Optional book ($35) |
Hands-on Cryptography with Python (plus Blockchains)BSidesSF: Weds, Aug 3, 2016 2-6 PM
|
Optional book ($33) |
Course DescriptionLearn essential concepts of cryptography as it is used on the modern Internet, including hashing, symmetric encryption, and asymmetric encryption. Then perform hands-on projects calculating hashes and encrypting secrets with RSA, and compete to solve challenges including cracking Windows and Linux password hashes, short and poorly-chosen RSA keys.No previous programming experience required. The best computer to bring is a 64-bit Linux machine, real or virtual. However, the Python projects can also be done on a Mac. I will have a few loaner computers available. As you can see below, the course will include hands-on projects with blockchains, using Multichain, Ethereum, and Bitcoin. |
|
Using Cryptool 2 on Windows | |
| Cracking a Caesar Cipher with CrypTool 2 | |
| Cracking a Monoalphabetic Substitution Cipher with CrypTool 2 | |
| Cracking AES (With Weak Keys) with CrypTool 2) |
LecturesReal Hacking (key)Data Breaches: Real and Imaginary (ppt) Bitcoin (key) Security at Colleges NETLAB password insecurity
The lectures are in Keynote and HTML formats. |
Links |
|---|
|
Bitcoin 1: The Crypto-Currency - The New Yorker (2011) Bitcoin 2: Merkle tree - Wikipedia Bitcoin 3: Genesis block Bitcoin 4: Bitcoin Block #0 on Blockchain.info -- Click Transaction to see quote Bitcoin 5: Coinbase, Coinbase Field - Bitcoin Glossary Bitcoin 6: The Crypto-Currency - The New Yorker (2011) Bitcoin 7: Cryptocurrency Prices Bitcoin 8: Understanding Bitcoin Difficulty Bitcoin 9: Difficulty - Bitcoin Wiki Bitcoin 10: Mt Gox: The History of a Failed Bitcoin Exchange Bitcoin 11: The Inside Story of Mt. Gox, Bitcoin's $460 Million Disaster Bitcoin 12: Details of $5 Million Bitstamp Hack Revealed Bitcoin 13: Bitcoin Exchange Gatecoin Hacked; 250 BTC & 185,000 ETH Lost (5-16-16) Bitcoin 14: A history of bitcoin hacks Bitcoin 15: Suspected multi-million dollar Bitcoin pyramid scheme shuts down, investors revolt (8-27-12) Bitcoin 16: Bitcoin exchange BitFloor shuttered after virtual heist (9-4-12) Bitcoin 17: Cryptsy Hacked: Bitcoin Worth $USD 6 Million Stolen (1-18-16) Bitcoin 18: Hackers steal $1m from Bitcoin site (11-8-13) Bitcoin 19: Danish Bitcoin exchange BIPS hacked and 1,295 Bitcoins worth $1 Million Stolen Bitcoin 20: $4.1 Million missing as Chinese bitcoin trading platform GBL vanishes (11-11-13) Bitcoin 21: List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses (11-16-14) Bitcoin 22: Poloniex Loses 12.3% of its Bitcoins in Latest Bitcoin Exchange Hack (3-5-14) Bitcoin 23: Secret Service Agent Gets Six-Year Sentence for Bitcoin Theft (12-17-15) Bitcoin 24: Block Size Chart for Bitcoin and BitcoinCash Bitcoin 25: Bitcoin Cash | Home Bitcoin 26: Segwit2x and the Tale of Three Bitcoins (Aug. 7, 2017)
Blockchain 1: Microsoft launches Project Bletchley blockchain framework (June 17, 2016)
Introduction to Cryptography Videos by Christof Paar - YouTube New Unsorted LinksBitcoin 27: 3 Things to Know About Bitcoin Mining in China (June 13, 2017)Bitcoin 28: Banks fear bitcoin's mining centralization in China Custom RBIX Shellcode Encoder/Decoder -- INTERESTING PROJECT Ch 3a: Why can I encrypt data with one DES key and successfully decrypt with another? Ch 3b: A Tutorial on Linear and Differential Cryptanalysis Brainwallet - JavaScript Client-Side Bitcoin Address Generator -- SHOW TO CLASS NIST POST-QUANTUM CRYPTO STANDARDIZATION CFP Deadline Nov 30, 2017 Hash-based Signatures: An Outline for a New Standard (from 2015) Google Tests New Crypto in Chrome to Fend Off Quantum Attacks (2016) Introducing Azure confidential computing--ENCRYPTING DATA IN USE Ch 4a: AES Rijndael Cipher - Visualization - YouTube