Reviewing Cryptographic Code - Revision history

Rahimjina: Review

2008-08-26T21:29:51Z

Review

Jcmax: Classic ASP technology inclusion

2008-06-08T00:05:06Z

Classic ASP technology inclusion

Yiannis at 03:54, 26 July 2007

2007-07-26T03:54:45Z

Yiannis at 23:02, 12 July 2007

2007-07-12T23:02:19Z

Yiannis at 22:41, 12 July 2007

2007-07-12T22:41:35Z

Yiannis at 22:31, 12 July 2007

2007-07-12T22:31:52Z

Yiannis at 21:32, 12 July 2007

2007-07-12T21:32:17Z

Yiannis at 20:35, 12 July 2007

2007-07-12T20:35:59Z

Jenellelea at 20:41, 20 June 2007

2007-06-20T20:41:56Z

Jenellelea at 20:29, 20 June 2007

2007-06-20T20:29:53Z

@@ Line 19: / Line 19: @@
 == Use of Standard Cryptographic Libraries ==
-As a general recomendation, there is strong reasoning behind not creating custom cryptographic libraries and algorithms. There is a huge distinction between groups organisations and individuals developing cryptographic algorithms and those that implement cryptography either in software or in hardware.
+As a general recommendation, there is strong reasoning behind not creating custom cryptographic libraries and algorithms. There is a huge distinction between groups organisations and individuals developing cryptographic algorithms and those that implement cryptography either in software or in hardware.
@@ Line 56: / Line 56: @@
 '''Classic ASP'''<br />
-Do all of these checkings on the COM wrapper as ASP does not have direct access to cryptographic functions
+Do all of these checks on the COM wrapper as ASP does not have direct access to cryptographic functions
 <ol>
 <li>Check that the Data Protection API (DPAPI) or CryptoAPI is being used into COM object

@@ Line 27: / Line 27: @@
 For C/C++ code running on Win32 platforms, the CryptoAPI is recommended [2]. This has been an integral component for any Visual C++ developer's toolkit prior to the release of the latest replacement with Windows Vista. The CryptoAPI today offers an original benchmark for what will become legacy applications.
 === Java ===
@@ Line 47: / Line 50: @@
 <ol>
 <li>Check that the Data Protection API (DPAPI) is being used
 <li>Verify no proprietary algorithms are being used
 <li>Check that RNGCryptoServiceProvider is used for PRNG

← Older revision		Revision as of 03:54, 26 July 2007
Line 383:		Line 383:

	There are a number of countries in which encryption is outlawed. As a result, the development or use of applications that deploy cryptographic processes could have an impact depending on location. The following crypto law survey attempts to give an overview on the current state of affairs regarding cryptography on a per country basis [8]		There are a number of countries in which encryption is outlawed. As a result, the development or use of applications that deploy cryptographic processes could have an impact depending on location. The following crypto law survey attempts to give an overview on the current state of affairs regarding cryptography on a per country basis [8]
		+
		+	== Design and Implementation ==
		+
		+
		+	=== Specification Definitions ===
		+
		+	Any code implementing cryptographic processes and algorithms should be audited against a set of specifications. This will have as an objective to capture the level of security the software is attempting to meet and thus offer a measure point with regards to the cryptography used.
		+
		+	=== Level of Code Quality ===
		+
		+	Cryptographic code written or used should be of the highest level in terms of implementation. This should include simplicity, assertions, unit testing, as well as modularization.
		+
		+	=== Side Channel and Protocol attacks ===
		+
		+	As an algorithm is static in nature, its use over a communication medium constitutes a protocol. Thus issues relating to timeouts, how a message is received and over what channel should be considered.

	== References ==		== References ==

@@ Line 17: / Line 17: @@
-== Use of Cryptographic Libraries ==
+== Use of Standard Cryptographic Libraries ==
-As a general recomendation, there is strong reasoning behind not creating custom cryptographic libraries and algorithms.
+As a general recomendation, there is strong reasoning behind not creating custom cryptographic libraries and algorithms. There is a huge distinction between groups organisations and individuals developing cryptographic algorithms and those that implement cryptography either in software or in hardware.
@@ Line 34: / Line 34: @@
 == Vulnerable Patterns Examples for Cryptography ==
-A secure way to implement robust encryption mechanisms within source code is by implementing FIPS[] compliant algorithms with the use of the Microsoft Data Protection API (DPAPI)[4] or the Java Cryptography Extension (JCE)[5].  The following should be identified when establishing your cryptographic code strategy:<br>
+A secure way to implement robust encryption mechanisms within source code is by implementing FIPS[7] compliant algorithms with the use of the Microsoft Data Protection API (DPAPI)[4] or the Java Cryptography Extension (JCE)[5].  The following should be identified when establishing your cryptographic code strategy:<br>
 <ul>
@@ Line 379: / Line 379: @@
 }</pre>
 == References ==
@@ Line 395: / Line 399: @@
 [7] Federal Information Processing Standards, http://csrc.nist.gov/publications/fips/

