Hacker Time

Alright, well, let's get started. What I'm going to, this is kind of the high level agenda I have today. I wanted to talk about I wanted to do some programming live and go through some really basic security stuff that's kind of tricky and there's a lot of details. So first, I want to talk about basic cryptographic operations, using the programming language, going. And so first I'm going to spin up a go program, a hello world type program and then I'll pull up some going docs and start walking through them. And I just want to. My goal here is to have a basic test case going where I can encrypt and decrypt something and be able to explain that succinctly about what's going on and and and why so. Let me close this and open up the program that will be using to Open up the program will be using to do this. So I'm going to write hacker time.co and we already have my I use them and my them my them. I have a plugin that's already taking care of creating the basic hello world program. So I can actually just run that program that was already populated when I open the program. Open the open the file. See it prints up them go and but I don't want this to be a main Package main means means it's actually a main program you're running it's but I don't want it to be a program that we run. I just want it to be a package that people can use and and test out. So I'm going to make this hacker time And we don't need a main method anymore. And And we want basically two functions, one for encrypt one for decrypt. And so let's start off with encrypt And let's start off with decrypt Decrypt Nice and I have a, I have a belief that Programming is one of the most important skills that somebody in the security industry can have And people who are in the security industry rarely get to flex their programming chops or do anything past basic scripting. They don't usually do much Real software engineering where you're writing thousands of lines of code. It's normally really intentional lines of code where you might whip up 100 line Python script or you might You might do some basic changes here and there to a bigger code base, but you're never really doing real software engineering and so So this kind of stuff is great to be able to to to to flex those those neurons in your brain and practice so encrypting and decrypting. How do we do this. What's the best way and go. Well, let's take a look at what Golang has in their crypto package. And one thing that I love about Golang as a security person is the docs are amazing. So I hope you can see this, you'll see that I just googled Golang crypto and Shout out to all the Golang maintainers who work really hard on the crypto package, especially, and all the other all the other main go packages and you'll, you'll see a bunch of stuff in here. And none of it is what we want. There's like a bunch of crypto interfaces and stuff. So actually, that's not what we want. We probably want to go one layer deeper and be more specific than just crypto Golang We want to take a look at some of these. So these are actually all cryptographic primitives that we could be using. There's a lot to unpack here. Like if you don't know much about cryptography. How do you even get started. There's SHA -1, SHA-256, SHA-512. Is that encryption. The answer is no and And it's, it's really tricky. All of these details in the world of cryptography are really important to get right. Because if you use something improperly or your understanding of the specific security technology is not complete You could, you could be opening up whatever software you have to attacks that that you didn't expect. So one of the main ways that people encrypt data is using AES And this stands for Advanced Encryption Standard. It is a very strong encryption algorithm. And the thing to know and where I'm kind of leading with this is that actually this stuff in the crypto Golang package. It is not really enough to do something securely and to do encryption and decryption securely. Because what AES does is it's a method for encrypting data, but there's also these different modes of AES different ways that AES is implemented and So you'll see here. That as I scroll down Where do they talk about the modes here. So they have a modes.go And you'll see they've implemented GCM Galois Galois counter mode. CBC cipher block chaining mode. CTR, which I believe is counter mode. These are different modes of AES and they all have slightly different purposes. They're all good for some things. They're all bad for some things. And turns out AES is really great for encrypting and decrypting data super secure. Very well studied in the cryptographic community. However, it's not really what we want to be encrypting and decrypting data securely because one, we have to learn about all these modes and That doesn't seem right. And it's, it's, it's not, it's just something about that isn't good. So what what the main recommendation from security experts is these days is you should be using what's known as an AE AD authenticated encryption. And the idea here is that Knowing about the algorithm you're using is one piece of doing secure encryption and decryption and and using these cryptographic primitives properly, but there are these other things which mode you use which How do you make sure that when you encrypt something and you have a ciphertext that somebody isn't messing with that ciphertext authentication of the ciphertext And so that's why these authenticated encryption. That's why this ad standard was created, where they kind of bundled up all of these Things where they bundled up how you do the authentication of the ciphertext what mode it is and what encryption algorithm. It is they bundled it up into one thing and And And you use that instead of using the underlying primitives and so We want to be doing authenticated encryption and going so Let's Google ad going And What I usually look for is The secret box. And let's take a moment and read some of this. So there's two standards for eight for that I like to use and go lane. One is box and one is secret