Cryptography With PHP
7 likes3,306 views
This document provides an overview of cryptography as it relates to PHP, detailing its significance in securing sensitive data against increasing cyber threats. It discusses various cryptographic definitions, algorithms, and techniques used in PHP, along with practical considerations for secure implementation. Additionally, it highlights the importance of cryptography in preventing data breaches and ensuring the confidentiality of communications.
![CRYPTOGRAPHY WITH PHP
ENCRYPTION WITH PHP
โธ Password hashing
โธ Salt generated automatically
โธ Deprecated as option in PHP 7
โธ Option โcostโ
โธ password_hash($password, PASSWORD_DEFAULT,
[โcostโ => 10]);](https://image.slidesharecdn.com/cryptographywithphp-160712180759/85/Cryptography-With-PHP-52-320.jpg)
![CRYPTOGRAPHY WITH PHP
ENCRYPTION WITH PHP
โธ openssl
โธ Private key generation
โธ openssl_pkey_new([$con๏ฌgs]);
โธ openssl_pkey_export_to_๏ฌle($privateKey, $๏ฌleName);
โธ openssl_free_key($privateKey);](https://image.slidesharecdn.com/cryptographywithphp-160712180759/85/Cryptography-With-PHP-62-320.jpg)
Cryptography With PHP
- 1. CRYPTOGRAPHY WITH PHP MARK NIEBERGALL https://joind.in/talk/53c3d
- 2. CRYPTOGRAPHY WITH PHP ABOUT MARK NIEBERGALL โธ PHP since 2005 โธ Masters degree in MIS โธ Senior Software Engineer โธ Team Lead โธ Drug screening project โธ President of Utah PHP User Group (UPHPU) โธ SSCP, CSSLP Certi๏ฌed and SME for (ISC)2 โธ PHP, databases, JavaScript โธ Drones, ๏ฌshing, skiing, father, husband
- 3. CRYPTOGRAPHY WITH PHP ABOUT MARK NIEBERGALL
- 4. CRYPTOGRAPHY WITH PHP UPHPU โธ Third Thursday of each month at 7pm โธ Venue is Vivint in Lehi (3401 Ashton Blvd) โธ Variety of PHP related topics โธ Mostly local speakers, occasional traveling speaker โธ Networking with other developers, companies โธ Professional development โธ uphpu.org
- 5. CRYPTOGRAPHY WITH PHP OVERVIEW โธ Why Cryptography โธ De๏ฌnitions โธ Role of Cryptography โธ Algorithms โธ Encryption with PHP โธ Considerations
- 6. CRYPTOGRAPHY WITH PHP WHY CRYPTOGRAPHY
- 7. CRYPTOGRAPHY WITH PHP WHY CRYPTOGRAPHY โธ Over 100,000 security incidents in 2015 โธ Attacks largely for ๏ฌnancial gain โธ Many going after sensitive data
- 8. CRYPTOGRAPHY WITH PHP WHY CRYPTOGRAPHY โธ Review Verizon 2016 Data Breach Investigations Report โธ Yearly report โธ Cybersecurity investigations report โธ Pulls from many sources โธ Lots of informative charts
- 9. CRYPTOGRAPHY WITH PHP WHY CRYPTOGRAPHY Countries represented in report
- 10. CRYPTOGRAPHY WITH PHP WHY CRYPTOGRAPHY Incidents by industry
- 11. CRYPTOGRAPHY WITH PHP WHY CRYPTOGRAPHY Incidents with data loss
- 12. CRYPTOGRAPHY WITH PHP WHY CRYPTOGRAPHY
- 13. CRYPTOGRAPHY WITH PHP WHY CRYPTOGRAPHY
- 14. CRYPTOGRAPHY WITH PHP WHY CRYPTOGRAPHY
- 15. CRYPTOGRAPHY WITH PHP WHY CRYPTOGRAPHY
- 16. CRYPTOGRAPHY WITH PHP WHY CRYPTOGRAPHY โธ No organization is immune โธ Cryptography signi๏ฌcantly reduces breach cost โธ Cryptography can prevent leak of actual sensitive data
- 17. CRYPTOGRAPHY WITH PHP WHY CRYPTOGRAPHY โธ Attack Countermeasures โธ Good password policy โธ Encrypt sensitive data โธ Encrypt computer disks and devices
- 19. CRYPTOGRAPHY WITH PHP DEFINITIONS โธ Cryptography โธ The process of writing or reading secret messages or codes โธ Classical cryptography started thousands of years ago โธ Advanced during wars of 20th century โธ The science or study of secret communications
- 20. CRYPTOGRAPHY WITH PHP DEFINITIONS โธ Encryption โธ To change information from one form to another especially to hide its meaning โธ En: to make โธ Crypto: secret or hidden โธ The actual changing of a communication
- 21. CRYPTOGRAPHY WITH PHP DEFINITIONS โธ Algorithm โธ A set of steps that are followed in order to solve a mathematical problem or to complete a computer process
