At Data Applied, we use applied cryptography to solve different problems: verify license keys, encrypt data, authenticate users, sign code, safeguard passwords, etc. Our security is therefore dependent on proper usage of cryptographic primitives.
Previously, I had a chance to work on an S/MIME precursor (used to encrypt e-mails), security features of large products (Microsoft Exchange Server, Microsoft Dynamics CRM), and interact with NSA cryptographers. Working on security-related projects has given me a chance to observe some design mistakes related to encryption. Here are some you may find interesting.
1. Impersonation attack – Using encryption for authentication:
Let’s say you want to implement a ticket-based authentication mechanism. After being presented with a proof of someone’s identity (ex: a valid password, a social security number, an SMS message, etc.), your goal is to issue verifiable authentication tickets, each associated with a user account.
Often, the following solution is proposed: use a secret key to encrypt an account ID, and return this information as an authentication ticket. Subsequently, when an authentication ticket is received, decrypt it using the secret key. If decryption is successful, this means that the ticket is valid, and the decrypted account ID can be used. Unfortunately, this approach is 100% wrong. Read more…