Cryptgenrandom()
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Making Sense of Snowden, Part II: What's Significant in the NSA
web extra Making Sense of Snowden, Part II: What’s Significant in the NSA Revelations Susan Landau, Google hen The Guardian began publishing a widely used cryptographic standard has vastly wider impact, leaked documents from the National especially because industry relies so heavily on secure Inter- Security Agency (NSA) on 6 June 2013, net commerce. Then The Guardian and Der Spiegel revealed each day brought startling news. From extensive, directed US eavesdropping on European leaders7 as the NSA’s collection of metadata re- well as broad surveillance by its fellow members of the “Five cords of all calls made within the US1 Eyes”: Australia, Canada, New Zealand, and the UK. Finally, to programs that collected and stored data of “non-US” per- there were documents showing the NSA targeting Google and W2 8,9 sons to the UK Government Communications Headquarters’ Yahoo’s inter-datacenter communications. (GCHQs’) interception of 200 transatlantic fiberoptic cables I summarized the initial revelations in the July/August is- at the point where they reached Britain3 to the NSA’s pene- sue of IEEE Security & Privacy.10 This installment, written in tration of communications by leaders at the G20 summit, the late December, examines the more recent ones; as a Web ex- pot was boiling over. But by late June, things had slowed to a tra, it offers more details on the teaser I wrote for the January/ simmer. The summer carried news that the NSA was partially February 2014 issue of IEEE Security & Privacy magazine funding the GCHQ’s surveillance efforts,4 and The Guardian (www.computer.org/security). -
NSA's Efforts to Secure Private-Sector Telecommunications Infrastructure
Under the Radar: NSA’s Efforts to Secure Private-Sector Telecommunications Infrastructure Susan Landau* INTRODUCTION When Google discovered that intruders were accessing certain Gmail ac- counts and stealing intellectual property,1 the company turned to the National Security Agency (NSA) for help in securing its systems. For a company that had faced accusations of violating user privacy, to ask for help from the agency that had been wiretapping Americans without warrants appeared decidedly odd, and Google came under a great deal of criticism. Google had approached a number of federal agencies for help on its problem; press reports focused on the company’s approach to the NSA. Google’s was the sensible approach. Not only was NSA the sole government agency with the necessary expertise to aid the company after its systems had been exploited, it was also the right agency to be doing so. That seems especially ironic in light of the recent revelations by Edward Snowden over the extent of NSA surveillance, including, apparently, Google inter-data-center communications.2 The NSA has always had two functions: the well-known one of signals intelligence, known in the trade as SIGINT, and the lesser known one of communications security or COMSEC. The former became the subject of novels, histories of the agency, and legend. The latter has garnered much less attention. One example of the myriad one could pick is David Kahn’s seminal book on cryptography, The Codebreakers: The Comprehensive History of Secret Communication from Ancient Times to the Internet.3 It devotes fifty pages to NSA and SIGINT and only ten pages to NSA and COMSEC. -
An Enhanced Advanced Encryption Standard Algorithm
ISSN 2278 – 3091 International Journal of Advanced Trends in Computer Science and Engineering (IJATCSE), Vol. 4 , No.4 Pages : 28 - 33 (2015) Special Issue of ICEEC 2015 - Held on August 24, 2015 in The Dunes, Cochin, India http://warse.org/IJATCSE/static/pdf/Issue/iceec2015sp06.pdf An Enhanced Advanced Encryption Standard Algorithm Kshyamasagar Mahanta1, Hima Bindu Maringanti2 1Department of Computer Science & Engineering, North Orissa University, India, [email protected] 2Department of Computer Science & Engineering, North Orissa University, India, [email protected] modifying the shift row phase involved . Similarly, in 2010, Abstract: In today’s world most of the communication is El-Sayed Abdoul-Moaty ElBadawy et. al. and in 2011, done using electronic media. Data Security plays a vital role Zhang