- 22. CRYPTOGRAPHY WITH PHP DEFINITIONS โธ Cipher โธ A way of changing a message to keep it secret โธ An algorithm used to encrypt or decrypt โธ Classically included substitution and transposition
- 23. CRYPTOGRAPHY WITH PHP DEFINITIONS โธ Hash โธ To chop into small pieces โธ Maps data to a string โธ One-way hash functions โธ Schneier โworkhorses of modern cryptographyโ โธ Input is the message, output is the digest
- 24. CRYPTOGRAPHY WITH PHP ROLE OF CRYPTOGRAPHY
- 25. CRYPTOGRAPHY WITH PHP ROLE OF CRYPTOGRAPHY โธ World War II โธ Enigma Machine used by Nazi Germany โธ Code breaking by Allies, including Alan Turing
- 26. CRYPTOGRAPHY WITH PHP ROLE OF CRYPTOGRAPHY โธ Secure communications from third parties โธ Con๏ฌdentiality of communications
- 27. CRYPTOGRAPHY WITH PHP ROLE OF CRYPTOGRAPHY โธ Secure data at rest โธ Secure data in transit
- 28. CRYPTOGRAPHY WITH PHP ROLE OF CRYPTOGRAPHY โธ First 2 Aโs in the AAA Framework โธ Authentication: credentials โธ Authorization: encrypt and decrypt data โธ Accounting
- 30. CRYPTOGRAPHY WITH PHP ALGORITHMS โธ One Way Hash
- 31. CRYPTOGRAPHY WITH PHP ALGORITHMS โธ One Way Hash โธ Data is hashed โธ Cannot go backwards โธ Integrity checks โธ Password checks โธ Identi๏ฌers; ex: Git and Mercurial
- 32. CRYPTOGRAPHY WITH PHP ALGORITHMS โธ One Way Hash โธ MD5 โธ SHA-1, SHA-2, SHA-3
- 33. CRYPTOGRAPHY WITH PHP ALGORITHMS โธ Symmetric-Key
- 34. CRYPTOGRAPHY WITH PHP ALGORITHMS โธ Symmetric-Key โธ Same key to encrypt and decrypt โธ Shared secret key โธ Stream 1 character at a time โธ Blocks of X bits โธ Susceptible to plaintext attacks (known and chosen) and cryptanalysis (differential and linear)
- 35. CRYPTOGRAPHY WITH PHP ALGORITHMS โธ Symmetric-Key โธ DES โธ Triple DES โธ AES
- 36. CRYPTOGRAPHY WITH PHP ALGORITHMS โธ Symmetric-Key โธ Blow๏ฌsh โธ Two๏ฌsh โธ Three๏ฌsh
- 37. CRYPTOGRAPHY WITH PHP ALGORITHMS โธ Asymmetric-Key
- 38. CRYPTOGRAPHY WITH PHP ALGORITHMS โธ Asymmetric-Key โธ Heavily used in cryptography โธ Public and private keys โธ Public key is publicly available โธ Private key is kept secret
- 39. CRYPTOGRAPHY WITH PHP ALGORITHMS โธ Asymmetric-Key
- 40. CRYPTOGRAPHY WITH PHP ALGORITHMS โธ Asymmetric-Key โธ Public key used to authenticate messages from owner of the private key โธ Public key used to encrypt message to send to owner of the private key โธ Private key used to decrypt inbound messages โธ Private key used to encrypt outbound messages
- 41. CRYPTOGRAPHY WITH PHP ALGORITHMS โธ Asymmetric-Key (Public-Key) โธ RSA โธ DSA
- 42. CRYPTOGRAPHY WITH PHP ALGORITHMS โธ Broken โธ DES โธ MD2, MD4, MD5 โธ SHA-1 โธ GOST โธ Panama โธ RC4
- 43. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 44. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ Hash โธ Password hashing โธ mcrypt โธ openssl โธ cracklib โธ CSPRNG
- 45. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ Hash โธ hash($algorithm, $message, $raw = false); โธ hash_algos for array of options โธ hash_๏ฌle for ๏ฌle contents hash โธ hash_update for larger data sets
- 46. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 47. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 48. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 49. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ Password hashing
- 50. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ Password hashing โธ $insecure = md5($password); โธ Too fast โธ Brute force โธ 5f4dcc3b5aa765d61d8327deb882cf99
- 51. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ Password hashing โธ Use password_hash and password_ver๏ฌy โธ $current = password_hash($password, PASSWORD_DEFAULT); โธ PASSWORD_DEFAULT can change over time, currently is blow๏ฌsh, max password length of 72 โธ $verify = password_verify($password, $current);
- 52. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ Password hashing โธ Salt generated automatically โธ Deprecated as option in PHP 7 โธ Option โcostโ โธ password_hash($password, PASSWORD_DEFAULT, [โcostโ => 10]);
- 53. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 54. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 55. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 56. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ mcrypt
- 57. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ mcrypt โธ Generally use openssl instead โธ Supports many ciphers โธ Encrypt and decrypt โธ Uses libmcrypt, which hasnโt been updated since 2007 โธ Bug ๏ฌxes and patches
- 58. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ mcrypt โธ $digest = hash($algorithm, $data, $raw = false); โธ Ex: hash(โsha256โ, โSome data!โ, true); โธ mcrypt_encrypt($cipher, $key, $data, $mode, $iv = null); โธ Ex: mcrypt_encrypt(MCRYPT_TRIPLEDES,
- 59. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ mcrypt โธ mcrypt_generic โธ mcrypt_decrypt โธ mcrypt_create_iv โธ Initialization vector โธ Alternative seed to encryption routines
- 60. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ openssl
- 61. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ openssl โธ Generate and verify signatures โธ Certi๏ฌcate Signing Requests (CSR) โธ Encrypt and decrypt data โธ Actively supported
- 62. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ openssl โธ Private key generation โธ openssl_pkey_new([$con๏ฌgs]); โธ openssl_pkey_export_to_๏ฌle($privateKey, $๏ฌleName); โธ openssl_free_key($privateKey);
- 63. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ openssl โธ Con๏ฌguration defaults to openssl.conf โธ digest_alg: Digest method to use โธ x509_extensions: Extensions to use for x509 cert โธ req_extensions: Extensions to use for CSR โธ private_key_bits: Bits for private key generation โธ private_key_type: Type of key โธ encrypt_key: Export key with passphrase โธ encrypt_key_cipher: Cipher for key
- 64. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 65. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 66. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ openssl โธ Public key generation โธ openssl_pkey_get_details($privateKey) โธ Array with keys bits, key (public key), rsa, type
- 67. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 68. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 69. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ openssl โธ Encrypting data โธ Encrypt in chunks smaller than key bit size โธ openssl_public_encrypt
- 70. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 71. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ openssl โธ Decrypting data โธ openssl_pkey_get_private($privateKey) โธ openssl_private_decrypt($chunk, $decrypted, $privateKey)
- 72. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 73. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ openssl โธ openssl_encrypt($data, $cipher, $password, $options, $iv) โธ openssl_encrypt(โPassword123!@#โ, โAES256โ, $publicKeyString, 0, $largeRandomNumber)
- 74. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 75. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ cracklib
- 76. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ cracklib โธ PECL extension, must be installed โธ Checks complexity of passwords โธ Still experimental
- 77. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ cracklib โธ crack_opendict(โ/ptah/to/dictionaryโ) โธ crack_check($dictionary, $password) โธ crack_getlastmessage() โธ crack_closedict($dictionary)
- 78. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ cracklib โธ it's WAY too short โธ it is too short โธ it does not contain enough DIFFERENT characters โธ it is all whitespace โธ it is too simplistic/systematic โธ it looks like a National Insurance number. โธ it is based on a dictionary word โธ it is based on a (reversed) dictionary word โธ strong password
