liveBookmanning.com

What you will learn in Hacking Cryptography

Write, break, and fix real-world implementations

by Kamran Khan and Bill Cox

Read it on liveBook Get the book at manning.com

Chapter by chapter

Concepts explained in this book

• pseudo-random number generatorA pseudorandom number generator uses a deterministic algorithm and an initial seed to produce a sequence of values that appears random.
• stateThe internal state of an LFSR is the mutable sequence of register bits that determines its subsequent output and evolution.
• keystreamA keystream is a sequence of cryptographic bits or symbols generated for combination with plaintext or ciphertext in a stream cipher.
• cryptographically secure random number generatorA cryptographically secure pseudorandom number generator is a pseudorandom number generator whose output and state-recovery properties satisfy security requirements against computationally bounded adversaries.
• private keyA private key is the secret member of an asymmetric key pair used for operations such as decryption or signature generation.
• message authentication codeAn authentication tag is a value generated from a message and authentication key that enables verification of message integrity and key-based authenticity.
• rainbow tableA rainbow table is a precomputed structure of chained password-hash values that trades storage space for lookup time when recovering likely plaintext passwords.
• RC4RC4 is a stream cipher that generates a keystream from a variable-length secret key using a permutation-based state algorithm.
• paddingA defined method for adding and later removing padding from cryptographic data, potentially incorporating randomness.
• cryptographic saltA salt is a publicly known value combined with a password before hashing to make precomputed password-hash tables less reusable.
• dictionary attackA dictionary attack is a password-cracking technique that hashes many possible passwords and compares the resulting digests with target digests.
• hash chainA hash chain is a sequence formed by alternately applying a hash function and a deterministic reduction function to messages and digests.
• reduction functionA reduction function deterministically maps a hash digest to a candidate plaintext or password satisfying specified constraints without reversing the hash function.
• cipher block chaining modeCipher-block chaining mode XORs each plaintext block with the preceding ciphertext block before encryption, using an initialization vector for the first block.
• entropyEntropy is a measure of uncertainty in a probability distribution, calculated as the negative sum of each outcome probability multiplied by its logarithmic probability.
• saltingSalting is the practice of combining a password with an additional value before hashing it so that precomputed password-hash tables are specific to that value.
• true random number generatorA hardware random number generator, or true random number generator, samples nondeterministic physical phenomena to produce unpredictable random values.
• public keyThe public key is the openly distributable member of an asymmetric key pair used for operations such as encryption or signature verification.
• length-extension attackA length-extension attack computes a valid hash for an extended message from a hash of the original message and its length when the hash construction exposes a reusable internal state.
• secret-prefix hashingA secret-prefix MAC is a message authentication construction that prepends the secret key to the message before hashing.
• linear feedback shift registerA linear feedback shift register is a stateful shift-register mechanism whose input bit is computed from a linear function of selected state bits.
• hash functionA function that maps input data to a fixed-size digest, typically designed so that recovering or finding inputs with specified relationships is computationally infeasible.
• initialization vectorAn initialization vector is a public or nonsecret value combined with secret keying material to vary cryptographic inputs across messages.
• cryptographyThe practice and study of securing information and communications through mathematical techniques such as encryption, authentication, and digital signatures.
• public-private key pairA key pair consists of mathematically related public and private keys used together in asymmetric cryptography.
• known-plaintext attackA known-plaintext attack is a cryptanalytic method that uses plaintext and corresponding ciphertext to infer information about the encryption process or key.
• randomness extractorA randomness extractor is an algorithm that converts a weakly random source into output with stronger and more uniform randomness properties.
• random seedA seed is an initial value supplied to a deterministic pseudorandom number generator to determine its starting state and resulting output sequence.
• Merkle–Damgård constructionA hash function built by repeatedly applying a compression function to message blocks in the Merkle–Damgård construction.
• multiplicative inverseA multiplicative inverse of an element is another element whose product with it equals the multiplicative identity in the relevant group.
• batch GCD algorithmA technique for efficiently computing the greatest common divisor of each number in a collection with the product of the other numbers.
• chilled random number generatorA chilled random number generator is a faulty or entropy-poor generator that produces a severely restricted set of random values.
• common-factors attackA cryptanalytic attack that factors RSA moduli by finding a prime factor shared by two public keys.
• prime number theoremThe prime number theorem describes the asymptotic distribution of prime numbers up to a given bound.
