Dutch PHP 2018 - Cryptography for Beginners

@adam_englander
Cryptography for Beginners
Adam Englander
Software Architect, iovation

@adam_englander
I am a Virtual Crime Fighter

@adam_englander
I am a lover of PHP

@adam_englander
Let’s Set Some Expectations

@adam_englander
What is cryptography?

@adam_englander
–Wikipedia
“Cryptography…is the practice and
study of techniques for secure
communication in the presence of third
parties called adversaries.”

@adam_englander
How Cryptography Works

@adam_englander
How is cryptography used?

@adam_englander
Encryption Signatures
Key Derivation Hashing

@adam_englander
Asymmetric Encryption

@adam_englander
Symmetric Encryption

@adam_englander
Input MD5 SHA1
Foo
1356c67d7ad1638d816bfb82
2dd2c25d
201a6b3053cc1422d2c3670b6
2616221d2290929
Bar
ddc35f88fa71b6ef142ae61f35
364653
e496fd20136d4bb7828ebb0ab
925b1bd977208e4

@adam_englander
Collisions occur when two input
values create the same hash

@adam_englander
Any modern hashing algorithm will
never create collision for an input
value whose size is equal to or less
then the hash output size

@adam_englander
db110e4553b9fb646c8d01d928668046
33,571 byte input and 32 byte output

@adam_englander
Hashes by themselves aren’t very useful!

@adam_englander
Data Key Signature
Foo KeyOne b4ac60b7d319d41df60c99a6d064c18e
Foo KeyOne b4ac60b7d319d41df60c99a6d064c18e
Foo KeyTwo db97086208d9dd34d4b288959cac612f
Bar KeyOne 8624de374522eaf1b4ae9f0b872c2169

@adam_englander
Key Derivation

@adam_englander
ihatepasswords randomsalt gPqSXKzzeStBAqT3

@adam_englander
gPqSXKzzeStBAqT3 randomsalt hoEiNrLNefkxRNPR

@adam_englander
hoEiNrLNefkxRNPR randomsalt MgbfofelpvLjM0Hx

@adam_englander
MgbfofelpvLjM0Hx randomsalt xYjyM0wXf1VYboBa

@adam_englander
MgbfofelpvLjM0Hx randomsalt xYjyM0wXf1VYboBa
xYjyM0wXf1VYboBa randomsalt OpWKejkZt/u1wFCk

@adam_englander
How do I get good
cryptography?

@adam_englander
Good cryptography obscures data
in such a way that it is difﬁcult and
costly to duplicate or reverse.

@adam_englander
Attacking Cryptography

@adam_englander
There are ways to ﬁght all that
power...

@adam_englander
Algorithm Complexity

@adam_englander
System Resources

@adam_englander
–Oxford Dictionary
Entropy:
Lack of order or predictability; gradual
decline into disorder.”

@adam_englander
Real world data has very
predictable patterns.

@adam_englander
HTTP/1.1 200 OK
Content-Type: application/json
Server: Apache/2.1
Date: Thu, 08 Feb 2018 18:19:56 GMT
{
"account": "my-secret-account-number",
"date_of_birth": "1980-01-02",
"ﬁrst_name": "Jane",
"last_name": "Doe",
"ssn_last4": "1234",
}

@adam_englander
Credential data is highly
predictable

@adam_englander
Most services use email for the
username

@adam_englander
Passwords have very high
predictability and are reused

@adam_englander
–iovation: August 2015 Password Survey
https://s3.amazonaws.com/launchkey-blog/LaunchKey_Password_Survey_Results.pdf
“68% of people reuse passwords”

@adam_englander
–Keeper Security: The Most Common Passwords of 2016
https://keepersecurity.com/public/Most-Common-Passwords-of-2016-Keeper-Security-Study.pdf
“The top 25 passwords of 2016
constitute over 50% of the 10M
passwords that were analyzed.”

@adam_englander
–Keeper Security: The Most Common Passwords of 2016
https://keepersecurity.com/public/Most-Common-Passwords-of-2016-Keeper-Security-Study.pdf
“Nearly 17% of users are safeguarding
their accounts with “123456."”