box. Let's pull up box as well. And there is a very key distinction between these And the very first line is what you need to Read to get that distinction in box, you'll see package box authenticates and encrypt small messages using public key cryptography Secret box will be symmetric key And so So this is kind of the one area that you need to pay attention to when using one of these at is One of the one of the few areas you need to pay attention to, and it is Our do you need public key crypto or do you need symmetric key crypto. So in this case, we just want to be simple. Let's just use secret box, we can use symmetric key crypto and it's a lot simpler. If you look back at the AES It's this isn't so complex. Actually, but You have to create a cipher and you're actually using The functions of this interface. So the docs are a little funky to traverse here. If you're using the AES The AES standard, but if you use secret box. This makes a ton of sense to me. You have data. You either want to seal and protect the data. So encrypt or open and decrypt and so So that is really simple and and makes a lot of sense in my mind. I don't work very well in abstractions with all of these like interfaces and stuff. Clicking around in docs really isn't for me. So it seems like the functions that we want in our code for encrypt. We want seal and then for decrypt. We want to open and so let's check out seal. And we will try to implement this out message seal takes in four pieces of data, your secret key your nonce your message and you're out and open does the same thing out box. So this is the data that you're decrypting nonce I'll explain that in a moment key and then it returns bite and pool and seal just returns a bite array. And so seal will encrypt whatever you send it box will open it and then What's this bull, though, is that telling you whether or not it was successful. Let's pull it up. Looks like if there's a failure for whatever reason they're returning false for know it was not successful. You'll see here in the implementation of open here that that That whenever there's a failure, they return false here and no data. That has been decrypted. So this is all the magic implementation of how the ad is implemented and Looks like on success they return true. Great. So when they get to the end of the function they return true. So if we get false when if we ever see false from this pool will know an error happened. Okay, let's try to use these Let me go back to the docs. So seal. Let's start by copying and pasting the function signature into seal, which will be encrypted. So we also need to include this secret box seal. And We need some variables here. So we need out, which is a bite array. We need message, which is bite. We need a nonce, which is very specific length. He, which is also very specific length. And That looks right to me. Might need to add some pointers here and there, but This should be pretty good. And it returns a All right. What have I done here. How's this code wrong. Let me make this a little larger. Undefined secret box. Alright, so what this is saying is I need to get this package. I need to get this going.org crypto This this code here isn't included in the ghost standard set of packages, you get right from right from the get go when you install go. And so I actually have to download this from going.org is pretty reputable. So you just use go get And Undefined secret box. What have I done here. Undefined secret box. This is what should be happening. I wonder if my go imports isn't working. That's actually possible. Yeah, I don't think my go imports is working. That shows you how little programming. I do that. Go imports isn't working and I didn't know it. Okay, so we've got the code up top and we've got my errors down below. Let's, let's try to read them hacker time go line 12 cannot use nonce type 24 length byte array as a pointer to a 24 length byte array so As all great programmers do let's add an asterisk and see what happens. Here's line 12 and nonce is what they're complaining about. So let's pass by reference here and likewise with key. Off declared and not used. Okay, that's progress and let's print out buff and go import seem to work there so Maybe it's working. Alright, so, so we have we have some semblance of something. This won't really do anything. I haven't populated this with any data. But let's try to get a test case written so we can actually run this code and see what happens. See if it prints see start adding some values in here and see what happens. So let me open up hacker time test go and let me get a This is how I always get my test started. I Google going tests I copy and paste one of these and Great. Look at this. In some values and we're cooking here. I can call encrypt and just see what happens. So run go test the dash V and Looks like the test pass and it encrypted whatever this is. With a bunch of empty values. This is what we get out. I wonder if we'll get the same thing twice and we do All right. Well, that's awesome. Our code is running. It's doing something we're not really sure what and so we got to, we got to pass in some values here and we've got to encrypt a real message so Let me bring up the code and bring up our test case. Side by side. And what we want to do. The thing we really care about is we just want to encrypt a message. Right. So let's just pass in a string. And that's really our message. And we'll have to convert this string to a byte array. And get rid of this. But yeah, now we should be able to encrypt whatever we want. And so The only message worth encrypting really is be sure to drink your oval team. And Let's see what happens. Now we should get a different value than this array. You see here, you see here it's 92 134 54 to 17 and we got that thing twice. And so we should see a different value here. But we should still see the same value every time. Yeah. All right. You'll notice it's much longer. You'll notice that this ciphertext is much longer. And the reason for that is because we passed in a longer message before the message was just a blank