• biasA systematic deviation in the probabilities of RC4 key-scheduling or keystream outcomes from the uniform behavior expected under the ideal model.
• key-scheduling algorithmA key scheduling algorithm initializes and scrambles a cipher's internal state from its key before keystream generation.
• pseudorandom generation algorithmRC4's pseudorandom generation algorithm updates the cipher state and produces successive keystream bytes.
• s-boxAn S-box is a substitution table or permutation structure used by a cipher to transform values and maintain internal state.
• prime numberA prime number is an integer greater than one that has no positive divisors other than one and itself.
• textbook rsaThe schoolbook RSA signature scheme is an unpadded textbook RSA signature method that applies direct modular exponentiation to a message representative.
• prefix cube rootA prefix cube root is a candidate RSA signature value whose cube preserves a required prefix of an encoded message despite unconstrained or truncated trailing bits.
• constant-time programmingA constant-time implementation is software or hardware whose execution behavior does not depend on secret-dependent values or control flow.
• WEPWEP is an obsolete wireless-network security standard that used RC4-based encryption and was vulnerable to cryptographic attacks.
• public exponentThe public exponent is the RSA exponent included in the public key and used for modular exponentiation during encryption or signature verification.
• linear congruential generatorA deterministic pseudorandom number generator that repeatedly applies a linear congruence to produce values in a sequence.
• padding oracleA padding oracle is a decryption process that reveals whether supplied ciphertext has valid padding without directly revealing the plaintext.
• modular entropy multiplicationA technique for constructing hardware random number generators by combining entropy sources with modular arithmetic and a physical model for monitoring output health.
• avalanche effectA phenomenon in which charge carriers gain enough energy in a semiconductor to create additional carriers and produce amplified current and noise.
• entropy sourceA physical or computational process that supplies uncertain values from which random output can be derived.
• fault injectionAn attack that deliberately perturbs a system's physical or electrical conditions to induce faults or influence its output.
• physical modelA physical model relates measurable system behavior to the physical properties of the phenomenon producing it.
• ring oscillatorAn electronic oscillator formed by connecting an odd number of inverting logic gates in a ring.
• thermal noiseRandom electrical fluctuations caused by thermal motion of charge carriers in a physical component.
• Zener diodeA diode designed to operate in reverse breakdown to regulate voltage or exhibit controlled electrical behavior.
• suffix cube rootA suffix cube root is a candidate RSA signature value whose cube exactly matches a required suffix of an encoded message.
• FMS attackThe FMS attack is a statistical attack that exploits RC4 key-scheduling biases in WEP weak-IV traffic to recover bytes of the preshared key.
• pre-shared keySecret keying material configured in advance and shared by the communicating parties.
• weak initialization vectorA weak initialization vector is a WEP IV whose byte pattern creates exploitable statistical leakage about the secret key during RC4 key scheduling.
• SHA-256SHA-256 is a member of the Secure Hash Algorithm 2 family that produces 256-bit cryptographic hash digests.
• HMACHMAC is a keyed-hash message authentication construction that produces an integrity and authentication tag from a key and message.
• Bleichenbacher's e=3 forgery attackBleichenbacher's e=3 forgery attack is an RSA signature-forgery attack that exploits lax validation of PKCS #1 v1.5 signature padding when the public exponent is 3.
• Dual ECDUAL_EC_DRBG is a deterministic random-bit generator based on elliptic-curve point multiplication whose output can permit state recovery when its generator points have a hidden mathematical relation.
• timing attackA timing attack is a side-channel attack that infers secret information from differences in the time required to perform computations.
• stream cipherA stream cipher is an encryption technique that combines plaintext with a generated keystream, typically one bit or symbol at a time.
• Montgomery ladderThe Montgomery ladder is a regular sequence of arithmetic operations for scalar multiplication that reduces dependence on secret scalar bits.
• Mersenne TwisterA deterministic pseudorandom number generator family based on recurrences associated with Mersenne primes and designed to provide a very long period.
• digital signatureA cryptographic value associated with data that enables verification of its integrity and origin by parties possessing the required verification information.
• time-space tradeoffA design trade-off in which additional storage or memory reduces computation time, or reduced storage increases computation time.
• state compromise extension attackA state-extension attack uses knowledge of a pseudorandom generator's state or exploitable state-transition information to predict or extend its future output sequence.
