CipherMode

ciphermode

A block cipher mode of operation, usually just called a "mode" in context, specifies how a block cipher should be used to encrypt or decrypt messages that are longer than the block size. Most symmetric-key algorithms currently in use are block ciphers: this means that they encrypt data a block at a time. The size of each block is fixed and determined by the algorithm: for example uses 16-byte blocks. Block ciphers are always used with a , which specifies how to securely encrypt messages that are longer than the block size. For example, AES is a cipher, while CTR, CBC, and GCM are all modes. Using an inappropriate mode, or using a mode incorrectly, can completely undermine the security provided by the underlying cipher. AES mode View Previous Terms: Certificate authority Challenge-response authentication Cipher Cipher suite Ciphertext CORS CORS-safelisted request header CORS-safelisted response header Cross-site scripting Cryptanalysis Cryptographic hash function Cryptography CSP CSRF Decryption Digital certificate DTLS (Datagram Transport Layer Security) Encryption Forbidden header name Forbidden response header name Hash HMAC HPKP HSTS HTTPS Key MitM OWASP Preflight request Public-key cryptography Reporting directive Robots.txt Same-origin policy Session Hijacking SQL Injection Symmetric-key cryptography TOFU Transport Layer Security (TLS) Credits Source: https://developer.mozilla.org/en-US/docs/Glossary/Block_cipher_mode_of_operation Published under license Open CC Attribution ShareAlike 3.0