Zhao et. al. have modified the standard AES in such communication. Hence, there is a need to protect data algorithm by modifying the S-box generation using 1-D from malicious attacks. Cryptography is the study of logistic chaos equation . In 2011, Alireza Jolfaei et. al. have mathematical techniques related to aspects of information identified such issues and modified the standard algorithm by security such as confidentiality, data integrity, entity modifying the S-box using the chaotic baker’s map equations authentication and data origin authentication. In data and . telecommunications, cryptography is necessary when Here, we have followed a different approach by encrypting communicating over any unreliable medium, which includes the key used in the AES algorithm. For the key encryption, any network particularly the internet. we have used the RNG algorithm, which gives a unique Advanced Encryption Standard (AES), also known as random key for each time of encryption. -
A Practical Implementation of a One-Time Pad Cryptosystem
Jeff Connelly CPE 456 June 11, 2008 A Practical Implementation of a One-time Pad Cryptosystem 0.1 Abstract How to securely transmit messages between two people has been a problem for centuries. The first ciphers of antiquity used laughably short keys and insecure algorithms easily broken with today’s computational power. This pattern has repeated throughout history, until the invention of the one-time pad in 1917, the world’s first provably unbreakable cryptosystem. However, the public generally does not use the one-time pad for encrypting their communication, despite the assurance of confidentiality, because of practical reasons. This paper presents an implementation of a practical one-time pad cryptosystem for use between two trusted individuals, that have met previously but wish to securely communicate over email after their departure. The system includes the generation of a one-time pad using a custom-built hardware TRNG as well as software to easily send and receive encrypted messages over email. This implementation combines guaranteed confidentiality with practicality. All of the work discussed here is available at http://imotp.sourceforge.net/. 1 Contents 0.1 Abstract.......................................... 1 1 Introduction 3 2 Implementation 3 2.1 RelatedWork....................................... 3 2.2 Description ........................................ 3 3 Generating Randomness 4 3.1 Inadequacy of Pseudo-random Number Generation . 4 3.2 TrulyRandomData .................................... 5 4 Software 6 4.1 Acquiring Audio . 6 4.1.1 Interference..................................... 6 4.2 MeasuringEntropy................................... 6 4.3 EntropyExtraction................................ ..... 7 4.3.1 De-skewing ..................................... 7 4.3.2 Mixing........................................ 7 5 Exchanging Pads 8 5.1 Merkle Channels . 8 5.2 Local Pad Security . -
Comments Received on Special Publication 800-90A, B and C
Comments Received on SP 800-90A On 9/11/13 12:06 AM, "Robert Bushman" <[email protected]> wrote: "Draft Special Publication 800-90A, Recommendation for Random Number Generation Using Deterministic Random Bit Generators" cannot be trusted to secure our citizens and corporations from cyber-attack, for reasons that should be quite apparent. Please terminate it or replace the PRNG algorithm without the participation of the NSA. On 9/21/13 1:25 PM, "peter bachman" <[email protected]> wrote: See enclosed random.pdf for comment (A picture was attached) From: Mike Stephens <[email protected]> Date: Friday, October 18, 2013 2:47 PM Remove DUAL_EC_DRBG from SP 800-90. [MS] 1 10.3 Page 60 te Published cryptanalysis shows that Dual EC DRBG outputs are biased. This should disqualify the algorithm from inclusion in the standard.i ii [MS] 2 10.3 Page 60 ge Recent publications regarding Dual EC DRBG have significantly compromised public trust in the algorithm to the extent that correcting any mathematical properties of Remove DUAL_EC_DRBG from SP 800-90. the algorithm would not regenerate confidence in it. Continued inclusion of Dual EC DRBG will harm the credibility of the SP-800 series of standards. [MS] 3 11 Page 72 ge The SP-800 series standardizes algorithms, not implementation aspects. Self-test requirements should come from FIPS 140-2. The current self-test requirements in SP 800-90 do not align with or cooperate with FIPS 140-2 Remove self-test requirements from SP800-90. requirements. Should the self-test requirements remain in SP 800-90; then, harmonize these requirements with those in FIPS 140. -