• ECDSAECDSA is an elliptic-curve digital signature algorithm that generates and verifies signatures using elliptic-curve group operations.
• convergentA convergent is a finite rational approximation obtained by truncating a continued fraction expansion.
• simple continued fractionA simple continued fraction represents a number as an integer part followed by reciprocals of integers, with all numerators equal to one.
• Wiener’s attackWiener's theorem states that an RSA private exponent can be efficiently recovered from the public key when it satisfies a specified smallness bound.
• BEASTBEAST is a browser-based attack against CBC-mode encrypted connections that exploits predictable initialization vectors to recover secret request data.
• factorizationInteger factorization is the problem of decomposing an integer into a product of prime factors.
• side-channel attackSide-channel analysis extracts information about secret computations from observable implementation behavior such as timing, power, or electromagnetic emissions.
• trapdoor functionA trapdoor function is easy to compute but computationally difficult to invert without secret auxiliary information called a trapdoor.
• modulo arithmeticArithmetic in which values are identified according to their remainders modulo a specified integer.
• modulusThe positive integer that defines the modulus and bounds the residue classes in modular arithmetic.
• periodThe period is the number of generated steps in a repeating sequence before its values begin to recur.
• vulnerabilityA vulnerability is a weakness in a system or implementation that can be exploited to violate security properties.
• cryptographic implementationA software or hardware realization of cryptographic theory that performs cryptographic operations in a system.
• bisection methodA root-finding technique that repeatedly halves an interval according to whether a candidate is below or above the target.
• cube rootA cube root of a number is a value whose third power equals that number.
• uniform distributionA uniform distribution assigns equal probability density or probability mass across the possible outcomes of a random variable.
• symmetric key encryptionCryptography in which communicating parties use the same secret key or shared secret for corresponding cryptographic operations.
• authenticityAuthenticity is the security property of establishing that a message is genuine and originated as claimed.
• public key cryptographyPublic-key cryptography is cryptography based on paired public and private keys, allowing operations such as encryption or signature verification with a public key while restricting the corresponding inverse operation to the private-key holder.
• padding oracle attackA padding oracle attack is a chosen-ciphertext technique that recovers plaintext by observing whether a decryption service accepts manipulated padding.
• elliptic curveAn elliptic curve is a set of points satisfying a specified cubic equation and equipped with a defined point-addition operation.
• P-256P-256 is a standardized elliptic curve over a 256-bit prime finite field used for public-key cryptography.
• PKCS#7 paddingPKCS#7 padding is a byte-padding scheme in which each padding byte contains the number of padding bytes added to complete a block.
• RSARSA is a public-key cryptosystem whose security relies on the difficulty of factoring a product of large primes.
• signature verificationSignature verification is the cryptographic process of checking whether a signature validly corresponds to data under the appropriate key.
• discrete logarithmThe discrete logarithm problem is the problem of finding an exponent n such that y equals g^n modulo a specified prime when g and y are known.
• one-time padA one-time pad is an encryption technique that combines plaintext with a truly random key of equal length that is never reused.
• collision-resistant hash functionThe property that it is computationally infeasible to find any two distinct inputs that produce the same hash output.
• Euler's totient functionEuler's totient function maps a positive integer to the number of positive integers smaller than it that are relatively prime to it.
• signature forgery attackA signature forgery attack attempts to create a valid signature for data without authorization from the holder of the signing private key.
• nonceA cryptographic nonce is a value intended to be used once to prevent identical cryptographic inputs from producing repeated protected outputs.
• confidentialityConfidentiality is the property that data is protected from being viewed by unauthorized parties.
• hash valueA hash digest is the fixed-size output produced by applying a hash function to input data.
• randomnessRandomness is the absence of a predictable pattern in an outcome or sequence according to a specified model of probability.
• elliptic-curve pointAn elliptic-curve point is a coordinate pair satisfying the equation of an elliptic curve and participating in its group operation.
• extended Euclidean algorithmThe extended Euclidean algorithm computes greatest common divisors and coefficients expressing them as linear combinations of integers.
• modular exponentiationModular exponentiation is the computation of an integer power followed by reduction modulo a specified integer.
• cryptographic keyA value that controls cryptographic operations and is shared with or retained by authorized participants according to the security scheme.
• fuzzingFuzzing tests software by automatically generating or mutating inputs, often including malformed inputs, to expose failures and vulnerabilities.
