Codereview-Cryptography - Revision history

Thomas Herlea: Added navigation to facilitate sequential reading online

2010-09-09T16:11:49Z

Added navigation to facilitate sequential reading online

2009-02-11T01:04:00Z

‎References

2009-02-11T01:01:23Z

‎Vulnerable Patterns Examples for Cryptography

2009-02-11T01:00:58Z

‎Vulnerable Patterns Examples for Cryptography

2009-02-11T00:59:31Z

‎Use of Standard Cryptographic Libraries

2009-01-13T01:08:07Z

2009-01-13T01:06:20Z

‎Side Channel and Protocol attacks

2009-01-13T01:05:53Z

‎Level of Code Quality

2009-01-13T01:05:30Z

‎Specification Definitions

2009-01-13T01:05:09Z

‎Laws and Regulations on Cryptography

← Older revision		Revision as of 16:11, 9 September 2010
Line 1:		Line 1:
−	[[OWASP Code Review Guide Table of Contents]]__TOC__	+	{{LinkBar
		+	\| useprev=PrevLink \| prev=Codereview-Deployment \| lblprev=Secure Deployment
		+	\| usemain=MainLink \| main=OWASP Code Review Guide Table of Contents \| lblmain=Table of Contents
		+	\| usenext=NextLink \| next=Reviewing Code for Buffer Overruns and Overflows \| lblnext=
		+	}}
		+	__TOC__

	== Introduction ==		== Introduction ==

@@ Line 412: / Line 412: @@
 [8] Bert-Jaap Koops, Crypto Law Survey, 2007, http://rechten.uvt.nl/koops/cryptolaw/
+[[Category:FIXME|Can you check the links for 5 and 6? They go to the same page.]]
 [[Category:OWASP Code Review Project]]

← Older revision		Revision as of 01:01, 11 February 2009
Line 61:		Line 61:


−	'''Bad Practice: Use of Insecure Cryptographic Algorithms>>'''	+	'''Bad Practice: Use of Insecure Cryptographic Algorithms'''

	The following algorithms are cryptographically insecure: DES and SHA-0. Below outlines a cryptographic implementation of DES (available per [[Using the Java Cryptographic Extensions]]): <br>		The following algorithms are cryptographically insecure: DES and SHA-0. Below outlines a cryptographic implementation of DES (available per [[Using the Java Cryptographic Extensions]]): <br>

@@ Line 52: / Line 52: @@
 # Check that RNGCryptoServiceProvider is used for PRNG
 # Verify key length is at least 128 bits
 '''Java'''

← Older revision		Revision as of 00:59, 11 February 2009
Line 16:		Line 16:

	As a general recommendation, there is strong reasoning behind not creating custom cryptographic libraries and algorithms. There is a huge distinction between groups, organizations, and individuals developing cryptographic algorithms and those that implement cryptography either in software or in hardware.		As a general recommendation, there is strong reasoning behind not creating custom cryptographic libraries and algorithms. There is a huge distinction between groups, organizations, and individuals developing cryptographic algorithms and those that implement cryptography either in software or in hardware.
−

	=== .NET and C/C++ (Win32) ===		=== .NET and C/C++ (Win32) ===

← Older revision		Revision as of 01:08, 13 January 2009
Line 413:		Line 413:

	[8] Bert-Jaap Koops, Crypto Law Survey, 2007, http://rechten.uvt.nl/koops/cryptolaw/		[8] Bert-Jaap Koops, Crypto Law Survey, 2007, http://rechten.uvt.nl/koops/cryptolaw/
		+
		+
		+
		+	[[Category:OWASP Code Review Project]]

@@ Line 393: / Line 393: @@
 Cryptographic code written or used should be of the highest level in terms of implementation. This should include simplicity, assertions, unit testing, as well as modularization.
-=== Side Channel and Protocol attacks ===
+=== Side Channel and Protocol Attacks ===
 As an algorithm is static in nature, its use over a communication medium constitutes a protocol. Thus issues relating to timeouts, how a message is received and over what channel should be considered.

← Older revision		Revision as of 01:05, 13 January 2009
Line 388:		Line 388:

	=== Specification Definitions ===		=== Specification Definitions ===
−
	Any code implementing cryptographic processes and algorithms should be audited against a set of specifications. This will have as an objective to capture the level of security the software is attempting to meet and thus offer a measure point with regards to the cryptography used.		Any code implementing cryptographic processes and algorithms should be audited against a set of specifications. This will have as an objective to capture the level of security the software is attempting to meet and thus offer a measure point with regards to the cryptography used.

@@ Line 382: / Line 382: @@
 == Laws and Regulations on Cryptography ==
+There are a number of countries in which encryption is outlawed. As a result, the development or use of applications that deploy cryptographic processes could have an impact depending on location. The following crypto law survey attempts to give an overview on the current state of affairs regarding cryptography on a per-country basis [8].
 == Design and Implementation ==