Ch 4b: PyCrypto API Documentation Ch 5a: Block cipher mode of operation - Wikipedia Ch 5b: Galois/Counter Mode - Wikipedia Ch 5c: Shor's algorithm - Wikipedia Ch 2g: What is the Difference Between Common Law and Civil Law? Penetration Testing in Active Directory using Metasploit (Part 2) Ch 6a: CSRC - NIST Computer Security Publications SpiderLabs/CryptOMG: CryptOMG is a configurable CTF style test bed that highlights common flaws in cryptographic implementations. Ch 5d: Bug #996193 "OFB chaining mode requires padding" : Bugs : Python-Crypto Ch 5e: Benefits and Vulnerabilities of Wi-Fi Protected Access 2 (WPA2) -- CCMP Mode Explained 2017-10-08: Algorithm for Linux $6$ password hashes c - python crypt in OSX - Stack Overflow Ch 7a: RSA numbers - Wikipedia Ch 7b: Attacking RSA exponentiation with fault injection Ch 7c: Fault-Based Attack of RSA Authentication Hash Length Extension Attacks CryptOMG Walkthrough - Challenge 1 CryptOMG Walkthough - Challenge 2 php - Can I blindly replace all mysql_ functions with mysqli_? - Stack Overflow MariaDB - How to reset MySQL root user password Automated Padding Oracle Attacks with PadBuster Padding oracle attack explained FeatherDuster is a tool for brushing away magical crypto fairy dust The Padding Oracle Attack - why crypto is terrifying The Cryptopals Crypto Challenges Crypto.PublicKey.ElGamal.ElGamalobj Ch 9a: A (Relatively Easy To Understand) Primer on Elliptic Curve Cryptography Why RSA encryption padding is critical Ch 8a: Chinese remainder theorem - Wikipedia Generate Random Prime Numbers rsatool can be used to calculate RSA and RSA-CRT parameters Calculating RSA private keys from its public counterpart IBM Blockchain 101: Quick-start guide for developers Ch 9b: security - The length of the Bitcoin's private keys - Bitcoin Stack Exchange Ch 9c: Keylength - ECRYPT II Report on Key Sizes (2012) Equihash: Asymmetric Proof-of-Work Based on the Generalized Birthday Problem Install Node.js - Ubuntu 16 nodesource/distributions: NodeSource Node.js Binary Distributions Cryptology ePrint Archive How the Byzantine General Sacked the Castle: A Look Into Blockchain Bitcoin.org - The Byzantine Generals' Problem Ethereum Casper 101 Attack of the 50 Foot Blockchain: Bitcoin, Blockchain, Ethereum & Smart Contracts Ethereum Contracts Are Going To Be Candy For Hackers (from 2016) Attacks on RSA cryptosystem Understanding Common Factor Attacks: An RSA-Cracking Puzzle MTC3 — The Cipher Contest trufflesuite/ganache-cli: Fast Ethereum RPC client for testing and development Blockchain Demo - A visual demo of blockchain technology The ultimate guide to audit a Smart Contract Most dangerous attacks in Solidity How $800k Evaporated from the PoWH Coin Ponzi Scheme Overnight (Feb., 2018) Hack This Contract - An Ethereum / Smart Contract Exploit Training Course Comparison of the different TestNets - Ethereum Stack Exchange Rinkeby is extremely slow at confirming transactions - Ethereum Stack Exchange Ethernaut Coin Flip problem Ethernaut ERC20 - Ethereum Token Standard How to stop mining empty blocks? - MultiChain Developer Q&A MultiChain/multichain-web-demo: Simple web interface for MultiChain blockchains, written in PHP. Crypto Identifier - Tool To Uncipher Data Using Multiple Algorithms And Block Chaining Modes Quantum Algorithm Zoo Post-quantum Key Exchange—A New Hope PQCrypto Usage & Deployment GCHQ on Quantum key distribution - NOT RECOMMENDED PadBuster v0.3 and the .NET Padding Oracle Attack NewHope: Quantum-robust Crypto for Key Generation using Ring Learning With Errors Introduction to post-quantum cryptography and learning with errors The Feynman Double Slit--QUANTUM MECHANICS EXPLAINED How to write a quantum program in 10 lines of code (for beginners) Crypton: Library consisting of explanation and