• reused-key attackA reused-key attack exploits the use of the same cryptographic key for multiple messages to derive relationships between their plaintexts.
• birthday paradoxA probability phenomenon in which collisions among samples from a finite set become likely after substantially fewer samples than the set size suggests.
• pre-image resistanceThe security property that makes it computationally infeasible to find an input corresponding to a specified hash output.
• collision attackA collision attack is a cryptanalytic method for finding two distinct inputs that produce the same hash digest.
• memory safetyMemory safety is the property that program operations access memory only within valid bounds and lifetimes without invalid aliasing or use-after-release.
• branch predictionBranch prediction is a processor mechanism that forecasts the outcome or target of a control-flow branch to keep instruction execution supplied.
• branching on secret valuesBranching on secret values is control flow whose selected path depends on private or sensitive data.
• branchless alternativeBranchless programming implements conditional behavior without control-flow paths that diverge according to input conditions.
• conditional moveA conditional move is a processor instruction that transfers a value when a Boolean predicate holds without branching to a different instruction path.
• speculative executionSpeculative execution is processor execution of predicted instruction paths before the corresponding control-flow decisions are resolved.
• variable-length loopA variable-length loop is an iterative control-flow construct whose iteration count depends on runtime data.
• certificateA digital certificate is a signed data structure that binds a public key to an identified subject and related metadata.
• second pre-image resistanceThe property that, given an input and its hash output, it is computationally infeasible to find a different input with the same hash output.
• birthday attackA birthday attack is a collision-finding method that generates approximately the square root of the hash output space to obtain a substantial probability of matching digests for distinct inputs.
• constant-time comparisonA constant-time comparison compares values without execution time depending on the position or content of mismatches, aside from permitted length handling.
• existential forgery attackAn existential forgery attack produces at least one valid message-signature pair without the attacker needing to choose the message in advance or possess the signing secret.
• cryptographic algorithmA cryptographic algorithm is an algorithm that transforms data to provide security properties such as confidentiality, integrity, authentication, or nonrepudiation.
• security objectiveA desired protection property for information or digital entities, such as confidentiality, integrity, or authenticity.
• SHA-3SHA-3 is a standardized family of cryptographic hash algorithms based on a sponge construction.
• Berlekamp–Massey algorithmThe Berlekamp–Massey algorithm finds a shortest linear feedback shift register that generates a given binary sequence.
• brute-force searchA brute-force search systematically tests possible candidates until one satisfies the required conditions.
• coefficient matrixA coefficient matrix is a matrix whose entries specify the coefficients of a system of linear combinations.
• linear algebraThe branch of mathematics concerning vectors, matrices, and linear equations and transformations.
• matrix inversionMatrix inversion is the operation of finding a matrix that multiplies with a given invertible matrix to produce the identity matrix.
• state matrixA state matrix is a matrix representing the internal contents or successive states of a linear feedback shift register.
• weighted sumA linear combination is an expression formed by multiplying values by coefficients and adding the resulting terms.
• rng cloning attackAn RNG cloning attack reconstructs a stateful random number generator from observed outputs so that its future outputs can be predicted.
• temperingTempering is an output transformation that applies bitwise operations to a generator state word before returning it.
• untemperingUntempering is the inverse procedure for recovering a generator state word from its tempered output.
• forward secrecyForward secrecy is the property that compromise of long-term or current secret keying material does not reveal previously established session secrets.
• Diffie–Hellman key exchangeDiffie–Hellman key exchange is a key-agreement protocol in which participants derive a shared secret from exchanged public values and retained private exponents.
• ElGamal encryptionElGamal encryption is a public-key encryption scheme based on the difficulty of the discrete logarithm problem and randomized exponentiation.
• elliptic-curve diffie-hellmanElliptic Curve Diffie–Hellman is a key-agreement protocol that performs Diffie–Hellman operations with elliptic-curve points instead of modular exponentiation.
• generatorA generator of a finite multiplicative group is an element whose successive powers produce every element of the group.
• multiplicative groupA multiplicative group modulo a prime consists of the nonzero residue classes under multiplication modulo that prime.
• AESA symmetric block-cipher standard adopted for protecting data in applications ranging from financial transactions to classified information.
• statistical health testA statistical health test checks whether an entropy source or random-number generator continues to exhibit its expected behavior and entropy properties.
• power analysisPower analysis is a side-channel technique that infers computational behavior or secrets from a device's power consumption.
