WEB-CRYPTO-01 - Cryptographic Failures

Learning Objectives

• Understand OWASP A02: Cryptographic Failures
• Identify common cryptographic vulnerabilities
• Learn secure encryption practices
• Practice vulnerability discovery using OS³ Studio
• Implement secure cryptographic solutions
• Explore career opportunities in cryptography

OWASP A02: Cryptographic Failures

Key Areas:

• Weak encryption algorithms
• Poor key management
• Insecure data transmission
• Inadequate data protection at rest

Real-World Impact

Common Cryptographic Vulnerabilities

1. Weak Encryption Algorithms

<!-- VULNERABLE: Using weak algorithms -->
MD5(password)  // Easily cracked
DES(data)       // 56-bit key, broken
RC4(data)       // Vulnerable to attacks

2. Hardcoded Keys

<!-- VULNERABLE: Hardcoded encryption key -->
const ENCRYPTION_KEY = "mysecretkey123";

Insecure Data Transmission

HTTP vs HTTPS

<!-- VULNERABLE: HTTP transmission -->
http://example.com/login
POST /login
username=admin&password=secret123
// SECURE: HTTPS transmission
https://example.com/login
POST /login (encrypted)

Poor Key Management

Common Mistakes:

• Using default keys
• Reusing keys across applications
• Storing keys in source code
• Not rotating keys regularly
• Weak key generation

Inadequate Data Protection at Rest

Database Encryption Issues:

<!-- VULNERABLE: Storing sensitive data unencrypted -->
CREATE TABLE users (
  id INT,
  username VARCHAR(50),
  password VARCHAR(50),  -- Should be hashed
  ssn VARCHAR(20),       -- Should be encrypted
  credit_card VARCHAR(20) -- Should be encrypted
);

Hash Function Vulnerabilities

Weak Hash Functions:

<!-- VULNERABLE: Weak hash functions -->
MD5(password)     // Collision attacks possible
SHA1(password)    // Vulnerable to attacks
CRC32(data)       // Not cryptographically secure
// SECURE: Strong hash functions
bcrypt(password, 12)  // Adaptive hashing
Argon2(password)     // Memory-hard function
scrypt(password)      // Memory-hard function

Certificate and SSL/TLS Issues

Common Problems:

• Self-signed certificates
• Expired certificates
• Weak cipher suites
• SSL/TLS misconfiguration
• Certificate validation bypass

Career Opportunities in Cryptography

Industry Certifications

Cryptographic Certifications:

• CISSP: Certified Information Systems Security Professional
• CISM: Certified Information Security Manager
• CISA: Certified Information Systems Auditor
• CEH: Certified Ethical Hacker
• OSCP: Offensive Security Certified Professional

OS³ Newman Cyber Security Lab

Practical Examples

Web Demos and Tools

Case Study: Heartbleed Vulnerability

Secure Implementation Principles

1. Use Strong Algorithms

<!-- SECURE: Use approved algorithms -->
AES-256-GCM for encryption
SHA-256 or SHA-3 for hashing
RSA-2048+ or ECDSA for signatures

2. Proper Key Management

• Use hardware security modules (HSMs)
• Implement key rotation
• Store keys securely

Summary: Common Cryptographic Failures

Task 1: Cryptographic Vulnerability Discovery

Secure Encryption Implementation

1. Strong Password Hashing

<!-- SECURE: Use bcrypt with appropriate cost -->
const bcrypt = require('bcrypt');
const saltRounds = 12;
const hashPassword = async (password) => {
  return await bcrypt.hash(password, saltRounds);
};
const verifyPassword = async (password, hash) => {
  return await bcrypt.compare(password, hash);
};

2. Data Encryption at Rest

<!-- SECURE: AES-256-GCM encryption -->
const crypto = require('crypto');
const encrypt = (text, key) => {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipher('aes-256-gcm', key);
  let encrypted = cipher.update(text, 'utf8', 'hex');
  encrypted += cipher.final('hex');
  return { encrypted, iv: iv.toString('hex') };
};

Secure Key Management

1. Environment Variables

<!-- SECURE: Store keys in environment variables -->
const ENCRYPTION_KEY = process.env.ENCRYPTION_KEY;
const JWT_SECRET = process.env.JWT_SECRET;
// Use .env file for development
ENCRYPTION_KEY=your-256-bit-key-here
JWT_SECRET=your-jwt-secret-here

2. Key Rotation Strategy

• Implement automatic key rotation
• Use key versioning
• Monitor key usage
• Have key recovery procedures

HTTPS Implementation

1. SSL/TLS Configuration

<!-- SECURE: Express.js HTTPS setup -->
const https = require('https');
const fs = require('fs');
const options = {
  key: fs.readFileSync('private-key.pem'),
  cert: fs.readFileSync('certificate.pem'),
  ciphers: [
    'ECDHE-RSA-AES256-GCM-SHA384',
    'ECDHE-RSA-AES128-GCM-SHA256'
  ].join(':'),
  honorCipherOrder: true
};
https.createServer(options, app).listen(443);

2. Security Headers

<!-- SECURE: Security headers -->
app.use((req, res, next) => {
  res.setHeader('Strict-Transport-Security', 'max-age=31536000');
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('X-Frame-Options', 'DENY');
  next();
});

Database Security

1. Encrypted Database Fields

<!-- SECURE: Encrypt sensitive fields -->
CREATE TABLE users (
  id INT PRIMARY KEY,
  username VARCHAR(50),
  password_hash VARCHAR(255),  -- bcrypt hash
  email_encrypted BLOB,        -- AES encrypted
  ssn_encrypted BLOB,         -- AES encrypted
  created_at TIMESTAMP
);

2. Database Connection Security

• Use SSL/TLS for database connections
• Implement connection pooling
• Use least privilege database users
• Enable database audit logging

API Security

1. JWT Token Security

<!-- SECURE: JWT implementation -->
const jwt = require('jsonwebtoken');
const generateToken = (user) => {
  return jwt.sign(
    { userId: user.id, role: user.role },
    process.env.JWT_SECRET,
    { expiresIn: '1h', algorithm: 'HS256' }
  );
};
const verifyToken = (token) => {
  return jwt.verify(token, process.env.JWT_SECRET);
};

2. API Rate Limiting

<!-- SECURE: Rate limiting -->
const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // limit each IP to 100 requests per windowMs
  message: 'Too many requests from this IP'
});
app.use('/api/', limiter);

Security Testing

1. Automated Security Scanning

<!-- Security testing tools -->
npm install --save-dev eslint-plugin-security
npm install --save-dev snyk
// Run security audit
npm audit
snyk test

2. Manual Testing Checklist

• Test all encryption/decryption functions
• Verify HTTPS implementation
• Check for hardcoded secrets
• Test password policies
• Validate certificate configuration

Compliance and Standards

1. Industry Standards

• FIPS 140-2: Cryptographic module validation
• Common Criteria: Security evaluation
• PCI DSS: Payment card industry standards
• GDPR: Data protection requirements

2. Best Practices

Career Development in Cryptography

Task 2: Secure Cryptographic Implementation

Further Activity: Code Inspection

Session Summary