Cryptography is something that technical folks either get excited over or completely tune out. There does not seem to be much of a middle ground. That said, cryptography is such an essential component of modern life that without it, the Internet and many, many companies would crumble.
To make matters more complicated, cryptography is an area that is always changing. Today's modern crypto primitives might be broken before you drink your coffee tomorrow morning. Look at how quickly POODLE changed the world. Virtually overnight, SSLv3 needed to be disabled across the globe. Obviously, developers, sysadmins, and other engineers need a basic understanding of cryptographic principles in order to securely develop and run a service in today's world.
Bruno Oliveira of Red Hat takes us through what developers really need to know for day-to-day development activities. Bruno works on the KeyCloak team and is very interested in cryptography.
Security is a multi-facet problem, cryptography is only one aspect of security. Crypto dates back to the Egyptians and is obviously still in use today. With the dramatic increase in computational power and the decrease in price, strong cryptographic algorithms are a must, regardless of whether people care about it.
Security is the Jar Jar Binks of software development.
When security is working correctly, nobody notices. When it fails, everyone is aware of it. It is really hard to get it right and frankly, documentation tends to suck and is quickly outdated. Even the crypto professionals mess up and build insecure systems. In short, crypto is really hard... it is a problem and a solution.
NEVER WRITE YOUR OWN CRYPTO
The most common way to implement crypto today is to include the popular cryptographic libraries. The more widely used, the better. As always, the number one rule of software development security is do not try to implement your own crypto system.
Some common techniques and recommendations for use in software development
- Avoid MD5. Collision attacks are very possible, MD5 should never be used for integrity checking. Use SHA-2 family message digest algorithms.
- Check authenticity in addition to message integrity, use HMAC or similar mechanism.
- Encrypt your data to protect you from man-in-the-middle (MITM) and other attacks, protecting your privacy.
- AES is most common these days, often combined with CBC or GCM to stream the data across the wire. Use GCM over CBC for additional integrity checking.
- Never reuse or hard code the initialization vector (IV). This should always be a random value per session.
- Never use ECB (never ever never ever).
- AES is most common these days, often combined with CBC or GCM to stream the data across the wire. Use GCM over CBC for additional integrity checking.
- Make use of KDF functions for password validation.
- Use public key encryption when sharing data with other parties.
- Key Exchange algorithms allow two parties to securely exchange a symmetric key without transmitting it over the network.
- RSA
- Diffe-Hellman
- ECDHE
- Key Exchange algorithms allow two parties to securely exchange a symmetric key without transmitting it over the network.
With these simple guidelines, you can begin to include basic cryptographic principles in your code and help to protect your customers.
About the Author
Brian J. Atkisson is a Senior Principal Systems Engineer and the technical lead on the Red Hat IT Identity and Access Management team. He has 18 years of experience as a Systems Administrator and Systems Engineer, focusing on identity management, virtualization, systems integration, and automation solutions. He is a Red Hat Certified Architect and Engineer, in addition to his academic background in Biochemistry, Microbiology and Philosophy.
