Cryptography

Últimamente, tanto en auditorías que realizamos, como en código que encuentro en la red, hay una cosa que me llama poderosamente la atención, y es el mal uso (o uso incompleto) de las funciones de criptografía. Por lo general, el procedimiento que suelen seguir los desarrolladores que no están en contacto con el mundo de la seguridad, suelen consistir en coger un método que venga con la API del lenguaje o en una librería de terceros, buscar el método que implementa el algoritmo de cifrado de turno, rellenar la firma del método y almacenar la salida. ...

As you probably already heard in recent news, 1,000,001 Apple UDID’s were leaked. It’s unfortunate that so many apps use UDID’s to identify users since it’s extremely insecure. This brings me to WhatsApp, a free messaging service, used by millions of people. Their system runs on a modified version of XMPP (Extensible Messaging and Presence Protocol). There is nothing wrong with using XMPP, but there is a problem in how WhatsApp handle authentication. If you installed WhatsApp on an Android device for example, your password is likely to be an inverse of your phones IMEI number with an MD5 cryptographic hash thrown on top of it (without salt). md5(strrev(’your-imei-goes-here’)) ...

Our investigation focuses on Microsoft proprietary protocols with the help of a network trace and references. The steps that will be covered are specific to authentication view (MS-Chapv2), key derivation for encryption and the algorithm of the compression feature (MPPE/MPPC). Finally, to complete our approach, we will illustrate weaknesses through a new forensic tool dedicated to these protocols. Mainline : Details on MSChap-v2 : The first chapter aims to understand how the authentication protocol works ; Overview of MPPE protocol : We explain briefly the encryption protocol ; Overview of MPPC protocol : Here, we take a look at the compression feature ; Decipher MPPE by breaking MSCHAP-v2 : We decipher MPPE protocol with the help of MSChap-v2; ...

I regularly receive e-mail from people who want advice on how to learn more about computer security, either as a course of study in college or as an IT person considering it as a career choice. First, know that there are many subspecialties in computer security. You can be an expert in keeping systems from being hacked, or in creating unhackable software. You can be an expert in finding security problems in software, or in networks. You can be an expert in viruses, or policies, or cryptography. There are many, many opportunities for many different skill sets. You don’t have to be a coder to be a security expert. In general, though, I have three pieces of advice to anyone who wants to learn computer security. ...

Although the Enigma cipher as a whole is quite complex (it’s complexity is comparable to modern cryptographic algorithms) the individual transformations within it are relatively simple. In fact, they are simple enough that you can decipher an Enigma message with just a paper model. Our model is three-dimensional, to illustrate the wiring of a real Enigma machine. It needs only common household items to construct, and is completely compatible with all settings of a real Enigma machine (models I, M1, M2 and M3). ...

The general thrust of this post is: use a MAC function like HMAC to sign data, don’t use hash functions. Although not all hash functions suffer from the problem I’m going to illustrate, in general using a hash function for message authentication comes with a lot of potential problems because those functions aren’t designed for this task. You shouldn’t try to work around it by creatively processing the inputs or inventing some fancy way of chaining hash functions. Just use the functions that were designed for this task instead of inventing your own crypto schemes. ...

El caso TheFlame ha promovido muchas reacciones: los articulistas rellenan páginas con prefijos ”ciber” y la palabra ”guerra”. Las casas antivirus lo usan como arma de venta (aun sin haberlo detectado en cinco años) y Microsoft queda en evidencia con su PKI y la refuerza. TheFlame ha minado también la confianza: en los gobiernos, en los antivirus… pero sobre todo, en la criptografía y en la actualización automática. » hispasec.com

This document is a gentle introduction to computational number theory. The plan of the paper is to first give a quick overview of arithmetic in the modular integers. Throughout, we will emphasize computation and practical results rather than delving into the why. Simple programs, generally in JavaScript, are available for all of the algorithms mentioned. At the end of the paper we will introduce the Gaussian Integers and Galois Fields and compare them to the modular integers. Companion papers will examine number theory from a more advanced perspective. ...