Glossary of Security Terms: Block Cipher Mode of Operation

In the modern world of , ensuring the confidentiality of passwords and other sensitive data is a paramount concern. For this purpose, cryptographic algorithms and key derivation functions are widely employed. One such algorithm is (Password-Based Key Derivation Function 2), used to derive cryptographic keys from passwords. Let’s delve into how PBKDF2 works using a Java service as an example. information security PBKDF2 What is PBKDF2? PBKDF2 is an algorithm designed to strengthen the security of passwords by creating cryptographic keys for cryptographic operations such as encryption. It achieves this by applying repeated hashing (iterations) to the password and adding a random “ ” to thwart brute-force attacks. salt The Role of Salt Salt is a random value added to the password before hashing and key derivation. Using salt serves several crucial : purposes : Salt ensures that each password’s hash is unique, even if the passwords themselves are identical. This uniqueness makes attacks based on precomputed tables (such as rainbow tables) less effective because the hash for the same password will differ due to different salts. Unique Hashes : Salt makes passwords less susceptible to dictionary attacks. Even if two users have the same password, using different salts results in different hashes. Protection Against Dictionary Attacks : Salt complicates the process of calculating the hash, requiring attackers to expend additional computational resources and time when attempting to crack a password through brute force. Password Security Enhancement Java Service Example Let’s examine a Java service example that utilizes PBKDF2 for encryption and decryption. The code example below represents this service, and we’ll break it down step by step. Constructor In the constructor, the master password ( ) and salt ( ) are initialized. These values will be used to create the encryption key. It's essential to ensure that the length of both the master password and salt meets the minimum security requirements. masterPassword salt public PasswordDerivationService(String masterPassword, String salt) {
    this.masterPassword = masterPassword;
    this.salt = salt;
    validateSaltAndMasterPassword(masterPassword, salt);
} Key Derivation This method creates the key used for encryption and decryption. It employs PBKDF2 to derive the key from the master password and salt. private SecretKeySpec generateSecretKeySpec() throws InvalidKeySpecException, NoSuchAlgorithmException {
    SecretKeyFactory factory = SecretKeyFactory.getInstance(KEY_DERIVATION_ALGORITHM);
    KeySpec spec = new PBEKeySpec(masterPassword.toCharArray(), salt.getBytes(), 512, 256);
    SecretKey tmp = factory.generateSecret(spec);
    return new SecretKeySpec(tmp.getEncoded(), CRYPTO_ALGORITHM);
} Cipher Preparation This method initializes a object for encrypting or decrypting data. It uses the previously created key and encryption parameters, such as the Initialization Vector (IV). Cipher private Cipher prepareCipher(int cipherMode) throws NoSuchPaddingException, NoSuchAlgorithmException,
        InvalidKeySpecException, InvalidAlgorithmParameterException, InvalidKeyException {
    IvParameterSpec ivSpec = new IvParameterSpec(IV);
    Cipher cipher = Cipher.getInstance(CIPHER_TRANSFORMATION);
    cipher.init(cipherMode, generateSecretKeySpec(), ivSpec);
    return cipher;
} Encryption The method uses the initialized cipher to encrypt input data. The encryption result is represented as a Base64-encoded string. encrypt public String encrypt(@Nonnull String dataToEncrypt) {
    try {
        Cipher cipher = prepareCipher(Cipher.ENCRYPT_MODE);
        return Base64.getEncoder().encodeToString(cipher.doFinal(dataToEncrypt.getBytes(StandardCharsets.UTF_8)));
    } catch (Exception e) {
        throw new EncryptionException(e.getMessage(), e);
    }
} Decryption The method employs the initialized cipher to decrypt a string encrypted using the method. It returns the original data. decrypt encrypt public String decrypt(@Nonnull String dataToDecrypt) {
    try {
        Cipher cipher = prepareCipher(Cipher.DECRYPT_MODE);
        return new String(cipher.doFinal(Base64.getDecoder().decode(dataToDecrypt.getBytes(StandardCharsets.UTF_8))));
    } catch (Exception e) {
        throw new DecryptionException(e.getMessage(), e);
    }
} Validate salt & master password The method checks the length of the master password and salt to ensure they meet minimum security requirements. If the lengths do not comply with these requirements, an exception is raised. validateSaltAndMasterPassword protected void validateSaltAndMasterPassword(@Nonnull String masterPassword, @Nonnull String salt) {
    if (masterPassword.length() < MIN_MASTER_PASSWORD_LENGTH) {
        throw new EncryptionException("Master password length must be at least " + MIN_MASTER_PASSWORD_LENGTH);
    }
    if (salt.length() < MIN_SALT_LENGTH) {
        throw new EncryptionException("Salt length must be at least " + MIN_SALT_LENGTH);
    }
} Conclusion The PBKDF2 algorithm is a powerful tool for enhancing the security of passwords and data. Understanding how PBKDF2 works can assist developers in creating secure applications. The Java service example provided demonstrates how PBKDF2 can be used to generate cryptographic keys and ensure secure encryption and decryption of data. This example underscores the importance of correctly implementing cryptography to safeguard data confidentiality and integrity, while also explaining the role of salt in enhancing password security. You can view the full project code on Github

Understanding the PBKDF2 Аlgorithm With a Java Service Example

, formerly known as , is a used by applications to communicate securely across a network, preventing tampering with and eavesdropping on email, web browsing, messaging, and other protocols. Both SSL and TLS are client / server protocols that ensure communication privacy by using cryptographic protocols to provide security over a network. When a server and client communicate using TLS, it ensures that no third party can eavesdrop or tamper with any message. Transport Layer Security (TLS) Secure Sockets Layer (SSL) protocol All modern browsers support the TLS protocol, requiring the server to provide a valid confirming its identity in order to establish a secure connection. It is possible for both the client and server to mutually authenticate each other, if both parties provide their own individual digital certificates. digital certificate : TLS 1.0 and 1.1 support will be removed from all major browsers in early 2020; you'll need to make sure your web server supports TLS 1.2 or 1.3 going forward. From version 74 onwards, Firefox will return a error when connecting to servers using the older TLS versions ( ). Note Secure Connection Failed bug 1606734 View Previous Terms: Block cipher mode of operation Certificate authority Challenge-response authentication Cipher Cipher suite Ciphertext CORS CORS-safelisted request header CORS-safelisted response header Cross-site scripting Cryptanalysis Cryptographic hash function Cryptography CSP CSRF Decryption Digital certificate DTLS (Datagram Transport Layer Security) Encryption Forbidden header name Forbidden response header name Hash HMAC HPKP HSTS HTTPS Key MitM OWASP Preflight request Public-key cryptography Reporting directive Robots.txt Same-origin policy Session Hijacking SQL Injection Symmetric-key cryptography TOFU Credits Source: https://developer.mozilla.org/en-US/docs/Glossary/TLS Published under license Open CC Attribution ShareAlike 3.0