@adam_englander
Most users will choose
passwords based on ease of
recall rather than entropy

@adam_englander
All the reuse and predictability
in passwords creates a very
serious problem

@adam_englander
user1 wI6Lx2klirB32K5T/4iQzsRVXI0PoVfc
user2 eHc9kCCZAzmR8HrelHeOAOs67XBo6OQe
user4 7U02IuFr4KJdjcexi26XFBWOuB3rTGLh

@adam_englander
Good cryptography uses random
salts to add entropy to hashes

@adam_englander
user1 4Ka7pm2M hqebP0ZRMl1DuBuoDC6+aA==
user2 lmsnAV/G XW0sV+kkle4DGaRyCul9mg==
user3 dLi1KjpE WrxmEs5ebHl1BiSp78fAeg==
user4 oRj3JUBE dATxMWkabTpBUwsjtNu3Eg==
user5 SD1sEqV tHKLSj5J8FoO0LHJfeI6lA==

@adam_englander
Nearly every type of data has
recognizable patterns

@adam_englander
English Message Patterns
• Spaces can be determined based on predictable word patterns
• Single letter words will be either the letter i or a
• In a two letter word, one of the letters is a vowel
• Three letter words mostly start and end with consonants and nearly
always have a vowel in the middle
• The letter e is the most common of all letters

@adam_englander
RrSRvtw/2Mk993TmCMjoAoSjyTAIF1emZQU=
RrSRvtw/2Mk993TmCMjoAoSjyTAIF1emZQU=
VXXo7Ov5OxFC5l6hEwDECoSjyTAIF1emZQY=
uoZjkwYzCwwN18xU8aZMzISjyTAIF1SmZQU=
yUe6wRXtblMRxrYP/N4n1ISjyTAIF1SmZQY=
coqei5pw+HHPDpaCPzcNW4SjyTMIF1emZQU=

@adam_englander
H4pyN6ucltNSlZBsaT5h2SBIuAXvITa0N3U=
uAHjDXC+A0QcyxLugng2wGd/QoghrgbHMaM=
o3O+HjdzJOZ7bZEi8X5MBbMWVphZmGnHEoQ=
RCsavNOf1KNgf7FAqn0o6xV/nWWMsT3KkNU=
dkHaoUx4npXSIOvO8rvY07CdWfOoQ7+Pht4=
rBdxOfwfsGmavqsgpqcavapMNb2/vYEFW6c=

@adam_englander
Random salts and IVs need
good random values

@adam_englander
Stop it! You’re blowing my mind!

@adam_englander
Use the password extension!

@adam_englander
<?php
function validate_password($password, $user) {
}

@adam_englander
<?php
if (!password_verify($password, $user->password)) {
throw new InvalidArgumentException("Password Failed");
}
}

@adam_englander
<?php
if (!password_verify($password, $user->password)) {
throw new InvalidArgumentException("Password Failed");
}
if (password_needs_rehash($user->password, PASSWORD_DEFAULT)) {
$user->password = password_hash($password, PASSWORD_DEFAULT);
$user->save();
}
}

@adam_englander
It’s encryption that’s good for you

@adam_englander
// Generating your encryption key
$key = random_bytes(SODIUM_CRYPTO_SECRETBOX_KEYBYTES);

@adam_englander
// Generate a random nonce
$nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);

@adam_englander
// Using your key to encrypt information
$ciphertext = sodium_crypto_secretbox('test', $nonce, $key);

@adam_englander
// Using your key to encrypt information
$ciphertext = sodium_crypto_secretbox('test', $nonce, $key);
// Decrypting a message requires the nonce and key used to encrypt
$plaintext = sodium_crypto_secretbox_open($ciphertext, $nonce, $key);
if ($plaintext === false) {
throw new Exception("Bad ciphertext");
}

@adam_englander
Books - Introductory
• The Code Book: The Science of Secrecy from
Ancient Egypt to Quantum Cryptography -
Simon Singh - ISBN: 0-385-49532

@adam_englander
Books
• Cryptography Engineering: Design Principles
and Practical Applications - Niels Ferguson,
Bruce Schneier, Tadayoshi Kohno - ISBN:
978-0-470-47424-2
• Serious Cryptography: A Practical Introduction
to Modern Encryption - Jean-Philippe
Aumasson - ISBN: 978-1593278267

@adam_englander
Websites
• https://secure.php.net/manual/en/book.password.php
• https://paragonie.com/book/pecl-libsodium
• https://secure.php.net/manual/en/book.openssl.php
• https://secure.php.net/manual/en/book.csprng.php
• https://en.wikipedia.org/wiki/Cryptography

@adam_englander
https://joind.in/talk/f411c

Dutch PHP 2018 - Cryptography for Beginners

Recommended

More Related Content

Similar to Dutch PHP 2018 - Cryptography for Beginners (20)

More from Adam Englander (20)

Recently uploaded (20)

Dutch PHP 2018 - Cryptography for Beginners