• square and multiplyThe square-and-multiply method is an efficient exponentiation algorithm that repeatedly squares and selectively multiplies according to the exponent bits.
• probability distributionA probability distribution assigns probabilities to the possible outcomes of a random process.
• composite numberA composite number is an integer greater than one that has a positive divisor other than one and itself.
• Fermat primality testThe Fermat primality test checks randomly selected integer bases against Fermat’s congruence to identify probable primes and composites.
• Fermat’s Little TheoremFermat's little theorem states that for a prime p, every integer a not divisible by p satisfies a^(p−1) ≡ 1 modulo p.
• primality testA probabilistic primality test uses one or more selected bases or trials to determine whether a number is probably prime while allowing a small probability of error.
• GoGo is a statically typed, compiled programming language designed for simplicity, portability, and efficient software development.
• OpenSSLOpenSSL is an open-source software toolkit that provides implementations of cryptographic primitives, protocols, and related security functions.
• TLSTLS is a cryptographic protocol for securing communications over computer networks.
• rsaes-pkcs1-v1_5PKCS #1 v1.5 is an RSA encoding standard that defines formatting and randomized padding for encryption and related operations.
• electronic codebook modeElectronic codebook is a block cipher mode that encrypts each block independently with the same key.
• buffer overflowA buffer overwrite occurs when software writes beyond a buffer's valid bounds and changes adjacent memory.
• buffer overreadA buffer overread occurs when software reads beyond the valid contents or allocated bounds of a memory buffer.
• HeartbleedHeartbleed is a memory-disclosure vulnerability in implementations of the TLS heartbeat extension that can return unintended server memory.
• heartbeat extensionThe TLS heartbeat extension is a protocol extension that lets a peer request an arbitrary payload to be echoed for connection liveness checking.
• memory-safe languageA memory-safe language is a programming language that prevents or detects invalid memory accesses through its language rules, runtime, or implementation.
• numerical overflowInteger overflow is the condition in which an arithmetic result exceeds the range representable by an integer type.
• cryptographic theoryThe mathematical foundations and security analyses underlying cryptographic algorithms and protocols.
• backward secrecyThe property of a pseudorandom generator that prevents an observer of current output from predicting values generated later.
• diffusionDiffusion is a cryptographic design property that spreads the influence of each plaintext element across many ciphertext elements.
• md5MD5 is a cryptographic hash algorithm that produces a 128-bit digest and is considered cryptographically broken because practical collision attacks exist.
• exploitA method or piece of code that takes advantage of a vulnerability to produce an unintended effect.
• random numberA random number is a value selected according to a stochastic process intended to prevent predictable patterns or preferences.
• secret-suffix MACA secret-suffix MAC is a message authentication construction that appends the secret key to the message before hashing.
• compression functionA function that combines a fixed-size message block with a fixed-size state to produce a new fixed-size state in an iterative hash construction.
• nonrepudiationNonrepudiation is the security property that provides evidence linking an action or signed data to its purported originator so that the originator cannot plausibly deny it.
• block cipherA block cipher is a keyed cryptographic algorithm that transforms fixed-size blocks of data.
• entropy poolAn entropy pool is an operating-system data structure that accumulates environmental noise for use in generating random values.
• selective forgery attackA selective forgery attack enables an attacker to forge valid signatures for messages satisfying specified constraints.
• universal forgery attackA universal forgery attack enables an attacker to forge valid signatures for arbitrary attacker-chosen messages.
• cipher feedback modeCipher feedback mode generates a keystream by feeding ciphertext back into a block cipher and is self-synchronizing.
• counter mode encryptionCounter mode encrypts successive counter values with a block cipher to generate a keystream that is combined with plaintext.
• output feedback modeOutput feedback mode repeatedly encrypts an internal feedback value, typically an initialization vector, to generate a keystream independent of ciphertext.
• root of trustA root of trust is an initially trusted hardware- or software-protected component from which subsequent trust decisions are established.
• ConstantTimeCompareConstantTimeCompare is a Go crypto/subtle function that compares two byte slices in time independent of their contents.
• crypto/subtlecrypto/subtle is the Go standard-library package providing cryptographic operations designed to reduce timing side channels.
• memcmpmemcmp is a C standard-library function that compares two memory regions and reports the first differing byte or equality.
• scalar multiplicationScalar multiplication is an operation that multiplies a mathematical point or vector by a scalar according to the structure's defining rules.

These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.