<p>In May 2018 I talked at RustFest Paris about <a href="https://github.com/ctz/rustls">rustls</a>. There are <a href="https://github.com/ctz/talks/blob/master/rustls-rustfest.pdf">slides</a> and a video:</p> <iframe width="620" height="420" src="https://www.youtube.com/embed/aHMRFZkXq4Y" frameborder="0"…
<p>This post has been superseded by a <a href="/2019/07/01/rustls-vs-openssl-performance.html">later, more thorough analysis</a>.</p> <hr />
<p>This is documentation for how I measure the coverage of <a href="https://github.com/ctz/rustls">rustls</a> using the <a href="https://compiler-rt.llvm.org/">LLVM "profile" compiler runtime library</a>.</p> <h1 id="Previous_attempts">Previous attempts</h1> <p>Prior to this work, I used <a…
<p>I gave a talk about <a href="https://github.com/ctz/rustls">rustls</a> at the Bay Area Rust Meetup in February. There are <a href="https://github.com/ctz/talks/raw/main/rustls.pdf">slides</a> and a video:</p> <iframe src="https://air.mozilla.org/rust-meetup-february-2017-02-09/video/" width="640"…
<p><a href="https://software.intel.com/en-us/sgx-sdk">SGX</a> is a way of running security-sensitive user-mode code in an '<strong>enclave</strong>'. Code running in an enclave has its memory encrypted and authenticated, and cannot be observed by code running anywhere else. It's able to use device-specific keys to encrypt…
<p><a href="https://fidoalliance.org/specifications/overview/">U2F</a> is another authentication technology which requires a trusted verifier, like a remote server: fundamentally the output of an authentication is 'Yes' or 'No' rather than some key material or new capability.</p> <p>OTPs fall into this category too. Biometrics usually also do;…
<p>This is a summary of a talk I gave at Passwords15 on 2015-08-05 in Las Vegas. There are <a href="https://github.com/ctz/talks/blob/master/pbkdf2/pbkdf2.pdf">slides</a> and a video:</p> <iframe width="620" height="420" src="https://www.youtube.com/embed/k_szwKBuNBw" frameborder="0" allowfullscreen></iframe> <hr />…
<p>With the publication of an <a href="http://eprint.iacr.org/2015/1129">excellent technical report</a> by Martin Albrecht and Kenny Paterson on the problems with s2n I thought I'd publish my contemporaneous report to Amazon.</p> <p>I didn't disclose/publish further at the time because I didn't also discover the second finding of their paper: that…
<p>When parsing an ASN.1 ECParameters structure OpenSSL enters an infinite loop if the curve specified is over a specially malformed binary polynomial field.</p> <p>This can be used to perform denial of service against any system which processes public keys, certificate requests or certificates. This includes TLS clients, TLS servers with client authentication enabled, and assorted offline…
<p>You can get a lot of embedded processing power for a euro these days.</p> <p>An ARM Cortex-M0-based STM32F030 costs €1.11<sup class="footnote-reference"><a href="#1">1</a></sup> and has approximately the computing power of a 1994-era 486 costing about €416<sup class="footnote-reference"><a href="#2">2</a></sup>.</p> <p>How does modern authenticated encryption run…
<p>Consider any of the following problems:</p> <ol> <li> <p>We have a widget that we'd like to set up using a smartphone. The widget doesn't have any user interface, and adding one is inappropriate (say, it's a light bulb).</p> </li> <li> <p>I have an iPad and an Android phone. I want to send a small amount of information between the two.</p> </li> <li> <p>I…
<p>This is a public comment made on the subject of the <a href="https://fidoalliance.org/">FIDO</a> U2F public standards. Submitted 2014-10-21.</p> <hr /> <p>U2F specifies use of ECDSA by referencing ANSI X9.62. This version of ECDSA (also described in SEC1, FIPS186-3, P1363, etc.) catastrophically fails in a number of cases surrounding the guessing entropy and reuse…
<p>Here's a review of <a href="https://otr.cypherpunks.ca/">libotr</a> I performed on a couple of long plane journeys recently.</p> <h1 id="The_source">The source</h1> <p>The reviewed source is <a href="https://github.com/off-the-record/libotr/tree/3172d79b3f60513aeb10a22450cb1ca2cf145016">this tree</a>. I passed all the source…
<p>Let's assume for a moment you are an IoT company like <a href="https://nest.com/">Nest</a>, controlling<sup class="footnote-reference"><a href="#1">1</a></sup> a chunk of devices which use energy. The more energy demand at your behest, the better: HVAC, refrigerators and heating are excellent choices.</p> <p>Your business model is probably a mix of…
<p>A bug in Android's keystore service means private keys stored by one app can be leaked to other apps, in violation of the guarantees the keystore service makes to apps.</p> <p>This bug affects all Android devices from ICS (4.0) onwards. Devices with a lock PIN, passphrase or pattern enabled are not affected: setting one is the recommended work-around.</p> <h1…
<p>This analysis is in four parts. First, there's an <a href="#1._Introduction">introduction</a> for readers not familiar with the API. Next, there's a review of <a href="#2._Implementation">the implementation</a> of the functions in OpenSSL. Third, the <a href="#3._Callers">callers</a> of these functions are analysed. Lastly, there's a set of <a…
<p><a href="https://docs.google.com/presentation/d/11eBmGiHbYcHR9gL5nDyZChu_-lCa2GizeuOfaLU2HOU">CRIME</a> and <a href="http://breachattack.com/">BREACH</a> are cool practical attacks, described in essence by Kelsey back in 2002. CRIME targets TLS-level <code>zlib</code> compression, while BREACH attacks HTTP <code>Content-Encoding</code>…
<p>Current deployments of TLS have a number of ongoing security problems, mostly arising from the vast complexity in the TLS standard, past poor design decisions and configuration errors.</p> <style> span.tbc { color: #c00; font-style: italic; } </style> <p>Note: <span class="tbc">this post should be considered a work-in-progress until this notice is removed.</span></p> <h1…
<p>In which I try to guess where the recent <a href="http://android-developers.blogspot.com/2013/08/some-securerandom-thoughts.html">SecureRandom is not seeded</a> problem is on Android. First, some background...</p> <h1 id="Zygote">Zygote</h1> <p>Android tries to improve app startup time and memory usage by forking all normal apps from a…
<p>Recently there has been a <a href="https://community.qualys.com/blogs/securitylabs/2013/06/25/ssl-labs-deploying-forward-secrecy">sequence</a> of <a href="http://www.theregister.co.uk/2013/06/26/ssl_forward_secrecy/">recommendations</a> promoting the use of TLS ciphersuites which provide <a…