Crypto Won't Save You Either Sound Advice from The
14/01/2016 Crypto Won’t Save You Either Peter Gutmann University of Auckland Sound Advice from the USG 1 14/01/2016 Saw Something, Said Something Saw Something, Said Something (ctd) You’re not paranoid, they really are out to get you 2 14/01/2016 BULLRUN Funded to the tune of $250-300M/year BULLRUN (ctd) This is fantastic value for money! Compare the BULLRUN cost to the JSF • $60 billion development • $260 billion procurement • $100-200 million each (lots of different cost estimates) • $600-700 million each over operational lifetime BULLRUN is a bargain by comparison 3 14/01/2016 BULLRUN (ctd) “capabilities against TLS/SSL, HTTPS, SSH, VPNs, VoIP, webmail, ...” BULLRUN (ctd) “aggressive effort to defeat network security and privacy” “defeat the encryption used in network communication technologies” 4 14/01/2016 BULLRUN (ctd) The first rule of BULLRUN club… What’s that NSAie? Crypto’s fallen in the well? 5 14/01/2016 I Know, Bigger Keys! We need to get bigger keys. BIG F**ING KEYS! — “Split Second”, 1992 Quick, do something! Cue the stannomillinery 6 14/01/2016 Crypto Won’t Save You Shamir’s Law: Crypto is bypassed, not penetrated Cryptography is usually bypassed. I am not aware of any major world-class security system employing cryptography in which the hackers penetrated the system by actually going through the cryptanalysis […] usually there are much simpler ways of penetrating the security system — Adi Shamir Example: Games Consoles All of the major consoles use fairly extensive amounts of sophisticated cryptography • PS3 • Wii • Xbox -
How to (Pre-)Compute a Ladder
How to (pre-)compute a ladder Improving the performance of X25519 and X448 Thomaz Oliveira1, Julio L´opez2, H¨useyinHı¸sıl3, Armando Faz-Hern´andez2, and Francisco Rodr´ıguez-Henr´ıquez1 1 Computer Science Department, Cinvestav-IPN [email protected], [email protected] 2 Institute of Computing, University of Campinas [email protected], [email protected] 3 Yasar University [email protected] Abstract. In the RFC 7748 memorandum, the Internet Research Task Force specified a Montgomery-ladder scalar multiplication function based on two recently adopted elliptic curves, \curve25519" and \curve448". The purpose of this function is to support the Diffie-Hellman key ex- change algorithm that will be included in the forthcoming version of the Transport Layer Security cryptographic protocol. In this paper, we describe a ladder variant that permits to accelerate the fixed-point mul- tiplication function inherent to the Diffie-Hellman key pair generation phase. Our proposal combines a right-to-left version of the Montgomery ladder along with the pre-computation of constant values directly de- rived from the base-point and its multiples. To our knowledge, this is the first proposal of a Montgomery ladder procedure for prime elliptic curves that admits the extensive use of pre-computation. In exchange of very modest memory resources and a small extra programming effort, the proposed ladder obtains significant speedups for software implemen- tations. Moreover, our proposal fully complies with the RFC 7748 spec- ification. A software implementation of the X25519 and X448 functions using our pre-computable ladder yields an acceleration factor of roughly 1.20, and 1.25 when implemented on the Haswell and the Skylake micro- architectures, respectively. -
Analysis of Entropy Usage in Random Number Generators