Glossary of Security Terms: Transport Layer Security

) is a security model in which a client needs to create a trust relationship with an unknown server. To do that, clients will look for identifiers (for example public keys) stored locally. If an identifier is found, the client can establish the connection. If no identifier is found, the client can prompt the user to determine if the client should trust the identifier. Trust On First Use (TOFU TOFU is used in the SSH protocol, in ( ) where the browsers will accept the first public key returned by the server, and in ( ) where a browser will obey the redirection rule. HTTP Public Key Pinning HPKP Strict-Transport-Security HSTS Learn more ( ) HTTP Public Key Pinning HPKP Public-Key-Pins Wikipedia: TOFU View Previous Terms: Block cipher mode of operation Certificate authority Challenge-response authentication Cipher Cipher suite Ciphertext CORS CORS-safelisted request header CORS-safelisted response header Cross-site scripting Cryptanalysis Cryptographic hash function Cryptography CSP CSRF Decryption Digital certificate DTLS (Datagram Transport Layer Security) Encryption Forbidden header name Forbidden response header name Hash HMAC HPKP HSTS HTTPS Key MitM OWASP Preflight request Public-key cryptography Reporting directive Robots.txt Same-origin policy Session Hijacking SQL Injection Symmetric-key cryptography Transport Layer Security (TLS) Credits Source: https://developer.mozilla.org/en-US/docs/Glossary/TOFU Published under license Open CC Attribution ShareAlike 3.0

Glossary of Security Terms: TOFU

Symmetric-key cryptography is a term used for cryptographic algorithms that use the same key for encryption and for decryption. The key is usually called a "symmetric key" or a "secret key". This is usually contrasted with , in which keys are generated in pairs and the transformation made by one key can only be reversed using the other key. public-key cryptography Symmetric-key algorithms should be secure when used properly and are highly efficient, so they can be used to encrypt large amounts of data without having a negative effect on performance. Most symmetric-key algorithms currently in use are block ciphers: this means that they encrypt data one block at a time. The size of each block is fixed and determined by the algorithm: for example uses 16-byte blocks. AES Block ciphers are always used with a , which specifies how to securely encrypt messages that are longer than the block size. For example, AES is a cipher, while CTR, CBC, and GCM are all modes. Using an inappropriate mode, or using a mode incorrectly, can completely undermine the security provided by the underlying cipher. mode View Previous Terms: Block cipher mode of operation Certificate authority Challenge-response authentication Cipher Cipher suite Ciphertext CORS CORS-safelisted request header CORS-safelisted response header Cross-site scripting Cryptanalysis Cryptographic hash function Cryptography CSP CSRF Decryption Digital certificate DTLS (Datagram Transport Layer Security) Encryption Forbidden header name Forbidden response header name Hash HMAC HPKP HSTS HTTPS Key MitM OWASP Preflight request Public-key cryptography Reporting directive Robots.txt Same-origin policy Session Hijacking SQL Injection TOFU Transport Layer Security (TLS) Credits Source: https://developer.mozilla.org/en-US/docs/Glossary/Symmetric-key_cryptography Published under license Open CC Attribution ShareAlike 3.0

