Presented at
DerbyCon 6.0 Recharge (2016),
Sept. 23, 2016, noon
(50 minutes).
Many times the answer to any question about cryptography is: “never roll your own crypto”. While the logic behind this is understandable it has become a bit of a lost art. Despite the fact that for the most part standard crypto used in normal situations works; when trying to hide the existence of encrypted data alltogether it is far from an optimal solution.
Most modern crypto is designed with the fact that the evesdropper knows that an encrypted message exists. However these days with ssl proxys, reversing antivirus, and “anti-crypto” law proposals the assumption that having an evesdropper knowing the existence of said crypto is no longer an easy concession. Despite the fact of many “next-gen” antiviruses failing to detect many obfuscation methods using algorithms such as AES for encrypting a payload is the WRONG way. The reason they are not detected is such an antivirus is just not looking for traces of such an algorithm. From a forensics standpoint, if you’re using AES the private key is on the victim’s machine for example. In addition, the permutations or S-Boxes are well known permutations and easy to spot in your algorithm.
This talk will be on how to design algorithms to make the existence of the cryptography unknown. We will keep some of it high level but also show how to properly implement your own cryptography and/or steganography in such a way that the evesdropper doesn’t know it exists. We will talk about side channels and how to keep out of band and/or homemade crypto “cryptographically strong” but also how to generate it on the fly so that no only can you encrypt data in side channels, you can generate a new algorithm on the fly. We want to make it so the randomness of the algorithm itself is “cryptographically strong” Even though many next-gen antivirus fails at such detection as it inproves we need to study obfuscation as much as the mathematics and/or science of standard cryptography.
Presenters:
Similar Presentations: