defuse

Finger in the Middle Contest
=================================

Players:

    Defender - Tries to send a fingerprint over an insecure channel and wins iff
               they (1) detect every attack, or (2) successfully transfer the
               fingerprint.

    Attacker - Tries to modify the fingerprint sent over the channel.

defuse

<?php

/*
 * This code is copied from 
 * http://www.warpconduit.net/2013/04/14/highly-secure-data-encryption-decryption-made-easy-with-php-mcrypt-rijndael-256-and-cbc/
 * to demonstrate an attack against it. Specifically, we simulate a timing leak
 * in the MAC comparison which, in a Mac-then-Encrypt (MtA) design, we show
 * breaks confidentiality.
 *
 * Slight modifications such as making it not serialize/unserialize and removing

defuse

<?php

/*
 * Padding oracle attack against https://github.com/keboola/php-encryption
 * By: Taylor Hornby.
 * Date: March 14, 2014.
 */

/* Download the two files and place in the same folder. */
require_once('EncryptorInterface.php');

defuse

<?php
// Broken crypto code from https://github.com/slimphp/Slim/blob/develop/Slim/Crypt.php
function validateKeyLength($key, $module)
    {
        $keySize = strlen($key);
        $keySizeMin = 1;
        $keySizeMax = mcrypt_enc_get_key_size($module);
        $validKeySizes = mcrypt_enc_get_supported_key_sizes($module);
        if ($validKeySizes) {
            if (!in_array($keySize, $validKeySizes)) {

defuse

<?php

/*
 * Backdooring the constant-time comparison algorithm.
 * Taylor Hornby. Feburary 28, 2015.
 *
 * THIS CODE IS INTENTIONALLY BACKDOORED. DO NOT USE IT!
 */

/* ========================================================================= */

defuse

  George Carlin                                            INVOICE
  carlin@example.org

  To:                                                   Invoice #6
      Stephen Hawking                         Date:   May 13, 2014
      hawking@example.org

  +-----------------------------------------------------------------+
  | Quantity |         Description         | Unit Price |   Total   |

defuse

// WARNING! This code is untested and experimental. DO NOT USE IT.

// NOTE: If I knew of a way to do the "shift and OR" thing reliably with unsigned ints, the code could be simplified a lot.

// Will always be compiled with -std=c99

// Returns UINT32_MAX if a == b, 0 otherwise.
uint32_t invariant_time_integer_compare(uint32_t a, uint32_t b)
{
    /* z will be zero if and only if a == b. */

defuse

# This is well-known behavior, it's just interesting.
$ mkdir a
$ echo "hello!" > a/file.txt
$ cat a/file.txt
hello!
$ chmod 000 a/file.txt 
# Now I don't expect to be able to change a/file.txt...
$ echo "GOODBYE" > a/file.txt
bash: a/file.txt: Permission denied
# Okay, good, I can't modify the file directly.

defuse

WARNING: This takes about 10-20 hours to run, depending on your system.
1%...
2%...
3%...
4%...
5%...
6%...
7%...
8%...
9%...

defuse

Goal: 
    You're given a sequence of random alphanumeric characters (0-9a-zA-Z, 62
    possible characters), for example from a password generator. Convert it into
    a sequence of random *bits*.

    The output should have the property:

        The alphanumeric character RNG can be distinguished from random if and
        only if the alphanumeric character RNG, with the conversion algorithm
        attached, can be distinguished from random.