Glossary of Security Terms: Symmetric-Key Cryptography

SQL injection takes advantage of Web apps that fail to validate user input. Hackers can maliciously pass SQL commands through the Web app for execution by a backend database. SQL injection can gain unauthorized access to a database or to retrieve information directly from the database. Many data breaches are due to SQL injection. How It Works After entering username and password, behind the GUI the SQL queries work as follows: " (*) Username= = SELECT Count FROM Users WHERE ' " + txt.User.Text+" ' AND Password ' "+ txt.Password.Text+" ' "; Now suppose User enters the Username: admin and Password: passwd123, so after clicking on the Log in button, SQL query will run as follows: " (*) Username= = SELECT Count FROM Users WHERE ' admin ' AND Password ' passwd123 ' "; If the credentials are correct, then the user is allowed to log in, so it's a very simple (and therefore insecure) mechanism. Hackers use this insecurity to gain unauthorized access. Hackers use a simple string called a Magical String, for example: Username: admin Password: anything 'or'1'='1 After clicking on the login button, the SQL query will work as follows: " (*) Username= = = SELECT Count FROM Users WHERE ' admin ' AND Password ' anything ' or '1' '1 ' "; Just take a closer look at the above query's password section. Password=' anything 'or'1'='1 ' The password is not 'anything', hence password=anything results in FALSE, but '1'='1' is a TRUE statement and hence returns a TRUE value. Finally, due to the OR operator, the value ( FALSE OR TRUE ) is TRUE, so authentication bypasses successfully. Just due to a simple string (Magical String) the entire database is compromised. How To Prevent Before executing the queries for the user credentials, make some changes like the following: $id = $_GET['id'] 

(1) $id = Stripslashes($id)

(2) $id = mysql_real_escape_String($id) So due to (1) each single quote (') in the input string is replaced with double quotes ("), and due to (2) before every (') it adds (/). The revised magical string fails to bypass the authentication, and your database stays secure. Learn more General knowledge on Wikipedia SQL injection on OWASP (Open Web Application Security Project) Explanation of SQL injection View Previous Terms: Block cipher mode of operation Certificate authority Challenge-response authentication Cipher Cipher suite Ciphertext CORS CORS-safelisted request header CORS-safelisted response header Cross-site scripting Cryptanalysis Cryptographic hash function Cryptography CSP CSRF Decryption Digital certificate DTLS (Datagram Transport Layer Security) Encryption Forbidden header name Forbidden response header name Hash HMAC HPKP HSTS HTTPS Key MitM OWASP Preflight request Public-key cryptography Reporting directive Robots.txt Same-origin policy Session Hijacking Symmetric-key cryptography TOFU Transport Layer Security (TLS) Credits Source: https://developer.mozilla.org/en-US/docs/Glossary/SQL_injection Published under license Open CC Attribution ShareAlike 3.0

Glossary of Security Terms: SQL Injection

occurs when an attacker takes over a valid session between two computers. The attacker steals a valid session ID in order to break into the system and snoop data. Session hijacking Most authentication occurs only at the start of a session. In TCP session hijacking, an attacker gains access by taking over a TCP session between two machines in mid session. TCP Session hijacking occurs because no account lockout for invalid session IDs weak session-ID generation algorithm insecure handling indefinite session expiration time short session IDs transmission in plain text Session hijacking process , that is perform a man-in-the-middle (MITM) attack, place yourself between victim and server. Sniff packets flowing between server and user. Monitor the victim machine's connection. Break of the session. Take control new packets to the server using the Victim's Session ID. Inject Protection against session hijacking create a secure communication channel with SSH (secure shell) pass authentication cookies over HTTPS connection implement logout functionality so the user can end the session generate the session ID after successful login pass encrypted data between the users and the web server use a string or long random number as a session key Learn more General knowledge on Wikipedia Session hijacking View Previous Terms: Block cipher mode of operation Certificate authority Challenge-response authentication Cipher Cipher suite Ciphertext CORS CORS-safelisted request header CORS-safelisted response header Cross-site scripting Cryptanalysis Cryptographic hash function Cryptography CSP CSRF Decryption Digital certificate DTLS (Datagram Transport Layer Security) Encryption Forbidden header name Forbidden response header name Hash HMAC HPKP HSTS HTTPS Key MitM OWASP Preflight request Public-key cryptography Reporting directive Robots.txt Same-origin policy SQL Injection Symmetric-key cryptography TOFU Transport Layer Security (TLS) Credits Source: https://developer.mozilla.org/en-US/docs/Glossary/Session_hijacking Published under license Open CC Attribution ShareAlike 3.0