DEGREE PROJECT IN THE FIELD OF TECHNOLOGY ENGINEERING PHYSICS AND THE MAIN FIELD OF STUDY COMPUTER SCIENCE AND ENGINEERING, SECOND CYCLE, 30 CREDITS STOCKHOLM, SWEDEN 2017 Analysis of Entropy Usage in Random Number Generators KTH ROYAL INSTITUTE OF TECHNOLOGY SCHOOL OF COMPUTER SCIENCE AND COMMUNICATION Analysis of Entropy Usage in Random Number Generators JOEL GÄRTNER Master in Computer Science Date: September 16, 2017 Supervisor: Douglas Wikström Examiner: Johan Håstad Principal: Omegapoint Swedish title: Analys av entropianvändning i slumptalsgeneratorer School of Computer Science and Communication i Abstract Cryptographically secure random number generators usually require an outside seed to be initialized. Other solutions instead use a continuous entropy stream to ensure that the internal state of the generator always remains unpredictable. This thesis analyses four such generators with entropy inputs. Furthermore, different ways to estimate entropy is presented and a new method useful for the generator analy- sis is developed. The developed entropy estimator performs well in tests and is used to analyse en- tropy gathered from the different generators. Furthermore, all the analysed generators exhibit some seemingly unintentional behaviour, but most should still be safe for use. ii Sammanfattning Kryptografiskt säkra slumptalsgeneratorer behöver ofta initialiseras med ett oförutsägbart frö. En annan lösning är att istället konstant ge slumptalsgeneratorer entropi. Detta gör det möjligt att garantera att det interna tillståndet i generatorn hålls oförutsägbart. I den här rapporten analyseras fyra sådana generatorer som matas med entropi. Dess- utom presenteras olika sätt att skatta entropi och en ny skattningsmetod utvecklas för att användas till analysen av generatorerna. Den framtagna metoden för entropiskattning lyckas bra i tester och används för att analysera entropin i de olika generatorerna. -
Chacha20-Poly1305 の実装性能調査
ChaCha20-Poly1305 の実装性能調査 株式会社レピダム 2017 年 10 月 目 次 第 1 章 エグゼクティブサマリー 3 第 2 章 ChaCha20-Poly1305 について 4 2.1 概要 :::::::::::::::::::::::::::::: 4 2.2 歴史的背景 :::::::::::::::::::::::::: 5 2.3 アルゴリズムの構造 ::::::::::::::::::::: 5 2.3.1 ChaCha20 ::::::::::::::::::::::: 5 2.3.2 Poly1305 ::::::::::::::::::::::: 7 2.3.3 ChaCha20-Poly1305 ::::::::::::::::: 8 第 3 章 ChaCha20-Poly1305 の採用状況 11 3.1 標準化動向 :::::::::::::::::::::::::: 11 3.1.1 IETF ::::::::::::::::::::::::: 11 3.1.2 その他の標準化団体 ::::::::::::::::: 14 3.2 OSS コミュニティ動向 :::::::::::::::::::: 14 第 4 章 ChaCha20-Poly1305 の実装性能評価に関する既存文献調 査 17 4.1 論文調査 :::::::::::::::::::::::::::: 17 4.2 ベンチマーク実装評価調査 :::::::::::::::::: 18 4.2.1 Cloudflare 版 OpenSSL ::::::::::::::: 19 4.2.2 Edge Security の WireGuard :::::::::::: 20 4.2.3 Barco Silex の BA417 と Inside Secure の ChaCha- IP-13 / EIP-13, POLY-IP-53 / EIP-53 ::::::: 22 第 5 章 認証暗号方式の性能比較調査 24 5.1 性能比較調査方法 ::::::::::::::::::::::: 24 5.1.1 比較対象アルゴリズム :::::::::::::::: 24 5.1.2 実行環境 :::::::::::::::::::::::: 32 5.1.3 暗号ライブラリ :::::::::::::::::::: 34 5.2 実行コマンド ::::::::::::::::::::::::: 35 5.3 性能比較結果 ::::::::::::::::::::::::: 37 5.3.1 AES-NI 有効の場合 ::::::::::::::::: 37 1 5.3.2 AES-NI 無効の場合 ::::::::::::::::: 46 5.3.3 性能測定における注意点 ::::::::::::::: 51 5.4 考察 :::::::::::::::::::::::::::::: 52 5.4.1 Poly1305 によるオーバーヘッド ::::::::::: 52 5.4.2 AES-NI の影響 :::::::::::::::::::: 53 5.4.3 ChaCha20-Poly1305 と AES-GCM の比較 ::::: 53 第 6 章 まとめ 54 Arm, Cortex, mbed は Arm Limited の登録商標です。 Cloudflare は Cloudflare, Inc の登録商標です。 Google は Google LLC の登録商標です。 Inside Secure は Inside Secure またはその子会社の登録商標です。 Intel は Intel Corporation またはその子会社の登録商標です。 WireGuard は Jason A. Donenfeld の登録商標です。 AVR は Microchip Technology Incorporated の登録商標です。 OpenSSL は OpenSSL Software Foundation の登録商標です。 OpenVPN は OpenVPN Inc. -
Backdoors in Crypto the Problem with Castles
Backdoors in Crypto The Problem with Castles. Treason Doors. Nottingham Castle. ● Roger Mortimer, 1st Earl of March ruled from Nottingham Castle. Nottingham Castle. ● Roger Mortimer, 1st Earl of March ruled from Nottingham Castle. ● Nottingham Castle had a secret tunnel that bypassed all the defenses. Nottingham Castle. ● Roger Mortimer, 1st Earl of March ruled from Nottingham Castle. ● Nottingham Castle had a secret tunnel that bypassed all the defenses. ● 1330 AD - Secret passage isn’t so secret. ○ Overseer of the castle betrays Mortimer. ○ Leads raid through secret tunnel. ○ kills Mortimer’s guards, arrests Mortimer. ○ Mortimer is executed soon after. Maginot Line Fortifications. ● French WW2 fortifications. ● Claim: Designed so that if captured, they would be easier to recapture. What does this have to do with Crypto? ● Can you design a cipher that would keep you secure but you could break if other people used it? ● How? ● What properties should such a backdoor have? Backdoors Definition: ● Backdoors are built-in methods of bypassing the security of a system. Dual EC DRBG