature algorithm and the signature is computed.
3082530	3090350	This signature along with the plain text message is passed to the receiving side where the same operation is performed again.
3090350	3096750	The output hashes are compared. If they are same, then the services are achieved out of the box.
3096770	3103450	Something very similar to Mac, except for there is a private key involved on the sender side or for signing.
3103510	3107350	And for verification, there is a public key of the signer involved.
3107350	3111590	So that's how simply the digital signatures work.
3112510	3116050	Let's look at some of the do's and things to avoid.
3116050	3125970	Digital signatures over time have been very famously used by RSA algorithms or the Al-Gamal key-based DSA algorithms.
3126290	3134830	If you have a choice, just avoid that. In fact, DSA is already going to be deprecated in the next DSS standard coming out of the government body.
3134830	3137910	RSA is fragile as we spoke earlier.
3138710	3145810	ECDSA is another common thing used. It has its own issues of how well the nonces are generated.
3145910	3153370	There was a talk talking in detail about this earlier today. Hopefully, you got a chance to look at that.
3154070	3163670	As we spoke earlier, use Edward curves. Underlying hashes use SHA-2 or SHA-3 family providing at least 112 bits of security.
3163670	3169810	Avoid MD families and SHA-2 and even SHA-24 algorithms.
3171290	3178710	Let's see how this actually works. For that, let's go to the development environment again.
3180430	3187510	Back to our CryptoDriver class. Let's see how we can implement digital signatures using Java.
3187510	3196090	What all do we need from planning and designing? We need ECC based key pairs.
3196830	3202250	We need signer side of the code and the verifier side of the code.
3202270	3215990	Now, I have a little bit of a bad news for you. The signature classes and the public key algorithms coming out of the box from Java does not provide us with Edward keys.
3215990	3220710	Edward key based key exchange algorithms are available but not for signatures.
3221170	3225710	But worry not, we have a pretty good shortcut for this.
3225710	3237130	There is a third party provider for Java called Bouncy Castle which provides us with this and it seamlessly works with all the JDK APIs we have been looking at so far.
3237130	3245910	So, let's go ahead and use that. And for that, let's first go ahead and create an ECC keys generator class.
3247010	3252890	Again, just like secret keys, this class is a holder for the public and the private keys.
3256070	3266950	And for us to use this third party provider, the only thing extra we need to do is add it on our class part to be picked up by the algorithms.
3267130	3271370	And after that, it's pretty much business as usual actually.
3271670	3276250	Let's make sure we use the required algorithm.
3277210	3281190	And this is going to be provided by this Bouncy Castle provider.
3281470	3290410	And we just have to generate key pairs at this point after obviously adding the much needed exception handling here.
3290810	3294130	Let's go back to our driver class and start using this.
3312030	3313830	Key pairs...
3316820	3324050	And let's see the signer and the verifier side of the code.
3324880	3328880	It's just creating a simple message for us to sign.
3335080	3344880	Let's go ahead and create a different package to help us with this signer and verifier APIs for digital signatures.
3344980	3350660	We are going to return the actual sign for the message.
3350660	3355520	We need private key and that's it actually.
3355520	3369380	And similarly on the verifier side, we are going to return a boolean saying all the services we expect the scheme to provide are actually met or not.
3372040	3374810	And actually pass the signature.
3380820	3387000	Okay, let's go ahead and coding up. Again we are going to use the signature API class.
3390980	3395860	Making sure we are using the right algorithm we plan to use.
3396120	3403280	Next going ahead and preparing this class for actually signing messages with the private key.
3404200	3415560	And then adding the message we wish to do just like we did it in Cypher as well as looked at doing it in Mac or Message Digest.
3415560	3422020	And this is just going to hold a final signature for us.
3423180	3425460	Actually sign it.
3425460	3427720	This is what we are going to return.
3428880	3432520	Let's add some exception handling here.
3438580	3442740	Similarly on the verifier side.
3445300	3450860	We are again going to use the same AdWords course.
3451120	3457860	This time we are going to prepare it for verifying with the public key.
3458640	3463520	Preparing it with the message to be verified.
3465000	3468920	And finally actually verifying the message.
3480710	3482150	Signature.VerifyWithSignProvided
3483870	3486730	And let's return this guy.
3496750	3503690	Cool, this is the signer and the verifier side. So let's go back to the driver class and actually use this.
3517290	3522540	Let's collect the signature in this particular array.
3523650	3528690	The message and the private key.
3528950	3531750	And let's see if we could verify this.
3543180	3546980	This time we are going to give it a public key.
3547040	3549600	And the actual signature.
3550180	3552600	And let's see if all this works.
3558810	3559980	Cool.
3560590	3569980	So just to show how easy it is to use elliptic curves. Don't be discouraged. Embrace that. It's really simple.
3570490	3572930	And let's go back to our slides.
3572930	3583150	This is what I wanted to talk about in all different crypto primitives and its building blocks and some most commonly used applications.
3583970	3591150	Before I conclude, I want to point out that key management is a huge issue.
3591550	3599370	If you would have noticed across all the things we spoke about, we always needed some kind of a key material.
3600030	3611770	We have to be conscious about how we are generating it, how we are reusing it, how we are distributing it, how well we are storing it, how well we are refreshing it on a timely basis.
3611770	3620210	And unfortunately, all these aspects of actually managing your key material is usually homegrown.
3620570	3627090	Which is one of the biggest reasons why any crypto systems fail.
3627850	3634910	And something which is not very widely talked about or honestly not even paid a lot of attention to.
3634910	3647070	The worst things I have seen is hard-coded keys and even worse is actually those keys getting checked in into open GitHub repositories.
3647070	3656150	There are many attacks around that recently which comes to mind as PrimeFace's WebLogic-based key attack.
3657310	3661190	Just be conscious about that. Don't ignore this. It's huge.
3662770	3682450	Finally, I hope next whenever you look at any new crypto failure, hopefully it does not happen often, or you are looking at understanding previous use cases, you might find something which was on the don'ts list or something on the cautious list in today's talk.
3683230	3691670	This small community of ours shares the biggest responsibility of making the internet a safer place and keeping it secure.
3692650	3698730	And that was what I hope you have shared enough in this one hour.
3699810	3706330	Finally, I would like to conclude by giving my contact information. My DMs are always open.
3706330	3718310	I talk a lot about all these things and a few other topics on my employer's blog post in much more detail than what I could ever cover in just 60 minutes.
3718390	3727590	And all the codes we worked up today is more polished and in a real world API-based usage dockerized on the GitLab repo here.
3727590	3731970	So feel free to poke around. Thank you.