- 79. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ CSPRNG
- 80. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ CSPRNG โธ Part of PHP 7 core โธ Cryptographically Secure Pseudo-Random Number Generator (CSPRNG)
- 81. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP โธ CSPRNG โธ random_bytes($length) โธ random_int($min, $max)
- 82. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 83. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 84. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 85. CRYPTOGRAPHY WITH PHP ENCRYPTION WITH PHP
- 87. CRYPTOGRAPHY WITH PHP CONSIDERATIONS โธ Salts โธ Algorithm costs โธ Timing attacks โธ Brute force attacks โธ Rainbow tables โธ Max message length
- 88. CRYPTOGRAPHY WITH PHP CONSIDERATIONS โธ Salts โธ Increased security for digest if done correctly โธ Ex: $salt . $password โธ Pepper debate โธ Let password_hash generate the salt for you โธ Different salt per password or message
- 89. CRYPTOGRAPHY WITH PHP CONSIDERATIONS โธ Algorithm Costs โธ Default cost for password_hash is 10 โธ Higher cost leads to more processing time โธ 8-12 is generally a good baseline โธ Might change depending on hardware available
- 90. CRYPTOGRAPHY WITH PHP CONSIDERATIONS โธ Timing Attacks โธ Analyzing timing for algorithms โธ Time variation for hashing, encrypting, decrypting โธ Ex: Username not found, no password check attempted โธ Ex: String comparisons stop after ๏ฌrst mismatch โธ Timing safety built into functions, take same time for positive or negative match
- 91. CRYPTOGRAPHY WITH PHP CONSIDERATIONS โธ Brute Force Attacks โธ Timing attack used to brute force list of usernames โธ Dictionary attack using dictionary and common passwords โธ Take time โธ Advanced Persistent Threat (APT)
- 92. CRYPTOGRAPHY WITH PHP CONSIDERATIONS โธ Brute Force Attacks โธ Countermeasures โธ Lock accounts, but causes Denial of Service โธ Add time to each login โธ Lock by IP address โธ Vary failed login attempt behavior (Ex: HTTP status, redirect)
- 93. CRYPTOGRAPHY WITH PHP CONSIDERATIONS โธ Brute Force Attacks โธ Countermeasures โธ Key words in HTML comments (invalid login, bad username or password) โธ Security questions โธ CAPTCHA โธ Add another factor (multi-factor authentication)
- 94. CRYPTOGRAPHY WITH PHP CONSIDERATIONS โธ Rainbow Tables โธ Table with hashes already ๏ฌgured out โธ Used for hashing that always generates same hash for an input โธ Counter with modern algorithms, salts โธ Common for MD5, SHA1, LM
- 95. CRYPTOGRAPHY WITH PHP CONSIDERATIONS โธ Rainbow Tables โธ Internet search for the hash โธ Online hash cracking sites
- 96. CRYPTOGRAPHY WITH PHP CONSIDERATIONS โธ Max Message Length โธ Only X characters considered when generating hash โธ Ex: MD5 max is 128 characters in, 32 hex out
- 97. CRYPTOGRAPHY WITH PHP CONSIDERATIONS โธ Identify sensitive data โธ Determine appropriate encryption โธ Use cryptography to keep data safe
- 98. CRYPTOGRAPHY WITH PHP CONSIDERATIONS โธ Cryptography can help minimize damage โธ Electronic data breaches โธ Stolen electronic devices โธ Data transmission
- 99. CRYPTOGRAPHY WITH PHP CONSIDERATIONS โธ Cryptography cannot help minimize damage โธ Phishing attacks โธ Credential theft โธ Escalation of privileges โธ DoS/DDoS โธ Social engineering
- 100. CRYPTOGRAPHY WITH PHP CONSIDERATIONS โธ Security education โธ Verizon Data Breach Investigation Report โธ SANS Institution, email digest โธ Krebs on Security blog โธ OWASP โธ BrightTALK
- 101. CRYPTOGRAPHY WITH PHP QUESTIONS? โธ https://joind.in/talk/53c3d
- 102. CRYPTOGRAPHY WITH PHP SOURCES โธ Merriam-Webster Dictionary online โธ PHP.net documentation โธ Virendra Chandak https://www.virendrachandak.com โธ OWASP โธ Verizon 2016 Data Breach Investigations Report