implementation of all the existing attacks on various Encryption Systems -- MORE PROJECTS A Guide to Post-Quantum Cryptography EC Council ECES. Cryptography Certification -- TechExams Community How to generate MD5 and SHA-1 collisions of several types From "Hello World" to "Hello Quantum" --VERY GOOD Another New AES Attack - Schneier on Security (from 2009) Serious Security: What 2000 years of cryptography can teach us Beyond the doomsday economics of "proof-of-work" in cryptocurrencies -- EXCELLENT SUMMARY OF BITCOIN Ch 2a: Utah Data Center - Wikipedia Ch 2b: Fresh Tomcat takes loong time to start up Ch 2c: Haveged - ArchWiki Ch 2d: On the Possibility of a Back Door in the NIST SP800-90 Dual Ec Prng (2007) Ch 2e: How a Crypto 'Backdoor' Pitted the Tech World Against the NSA Ch 2f: The Strange Story of Dual_EC_DRBG - Schneier on Security Ch 2g: NIST formally chops NSA-tainted random number generator (2015) Ch 2h: Documents Reveal N.S.A. Campaign Against Encryption (NY Times, 2013) Ch 2i: Crypto shocker: four of every 1,000 public keys provide no security (2012) MD5 considered harmful today (from 2008) Why it's harder to forge a SHA-1 certificate than it is to find a SHA-1 collision Potential Backdoor in Russian Cryptography Systems Ch 3a: What we can learn from attacks on the WEP Protocol Ch 3c: Cryptography | NIST Ch 3d: Jan. 2019 Status of NIST Post-Quantum Cryptography Standards: 17 survivors, including NewHope Ch 3e: SP 800-131A Rev. 2 (DRAFT) Transitioning the Use of Cryptographic Algorithms and Key Lengths (July, 2018) Ch 3f: Keylength - NIST Report on Cryptographic Key Length and Cryptoperiod (2016) Ch 3g: Should We Start Using 4096 bit RSA keys? Ch 3h: Shonen Crypto #1 Cryptocurrency Manga Ch 3i: Ethereum's Memory Hardness Explained, and the Road to Mining It with Custom Hardware Ch 3j: NTLM Decrypter Ch 3k: Another New AES Attack - Schneier on Security Ch 3l: OAEP Reconsidered Ch 3m: Breaking 512-bit RSA with Amazon EC2 is a cinch. So why all the weak keys? Ch 4a: AES Rijndael Cipher explained as a Flash animation - YouTube Ch 4b: Staples Insecure Encryption Ch 4c: Ciphertext stealing - Wikipedia Ch 4d: Block cipher mode of operation - Wikipedia Ch 5a:: Microsoft Office Encryption 2003 and 2007 Ch 5b: The Misuse of RC4 in Microsoft Word and Excel; by hongjun wu Ch 5c: How to break XOR cipher with repeating key? Ch 5d: ASIC vs GPU vs CPU Cryptocurrency Mining Equipment Ch 5e: A Stream Cipher Proposal: Grain-128 (2006) Ch 5f: Fault Analysis of Grain-128 by Targeting NFSR Ch 5g: Grain-128a: a new version of Grain-128 with optional authentication (2011) Ch 5i: On cellular encryption -- A Few Thoughts on Cryptographic Engineering Ch 5k: IETF takes rifle off wall, grabs RC4 cipher's collar, goes behind shed (2004) Ch 5l: Microsoft kills RC4 crypto (2016) Ch 5k: RC4 - Wikipedia Ch 5l: RC4 NOMORE Ch 5k: eSTREAM - Wikipedia Ch 5l: Salsa20 - Wikipedia Ch 5k: The Underhanded C Contest � 2007 Ch 5l: Satellite Phone Encryption Calls Can be Cracked in Fractions of a Second (2017) Ch 6a: BLAKE2: "Harder, Better, Faster, Stronger" Than MD5 Ch 6b: BLAKE2 Ch 6c: Finding Collisions in MD4 Hacker steals $7.7 million in EOS cryptocurrency after blacklist snafu (2019) Ch 6d: Birthday problem - Wikipedia Ch 6e: RC5 and cracking a 72-bit key- Wikipedia Ch 6f: distributed.net - Wikipedia Ch 6g: Is 80 bits of key size considered safe against brute force attacks? - Cryptography Stack Exchange Ch 6h: Create your own MD5 collisions Crypto_MD5_Collision.pdf Ch 6j: How to Break MD5 and Other Hash Functions (Wang) Ch 6k: Parallel hash collision search by Rho method with distinguished points - LISAT2018_Weber_Zhang.pdf Ch 7a: What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do? - Cryptography Stack Exchange NIST finally dumps NSA-tainted