Cracking the crypto
Download as PPTX, PDF1 like339 views
Cryptography is an important but often neglected part of security testing. The presentation discusses different attacks against cryptographic ciphers and encryption modes. It demonstrates bit-flipping attacks against cipher block chaining and padding oracle attacks. Padding is used to standardize message lengths for encryption and proper padding can be checked by decryption errors, allowing decryption via known plaintext attacks.
Cracking the crypto
- 1. Click to edit Master title style 1 Cracking the Crypto
- 2. Click to edit Master title style 2 $whoami MIHIR SHAH | SHAHENSHAH Github: github.com/shahenshah99 Blog: shahenshah99.blogspot.com 2
- 3. Click to edit Master title style 3 What is Cryptography? Cryptography is a funny topic in penetration testing: it's such a fundamental part of the entire science of information security, but also often neglected in security testing. 3
- 4. Click to edit Master title style 4 What do we plan on doing today? • Bit-flipping attacks against cipher block chaining algorithms • Sneaking in malicious requests by calculating a hash that will pass verification; we'll see how cryptographic padding helps us • Padding oracle attack; as the name suggests, we continue to look at the padding concept • Installation of two deliberately vulnerable web applications for testing in your home lab 4
- 5. Click to edit Master title style 5 When we consider attacks against cryptographic ciphers, we usually think about those attacks against the cipher itself that allow us to break the code and recover plaintext. It's important to remember that the message can be attacked, even when the cipher remains unbroken and, indeed, even the full message is unknown. 5 What are we attacking exactly, again?
- 6. Click to edit Master title style 6 B lock ciphers – A s t he name implies, it encrypt s dat a in f ixed lengt hs of blocks. From a securit y st andpoint , t his concept implies t hat secure encrypt ion is easily achieved f or a single block of data; you could have high - entropy key mat erial w it h t he same lengt h as t he block. H ow w e repeat edly encrypt block af t er block and link everyt hing t oget her is called a mode of operat ion . 6 Block Ciphers and mode of Operations
- 7. Click to edit Master title style 7 Rather than me filling up this slide, to explain how this works. Let me show you a demo for the same 7 Electronic Codebook(ECB)
- 8. Click to edit Master title style 8 You still don't know what the message is . In the realm of cryptanalysis, this is a major breakthrough. A simple rule of thumb about good encryption is: the cipher text should have no relationship w hatsoever w ith the plaintext. In this case, w e already know something is repeating. The effort to attack the message is already underw ay 8 Ok, we found a Pattern, So what?
- 9. Click to edit Master title style 9 Enter Cipher Block Chaining (CBC), where we encrypt a block just like before – except before we encrypt the next block, we XOR the plaintext of the next block with the encrypted output of the previous block, creating a logical chain of blocks. 9 Introducing Block Chaining
- 10. Click to edit Master title style 1010
- 11. Click to edit Master title style 11 If we XOR the plaintext block with the encrypted output of the previous block, what's the XOR input for the first block? 11 Hang on!!
- 12. Click to edit Master title style 12 B e f o r e m o v i n g o n l e t s j u s t l o o k a t a D e m o o n t h e C B C b a s e d e n c r y p t i o n f o r t h e s a m e t e x t 12 we need an initial value appropriately called the initialization vector (IV)
- 13. Click to edit Master title style 1313 Setting and attacking our Bit-Flipping Lab
- 14. Click to edit Master title style 1414 Manipulating the IV to generate predictable results
- 15. Click to edit Master title style 1515
- 16. Click to edit Master title style 1616 Busting the Oracle Padding
- 17. Click to edit Master title style 17 What is padding and Why should I care? messages that need to be encrypted are not of a fixed length; they may be as short as Hello World! or as long as the Zimmermann Telegram. This is where padding comes in. PKCS#5/PKCS#7 uses padding bytes, which are nothing more than a hexadecimal number
- 18. Click to edit Master title style 1818 The number is equal to the number of padding bytes. For example, if there are five padding bytes, they'll all be 0x05.
- 19. Click to edit Master title style 19 The purpose of this is to provide the error-checking mechanism inherent to this design. So if I come along and decrypt a message only to find five padding bytes with the value 0x07, then guess what prophecy this wise oracle is telling? Padding error.
- 20. Click to edit Master title style 20 • The encrypted data w as padded correctly, and contains valid server data once decrypted. Basically, a completely normal operation. The server responds w ith HTTP 200 OK. • The encrypted data w as padded correctly, and contains invalid server data once decrypted. This is just like sending something unexpected to a server w ithout encryption, for example, a file request for a non -existent file. This is technically an HTTP 200, but typically w ith a custom error (for example, File Not Found). • The encrypted data w as padded incorrectly, w hich breaks the decryption process and hence, nothing gets actually passed to the server. This causes a cryptographic exception and the response is an HTTP 500 Internal Server Error. 20 The oracle can tell us one of three things when we pass encrypted data to the target:
- 21. Click to edit Master title style 2121 The other half is the concept we introduced at the beginning of the chapter: when you know two out of three binary values that have an XOR relationship to each other, you can easily solve for the missing field. So, we tweak the enciphered bits and repeatedly submit our modified requests, chatting with the oracle for state feedback, until we stop breaking decryption and the oracle tells us the padding looks good. With the oracle confirming the correct padding, this attack becomes a form of known- plaintext cryptanalysis, allowing us to decrypt the message.
- 22. Click to edit Master title style 22 PadBuster can work with this via the -noiv flag and thus uses the first bytes as an IV; the number of bytes used as an IV is defined in the block size parameter. We also know that CBC mode ciphers XOR the intermediary bits (that is, the bits after the encryption process) with the corresponding bits from the previous block (block chaining), so once decryption has begun, PadBuster works backwards.
- 23. Click to edit Master title style 2323 Q&A
- 24. Click to edit Master title style 24 Thank You