đŸȘŽ Anil's Garden

Cryptography and Cybersecurity

10 Feb 20256 min read

Resources 📚

Articles

Concepts

Elliptic Curve Cryptography

Notes on Motivations for use of Elliptic Curve Cryptography from National Security AgencyCentral Security Service Web Site

The two noteworthy first generation public key algorithms used to secure the Internet today are known as RSA and Diffie-Hellman (DH). The security of the first is based on the difficulty of factoring the product of two large primes. The second is related to a problem known as the discrete logarithm problem for finite groups. Both are based on the use of elementary number theory. Interestingly, the security of the two schemes, though formulated differently, is closely related.


elliptic curve cryptography has remained at its full strength since it was first presented in 1985



The length of a key, in bits, for a conventional encryption algorithm is a common measure of security. To attack an algorithm with a k-bit key it will generally require roughly 2k-1 operations. Hence, to secure a public key system one would generally want to use parameters that require at least 2k-1 operations to attack. The following table gives the key sizes recommended by the National Institute of Standards and Technology to protect keys used in conventional encryption algorithms like the (DES) and (AES) together with the key sizes for RSA, Diffie-Hellman and elliptic curves that are needed to provide equivalent security.

Symmetric Key Size (bits)RSA and Diffie-Hellman Key Size (bits)Elliptic Curve Key Size (bits)
801024160
1122048224
1283072256
1927680384
25615360521
Table 1: NIST Recommended Key Sizes

To use RSA or Diffie-Hellman to protect 128-bit AES keys one should use 3072-bit parameters: three times the size in use throughout the Internet today. The equivalent key size for elliptic curves is only 256 bits.

One can see that as symmetric key sizes increase the required key sizes for RSA and Diffie-Hellman increase at a much faster rate than the required key sizes for elliptic curve cryptosystems.

Attack Types

Clickjacking

Clickjacking or formally UI Redressing: attacker “redresses” the interface seen by the user with an invisible frame that tricks them into doing things they wouldn’t ordinarily do

Password managers

Miscellaneous

  • Crowdstrike failure in July 2024 write up Tavis Ormandy (vulnerability researcher at Google)
  • Extracting Clear-Text Credentials Directly From Chromium’s Memory
    • memory chunk, the password is stored inside a memory section of type Private: Commit. One could think that data stored in such memory pages is not accessible to any other process. Surprisingly, such pages cannot be part of a “shared memory,” but other processes have no problem reading the data in them (via ReadProcessMemory API).
    • Chromium.org stated they will not fix issues related to physical local attacks since “there is no way for Chrome (or any application) to defend against a malicious user who has managed to log into your device as you” (here). While this statement is probably true in general (especially if you assume the attacker can get administrator privileges), I believe it should not be so easy to steal sensitive credentials as it is today.
    • Chromium Docs - Chrome Security FAQ - see Threat Model therein

SSH

Graph View

Backlinks

  • No backlinks found