string. It was just a No bites. We weren't really encrypting anything. And so now we actually have some bites to encrypt and so message is longer. Okay, but we haven't really, we have no secret key. And the whole point of encryption is that you have a key and nobody else has that key. And so, so that's the whole that's where all the security is meant to be in cryptography is I have a key. You don't. So I can decrypt the message, no matter what you do. And I can do so securely. And then there's also this non thing. Let me talk about that for a moment. Nonce Is something that you use once it's a piece of random data and in the context of an ad, you just want to generate some random bites pass it in when you when you encrypt and then Never use and then Take that nonce and when you are So there's, there's a question that I have real really quick. Is the nonce needed to encrypt and decrypt And that depends on the function signature here and all I realized I didn't actually explain the nonce here. But yeah, so the nonce is passed in when you encrypt and decrypt and it's just a random bunch of bites that That ensures that when I encrypt data to you that the It adds it's used as in the encryption. Operation and decryption operation and it makes sure that my cipher text. If I encrypt to you the message. Hello. Every time Every day at 1230 then It'll never be the same cipher text twice. And so that's a very important cryptographic property. And so it's very important not to reuse nonces because if I ever reuse the nonce when I'm messaging you. Hello at 1230 every day at the same time. There'd be a problem you would see randomly one day if you're eavesdropping on the on my communications, you would see that. Wait, Evan sends a message to To somebody every day at 1230 saying saying a bunch of bites. But one time he sent the same bites and And that gives attackers, a lot of ideas about how to break into your system and break into break your cryptography and there are more There are more subtle like nonce reuse attacks and more. There's a lot more details there. But the general idea and the principle, you need to know is that nonce is it has a word once in it and you want to use it once just generate a random one, use it. And so let's do some let's do some randomness generation here. We want to use crypto Rand. Crypto Rand and There's two rands in going One is math ran. There might be more, but I at least know about two there's math brand and crypto Rand and with Regard to math brand. You don't want to use it for anything security related might be good for math. That's why it's in the math package for anything security related use the crypto Because The, the properties of those randomness generators are very different. So what we want to do is do a Rand read and we pass in a bite array here and we get back Some an error. If it didn't work and The number of bites it read. So let us generate a Let's pass our nonsense here. And we may need to do some funkiness here. And let's see if this actually works. Returns the number of bites it read And an error. Let's just print them out. Okay. So let's try to run our test. Okay. Crypto is undefined That's unexpected. Crypto Rand. Oh, duh. It's crypto Rand, not Rand. So the packages ran. No. And this is Rand read, I believe. Crypto Rand. Yeah, Rand read not math read Crypto Rand. Read. I believe this The computer should like this much better. Great. So Let's print out my random bites and we should should look different every time. So let's get rid of this. Say, You read And this is nonce. This is an You read Your bites are Just printed out as a string, because in my mind, everything is a string and anyone who disagrees. Wrong by printing out the printing out the bytes as a string. You can't lose. Okay. And let me print this out. And what is interesting here is you will see you read 24 bytes and your bites. This doesn't look like 24 bytes, but I promise you it is. Let's take a look each time. And it's different each time. So we are successfully reading from From Debbie random is what is actually happening under the hood and we're getting 24 random bites and we've, we've just securely generated our nonce every time. And And we're slow. We're close to getting out of time. And so I'm going to keep programming. I'm just going to program up to the end of time and keep talking and And but do expect that I will get cut off and all this code is going up here on Hacker time github.com slash ej CX slash hacker time and I'll be committing this code afterwards to this and you can see it play with it and feel free to file issues for everything that I did wrong. I'm happy to fix those for you. And so the other thing we need is we need a key. So we have announced, but we also need a key and the same thing will work here. And this will be a random key which might not be what we want because What that actually means is we are Never going to be able to decrypt the message unless we save that random key if we run this code and we're generating a new random key every time. What's the point of that like your key is supposed to be consistent for at least one message for you to actually For you to actually encrypt and decrypt and so This will Run us a random key now though. I believe Yep. So now we have a random knots and a random key each time. And I'm going to commit this up to GitHub and call it a show. And so I appreciate everyone for joining me. I didn't get as far as I hoped. I hope it was educational, though, because I don't know. I don't know. I don't know much content like this out there and I really think that security people could benefit a lot from spending more time programming Spending more time implementing the security controls that they care so much about. Because it's really important to understand the nitty gritty details of how they work and and with that I will send my message. Thank you for watching. I Forgot the dash. And thank you for watching and I will get push that you origin master and It's there. Thank you so much. I appreciate it. I appreciate you watching and until next time. I