Glossary of Security Terms: Session Hijacking

The is a critical security mechanism that restricts how a document or script loaded from one can interact with a resource from another origin. It helps isolate potentially malicious documents, reducing possible attack vectors. same-origin policy origin View Previous Terms: Block cipher mode of operation Certificate authority Challenge-response authentication Cipher Cipher suite Ciphertext CORS CORS-safelisted request header CORS-safelisted response header Cross-site scripting Cryptanalysis Cryptographic hash function Cryptography CSP CSRF Decryption Digital certificate DTLS (Datagram Transport Layer Security) Encryption Forbidden header name Forbidden response header name Hash HMAC HPKP HSTS HTTPS Key MitM OWASP Preflight request Public-key cryptography Reporting directive Robots.txt Session Hijacking SQL Injection Symmetric-key cryptography TOFU Transport Layer Security (TLS) Credits Source: https://developer.mozilla.org/en-US/docs/Glossary/Same-origin_policy Published under license Open CC Attribution ShareAlike 3.0

Glossary of Security Terms: Same-Origin Policy

Robots.txt is a file which is usually placed in the root of any website. It decides whether are permitted or forbidden access to the web site. crawlers For example, the site admin can forbid crawlers to visit a certain folder (and all the files therein contained) or to crawl a specific file, usually to prevent those files being indexed by other search engines. Learn more General knowledge on Wikipedia Robots.txt https://developers.google.com/search/reference/robots_txt Standard specification draft: https://tools.ietf.org/html/draft-rep-wg-topic https://www.robotstxt.org/ View Previous Terms: Block cipher mode of operation Certificate authority Challenge-response authentication Cipher Cipher suite Ciphertext CORS CORS-safelisted request header CORS-safelisted response header Cross-site scripting Cryptanalysis Cryptographic hash function Cryptography CSP CSRF Decryption Digital certificate DTLS (Datagram Transport Layer Security) Encryption Forbidden header name Forbidden response header name Hash HMAC HPKP HSTS HTTPS Key MitM OWASP Preflight request Public-key cryptography Reporting directive Same-origin policy Session Hijacking SQL Injection Symmetric-key cryptography TOFU Transport Layer Security (TLS) Credits Source: https://developer.mozilla.org/en-US/docs/Glossary/Robots.txt Published under license Open CC Attribution ShareAlike 3.0

Glossary of Security Terms: Robots.txt

are used in a header and control the reporting process of CSP violations. CSP reporting directives Content-Security-Policy See for a complete list. Reporting directives View Previous Terms: Block cipher mode of operation Certificate authority Challenge-response authentication Cipher Cipher suite Ciphertext CORS CORS-safelisted request header CORS-safelisted response header Cross-site scripting Cryptanalysis Cryptographic hash function Cryptography CSP CSRF Decryption Digital certificate DTLS (Datagram Transport Layer Security) Encryption Forbidden header name Forbidden response header name Hash HMAC HPKP HSTS HTTPS Key MitM OWASP Preflight request Public-key cryptography Robots.txt Same-origin policy Session Hijacking SQL Injection Symmetric-key cryptography TOFU Transport Layer Security (TLS) Credits Source: https://developer.mozilla.org/en-US/docs/Glossary/Reporting_directive Published under license Open CC Attribution ShareAlike 3.0

Stories, News & Mentions about CIPHERMODE

Ciphermode’s Stories on HackerNoon