@@ Line 34: / Line 34: @@
 == Vulnerable Patterns Examples for Cryptography ==
-A secure way to implement robust encryption mechanisms within source code is by implementing FIPS[http://csrc.nist.gov/publications/fips/] compliant algorithms with the use of the Microsoft Data Protection API (DPAPI)[4] or the Java Cryptography Extension (JCE)[5].  The following should be identified when establishing your cryptographic code strategy:<br>
+A secure way to implement robust encryption mechanisms within source code is by implementing FIPS[] compliant algorithms with the use of the Microsoft Data Protection API (DPAPI)[4] or the Java Cryptography Extension (JCE)[5].  The following should be identified when establishing your cryptographic code strategy:<br>
 <ul>
@@ Line 393: / Line 393: @@
 [6] Sun Developer Network, Cryptographic Service Providers and Clean Room Implementations, http://java.sun.com/products/jce/jce122_providers.html

@@ Line 22: / Line 22: @@
-=== .NET, C/C++ and VBScript ===
+=== .NET and C/C++ (Win32) ===
 For .NET code, class libraries and implementations within System.Security.Cryptography should be used [2]. This namespace within .NET aims to provide a number of wrappers that do not require proficient knowledge of cryptography in order to use it [3].
-For C/C++ code, the CryptoAPI is recommended
+For C/C++ code running on Win32 platforms, the CryptoAPI is recommended [2]. This has been an integral component for any Visual C++ developer's toolkit prior to the release of the latest replacement with Windows Vista. The CryptoAPI today offers an original benchmark for what will become legacy applications.
 == Vulnerable Patterns Examples for Cryptography ==
-A secure way to implement robust encryption mechanisms within source code is by implementing FIPS[http://csrc.nist.gov/publications/fips/] compliant algorithms with the use of the Microsoft Data Protection API (DPAPI)[http://msdn2.microsoft.com/en-us/library/ms995355.aspx] or the Java Cryptography Extension (JCE)[http://java.sun.com/products/jce/].  The following should be identified when establishing your cryptographic code strategy:<br>
+A secure way to implement robust encryption mechanisms within source code is by implementing FIPS[http://csrc.nist.gov/publications/fips/] compliant algorithms with the use of the Microsoft Data Protection API (DPAPI)[4] or the Java Cryptography Extension (JCE)[5].  The following should be identified when establishing your cryptographic code strategy:<br>
 <ul>
@@ Line 379: / Line 382: @@
 == References ==
-[1] Bruce Schneier. Applied Cryptography. John Wiley & Sons, 2nd edition, 1996.
+[1] Bruce Schneier, Applied Cryptography, John Wiley & Sons, 2nd edition, 1996.
 [2] Michael Howard, Steve Lipner, The Security Development Lifecycle, 2006, pp. 251 - 258
-[3] .NET Framework Developer Center. http://msdn2.microsoft.com/en-us/library/93bskf9z.aspx
+[3] .NET Framework Developer's Guide, Cryptographic Services, http://msdn2.microsoft.com/en-us/library/93bskf9z.aspx

@@ Line 15: / Line 15: @@
 [[Guide to Cryptography]]<br>
 [[Using the Java Cryptographic Extensions]]
@@ Line 368: / Line 380: @@
 [1] Bruce Schneier. Applied Cryptography. John Wiley & Sons, 2nd edition, 1996.

@@ Line 5: / Line 5: @@
 == Introduction ==
-Cryptography provides for security of data at rest (via encryption), enforcement of data integrity (via hashing/digesting), and non-repudiation of data (via signing). Secure coding of cryptography within source code must conform to the following: use of standard cryptographically secure algorithms with strong key sizes. Use of non-standard cryptographic algorithms, custom implementation of cryptography (standard & non-standard) algorithms, use of standard algorithms which are cryptographically insecure (e.g. DES), and the implementation of insecure keys can weaken the overall security posture of the web application.  Implementation of the methods aforementioned enables the use of known cryptanalysis tools & techniques to decrypt sensitive data.
+There are two types of cryptography in this world: cryptography that will stop your kid sister from reading your files, and cryptography that will stop major governments from reading your files [1]. Developers are at the forefront of deciding which category a particular application resides in.  Cryptography provides for security of data at rest (via encryption), enforcement of data integrity (via hashing/digesting), and non-repudiation of data (via signing). As a result, the coding in a secure manner of any of the above cryptographic processes within source code must conform in principle to the use of standard cryptographically secure algorithms with strong key sizes.
@@ Line 322: / Line 324: @@
 		 *  Step 5. Decrypt the Data
 		 *  		1. Initialize the Cipher for Decryption
-*  		2. Decrypt the cipher bytes using doFinal method
+		 *  		2. Decrypt the cipher bytes using doFinal method
 		 */
 		aesCipher.init(Cipher.DECRYPT_MODE,secretKey,aesCipher.getParameters());
@@ Line 362: / Line 364: @@
 }</pre>

@@ Line 1: / Line 1: @@
 == Introduction ==
@@ Line 176: / Line 180: @@
 Additionally, SHA-1 and MD5 should be avoided in new applications moving forward.
 '''Good Practice: Use Strong Entropy>>'''<br>