WebFund 2016W Lecture 18

Video

The video for the lecture given on March 17, 2016 is now available.

Notes

In Class

(This is lecture 18, not 17!)

Lecture 18
----------

Symmetric cryptography
 - everyone uses the same key
 - think secret decoder rings
 - or, file encrypted with AES
 - secret has to be shared between sender and receiver
 

Public-key cryptography
 - but what if we don't have a shared secret?
   - your password isn't good enough, and
   - websites don't remember your password
   - and how would you send them your password in
     the first place
 - instead, we split the key into two parts
   - a public key
   - a private key
 - whatever one does, the other can undo

 - if you encrypt with a public key and decrypt with a
   private key
     - private one-way communication
     - e.g., you download Anil's public key and send
       Anil a secret message
 - if you encrypt with a private key and decrypt with 
   the public key
     - that's a digital signature

First rule of cryptography
 - friends don't let friends implement their own crypto
 - algorithms OR code!

Why?  You'll miss protections against attacks.
Example: timing attacks
 - can extract secrets by watching execution time
 - exploits the fact that some numbers take longer to
   multiply & other operations

Everyone else messes up too
 - so be prepared to update/replace all crypto-related
   code

Student Notes

Additional Notes on OpenStack Instances

• When selecting a floating IP address, the subnet must correspond to the network that you chose for your instance i.e. If you pick comp2406-net-31 you should use a 134.117.31 address and if you pick comp2406-net-26, use a 134.117.26 address. Mismatching will result in an error
• sudo setcap ‘cap_net_bind_service=rep’ /usr/bin/node.js is used to allow the user to bind to a privileged port

HTTPS

• HTTP is HyperText Transfer Protocol
• HTTPS is a secure version of HTTP which uses SSL/TLS
  • SSL - Secure Sockets Layer
  • TLS - Transport Layer Security
  • The current version of SSL is TLS
  • They are security protocols (cryptographic protocols) that encrypt communications to provide a secure connection over a network
• Normally in a URL, we don't see HTTP because it is the default so it is omitted
• With HTTPS, we will see the protocol written in the URL
• We also see a lock icon with HTTPS
  • It means that the data you are sending is secure and the website you’re accessing has been digitally certified
  • When you click on a lock icon, you can view information about the certificate that the server has
• If you want to enable SSL/TLS support in a Node application, you can change HTTP to HTTPS (change var http = require(‘http’); to var http = require(‘https’); in bin/www)
  • For the code to work, we have to specify some options (key and certificate) for the HTTPS server
• You can get it working by modifying the code:

In bin/www:

//use the app objects and put all the configurations into app, If require http is defined.
if (app.locals.sslOptions){
   var http = require(‘https’);
}
else{
   var http-require(‘http’);
}

//modify the ‘HTTP server’ part of your code with sslOptions.
//create an object in the app file.
if (app.locals.sslOptions){
   var server = http.createServer(app.locals.sslOptions, app);
}
else{
   var server = http.createServer(app);
}

In app.js, we specify the HTTPS options by loading the key and certificate files:

var fs = require('fs');

//put this after app is defined but before it is exported
app.locals.sslOptions = {
   key: fs.readFileSync(‘keys/comp2406-test-key.pem’),
   cert: fs.readFileSync(‘keys/comp2406-test-cert.pem’)
}

Certificates

• Certificates are a form of digital authentication for a web server
• They contain information about the server and the authority that has signed the certificate
• Companies such as GlobalSign and Verisign are certificate authorities which are relied upon to sign trustworthy certificates
• If you do not want to pay a trusted certificate authority to sign your server's certificate, you can sign it yourself
  • This gives you a usable certificate but it will produce a warning when a browser communicates with your server since it will receive a certificate signed by an untrusted source
  • In order to get our web application to work properly with SSL/TLS, we have to create a key and use it to sign a certificate
  • An alternative to get a trusted certificate is to get a free temporary certificate (from Let's Encrypt) and update it by using a script to run it in order to obtain new ones upon expiry

Symmetric Cryptography

• With symmetric cryptography, everyone uses the same key i.e. if you want to send a secret message to another person, you have to have the same secret decoder ring or files encrypted with AES
  • AES is a symmetric block cipher in which the same key is used to encrypt and decrypt a document. It is a block cipher because it encrypts data in blocks as opposed to the whole thing
• The key to symmetric cryptography is that the secret has to be shared between the sender and receiver to keep it a secret i.e. instead of making the whole document secret, just make a key to keep it secure
  • The difficulty is in initially sharing this secret in a secure fashion

Public-key Cryptography

• But what if we don’t have a shared secret?
• Passwords aren’t good enough
• Websites don’t remember your password
  • How would you send them your password in the first place (in a secure fashion)?
• Instead, we split the key into two parts: public key and private key
• In public key cryptography, you have two keys, a matched pair of public and private keys are opposite (inverters) because what you do with one can be undone with the other
  • If you encrypt with a public key and decrypt with a private key, it’s a private one way communication
    • For example, you can send the professor a secret message after downloading his public key and using it for encryption
  • If you encrypt with a private key and decrypt with the public key, that’s a digital signature
• This is what is used for HTTPS

Creating Our Key and Certificate

• We can use OpenSSL to create a key and to use that key to sign a certificate
• Randomness is an important factor in the creation of our key
  • We want this done in a non-deterministic fashion so that nobody can guess what our key is
  • OpenSSL uses Linux drivers which are designed to gather random data from events such as:
    • User actions on the keyboard and mouse
    • CPU temperatures
    • Network activity

First Rule of Cryptography

• Friends don’t let friends implement their own cryptography, algorithms or code because it’s hard to do it and be sure you’re secure
• Why?
  • You’ll miss protections against attacks. E.g. Timing attacks.
    • In a timing attack, the attacker can extract secrets by watching execution time
    • This exploits the fact that some numbers take longer to multiply than others
• Even professionally developped crypto systems will have bugs, so be prepared to update/replace all crypto-related code

Code

analyzeLogs-ssl-template.zip