Backdoor: Overview ● Dual Elliptic Curve Deterministic Random Bit Generator. ● Backdoored by the NSA. ● Deployed in commercial systems. ● Exposed by Academic Cryptographers and Snowden. Dual EC DRBG Backdoor: How ● Dual Elliptic Curve Deterministic Random Bit Generator. ● Like Blum-Micali, but generates many bits at a time. Dual EC DRBG Backdoor: The players ● NSA - National Security Agency ○ Offensive/Defensive mission: Makes & breaks codes/ciphers, ○ Captures, listens to & analyzes communications. ● NIST - National Institute of Standards and Technology ○ Creates & evaluates national technology standards. ○ Trusted as a fair player nationally & internationally. ● RSA ○ Technology company, created to commercialize public key encryption. -
Additional Source of Entropy As a Service in the Android User-Space
Faculty of Science Additional source of entropy as a service in the Android user-space Master Thesis B.C.M. (Bas) Visser Supervisors: dr. P. (Peter) Schwabe dr. V. (Veelasha) Moonsamy Nijmegen, July 2015 Abstract Secure encrypted communication on a smartphone or tablet requires a strong random seed as input for the encryption scheme. Android devices are based on the Linux kernel and are therefore provided with the /dev/random and /dev/urandom pseudo-random-number generators. /dev/random generates randomness from environmental sources but a number of papers have shown vulnerabilities in the entropy pool when there is a lack of user input. This thesis will research the possibility to provide additional entropy on the Android platform by extracting entropy from sensor data without the need for user input. The entropy level of this generated data is evaluated and this shows that it is feasible to extract randomness from the sensor data within reasonable time and using limited resources from the Android device. Finally, a prototype Android app is presented which uses generated sensor data as input for a stream cipher to create a pseudo-random-number generator in the Android user-space. This app can then be used as an additional source of randomness to strengthen random seeds for any process in the Android user-space on request. Additional source of entropy as a service in the Android user-space 1 Acknowledgements First I would like to thank my supervisor, Peter Schwabe. I started with a number of research projects that did not align with my interests and expertise. -
Practical State Recovery Attacks Against Legacy RNG Implementations
Practical state recovery attacks against legacy RNG implementations Shaanan N. Cohney Matthew D. Green Nadia Heninger University of Pennsylvania Johns Hopkins University University of Pennsylvania [email protected] [email protected] [email protected] ABSTRACT 1 INTRODUCTION The ANSI X9.17/X9.31 pseudorandom number generator design was Random number generation is a vital component of any crypto- first standardized in 1985, with variants incorporated into numerous graphic system. While systems may survive subtle flaws in crypto- cryptographic standards over the next three decades. The design graphic algorithm implementation, the ability to predict the output uses timestamps together with a statically keyed block cipher to of a (pseudo)random number generator typically leads to the cata- produce pseudo-random output. It has been known since 1998 that strophic failure of any protocol built on top of it. In recent years the key must remain secret in order for the output to be secure. a number of cryptographic systems have been found to include However, neither the FIPS 140-2 standardization process nor NIST’s flawed random and pseudorandom number generation subsystems. later descriptions of the algorithm specified any process for key These flaws range from subtle weaknesses, e.g. biases that admit generation. sophisticated attacks against the protocol [49]; to catastrophic vul- We performed a systematic study of publicly available FIPS 140- nerabilities that allow for adversarial recovery of all random coins 2 certifications for hundreds of products that implemented the used in a protocol execution [16, 59]. In a particularly ominous ANSI X9.31 random number generator, and found twelve whose development, some of these flaws appear to have been deliberately certification documents use of static, hard-coded keys in source engineered.