random number algorithm (2014) Juniper Networks Hack via ECC (2017) Arrow of time and its reversal on the IBM quantum computer--SHOW TO CLASS Grover's algorithm - Quantum Crypto v. AES Ch 9a: What's "P=NP?", and why is it such a famous question? Ch 9b: Non-deterministic Turing machine - Wikipedia Ch 9c: Nondeterministic algorithm - Wikipedia Ch 9d: P versus NP problem - Wikipedia Ch 9e: Finally, a Problem That Only Quantum Computers Will Ever Be Able to Solve Ch 9f: NP-Complete - explain xkcd Ch 9g: The Original RSA Paper from 1978 Ch 9h: Weak Diffie-Hellman and the Logjam Attack Ch 9i: CECPQ1 - Wikipedia Ch 9j: Lattice-based cryptography -- Episode IV - A new hope - newhope.pdf Ch 10a: Optimal asymmetric encryption padding - Wikipedia Ch 10b: How the EverCrypt Library Creates Hacker-Proof Cryptography Different Types of Hash Codes-How to Find Which Hash types? psypanda/hashID: Software to identify the different types of hashes Ch 11a: Security/Server Side TLS - MozillaWiki Ch 12a: Secure Remote Password protocol - Wikipedia Ch 12b: Practical_Invalid_Curve_Attacks_on_TLS-ECDH Ch 12c: JSON Libraries Patched Against Invalid Curve Crypto Attack Ch 13a: What Happens in a TLS Handshake? | Cloudflare Ch 13b : SecureString Class (System.Security) | Microsoft Docs Ch 13c: Trustwave sold root certificate for surveillance Ch 13d: Law Enforcement Appliance Subverts SSL Ch 13e: Gogo Inflight Internet is intentionally issuing fake SSL certificate Ch 13f: SSL broken! Hackers create rogue CA certificate using MD5 collisions Ch 13g: HTTP Strict Transport Security - Wikipedia Ch 13h: HTTP Public Key Pinning - Wikipedia Ch 13i: Expect-CT - HTTP | MDN Ch 13j: Secure your web application with these HTTP headers Ch 14a: Digital Electronics/Logic Gates/Fundamental Digital Gates Ch 14c: Digital electronics - Wikipedia Ch 14e: Shor's algorithm -- Experience Documentation 2.0 documentation Ch 14d: Grover's Algorithm: IBM Q Experience Ch 14d: Grover's Algorithm -- Experience Documentation 2.0 documentation Scientists Crack Longest Encryption Key Ever--795 bits (Dec 2019) CyberChef--Many cryptographic tasks Wikizero - Number Theoretic Algorithms (at bottom of page) Seriously, stop using RSA | Trail of Bits Blog CRYSTALS: Cryptographic Suite for Algebraic Lattices -- One of IBM's Quantum-Resistant Encryption Methods IBM Quantum-safe cryptography: What it means for your data in the cloud Pentesting Ethereum dApps. An Ethereum decentralized application Minimum Viable Ethereum Mobile Wallet How to Make a Cryptocurrency Using Litecoin v0.15 Source Differential and Linear Cryptanalysis in Evaluating AES Candidate Algorithms (1998) GitHub - eth-sri/securify2: Securify v2.0 - Scan Solidity Contracts for Vulnerabilities National Security Agency | Frequently Asked Questions: Quantum Computing and Post-Quantum Cryptography The limitation of the computational power of the universe ID card security: Spain is facing chaos over chip crypto flaws (from 2017) The Universe has the capacity to perform a maximum of 10^123 logic operations Ch 9k: PQC Standardization Process: Third Round Candidate Announcement | NIST Quantum Computers Won't Find Hash Collisions Faster than Classical Computers A Survey of Security Vulnerabilities in Ethereum Smart Contracts Exploring Bitcoin’s Lightning Network Podcast History of Cryptographic Key Sizes A curated list of blockchain security Capture the Flag (CTF) competitions SP 800-131A Rev. 2, Transitioning the Use of Crypto Algorithms and Key Lengths | CSRC Breaking 256-bit Elliptic Curve Encryption with a Quantum Computer - Schneier on Security Bitcoin and quantum computing Kyber and Post-Quantum Crypto - How does it work? -- RedRocket Computer Scientist Explains Zero-Knowledge Proofs in 5 Levels of Difficulty |
Last updated 8-6-16 9:45 pm
