Cryptography August 2006

cryptography@lists.squeakfoundation.org

3 participants
7 discussions

Notification of publicly available cryptography code
by Ron Teitelbaum 28 Nov '06

28 Nov '06

Notification of publicly available cryptography code: Cryptography code and access to a repository for continuing development will be made publicly available on or after Monday Jan 9th 2006 as part of the Open Source Squeak Project (www.squeak.org <http://www.squeak.org/> ). The code can be accessed two ways. Either through www.squeakSource.com <http://www.squeaksource.com/> in the cryptography project or through the squeak software itself. The location for the Squeak Montecello repository using HTTP accessed through the Squeak software is: MCHttpRepository location: 'http://kilana.unibe.ch:8888/Cryptography' user: '' password: '' Thank you, Ron Teitelbaum Squeak Cryptography Team Leader

3 5

RE: DES Encryption
by Ron Teitelbaum 20 Aug '06

20 Aug '06

All, I wasn't able to find the source code for DESPlugin. I'm still looking into it. Does anyone know where the source code is? I was hoping to see it in the VMMaker but it is not there. Thanks! Ron Teitelbaum > From: Malte Zacharias > Sent: Sunday, August 20, 2006 2:10 PM > Ron Teitelbaum wrote: > > > Hello Malte, > > > > You can find the plugins here: > > http://minnow.cc.gatech.edu/squeak/uploads/2410/ > Thank you, unfortunately the .so file there is linked > against a different libc version as mince, is the source > available somewhere so I could recompile? > > Just place the file in your squeak directory. Use the Dll for Windows > > platforms. > > >

2 1

RE: [Cryptography Team] Help with RSA
by Ron Teitelbaum 17 Aug '06

17 Aug '06

Thank you Matt! Ron _____ From: Matthew S. Hamrick [mailto:mhamrick@cryptonomicon.net] Sent: Thursday, August 17, 2006 3:09 AM To: Ron Teitelbaum Subject: Re: [Cryptography Team] Help with RSA Hey Ron... I haven't been looking too closely at the official crypto source, so I can't say for sure. But from the sound of it, maybe it's the message encoding scheme for the RSA signature. There are two main encoding schemes: PKCS#1 and OAEP, though PKCS#1 now includes OAEP as an option. There's also ISO9697, but I've never seen it used in conjunction with X.509. If this is the encoding scheme, then it can be found in the ALGO oid in the SubjectPublicKeyInfo portion of the cert. Hope this helps. -Cheers -Matt H. On Aug 16, 2006, at 8:21 PM, Ron Teitelbaum wrote: Hello All, I'm working on SSL / TLS implementation in Squeak and I need some help understanding RSA. It appears that our RSA implementation has an encodingParameter. I see what it's doing but now I'm confused and was hoping that someone could explain this to me. I see that the parameter is needs to be the same for encrypting and decrypting, or it doesn't work. My question is how is this stored on a certificate? Here is the MS Export format http://msdn.microsoft.com/library/default.asp?url=/library/en-us/seccrypto/s ecurity/private_key_blobs.asp Field Description blobheader A BLOBHEADER structure as described in a previous section. The bType field must always have a value of PRIVATEKEYBLOB. rsapubkey A <http://msdn.microsoft.com/library/en-us/seccrypto/security/rsapubkey.asp> RSAPUBKEY structure as described in Public <http://msdn.microsoft.com/library/en-us/seccrypto/security/public_key_blobs .asp> Key BLOBs. The magic field must always have a value of 0x32415352 ("RSA2"). modulus The modulus. This has a value of "prime1 * prime2" and is often known as "n". prime1 Prime number 1, often known as "p". prime2 Prime number 2, often known as "q". exponent1 Exponent 1. This has a numeric value of "d mod (p - 1)". exponent2 Exponent 2. This has a numeric value of "d mod (q - 1)". coefficient Coefficient. This has a numeric value of "(inverse of q) mod p". privateExponent Private exponent, often known as "d". I also noticed that : http://en.wikipedia.org/wiki/RSA For reasons of efficiency sometimes a different form of the private key (including CRT parameters) is stored: * p and q, the primes from the key generation, * d mod (p-1) and d mod (q-1) (often known as dmp1 and dmq1) * (1/q) mod p (often known as iqmp) Does this mean that the parameter is the coefficient? Is the CRT parameter the encoding parameter? Any help would be very much appreciated, I'm having trouble understanding the differences, and how the parameter is supposed to be used. Thanks! Ron Teitelbaum _______________________________________________ Cryptography mailing list Cryptography(a)lists.squeakfoundation.org http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/cryptography

1 0

Help with RSA
by Ron Teitelbaum 17 Aug '06

17 Aug '06

Hello All, I'm working on SSL / TLS implementation in Squeak and I need some help understanding RSA. It appears that our RSA implementation has an encodingParameter. I see what it's doing but now I'm confused and was hoping that someone could explain this to me. I see that the parameter is needs to be the same for encrypting and decrypting, or it doesn't work. My question is how is this stored on a certificate? Here is the MS Export format http://msdn.microsoft.com/library/default.asp?url=/library/en-us/seccrypto/s ecurity/private_key_blobs.asp Field Description blobheader A BLOBHEADER structure as described in a previous section. The bType field must always have a value of PRIVATEKEYBLOB. rsapubkey A <http://msdn.microsoft.com/library/en-us/seccrypto/security/rsapubkey.asp> RSAPUBKEY structure as described in Public <http://msdn.microsoft.com/library/en-us/seccrypto/security/public_key_blobs .asp> Key BLOBs. The magic field must always have a value of 0x32415352 ("RSA2"). modulus The modulus. This has a value of "prime1 * prime2" and is often known as "n". prime1 Prime number 1, often known as "p". prime2 Prime number 2, often known as "q". exponent1 Exponent 1. This has a numeric value of "d mod (p - 1)". exponent2 Exponent 2. This has a numeric value of "d mod (q - 1)". coefficient Coefficient. This has a numeric value of "(inverse of q) mod p". privateExponent Private exponent, often known as "d". I also noticed that : http://en.wikipedia.org/wiki/RSA For reasons of efficiency sometimes a different form of the private key (including CRT parameters) is stored: * p and q, the primes from the key generation, * d mod (p-1) and d mod (q-1) (often known as dmp1 and dmq1) * (1/q) mod p (often known as iqmp) Does this mean that the parameter is the coefficient? Is the CRT parameter the encoding parameter? Any help would be very much appreciated, I'm having trouble understanding the differences, and how the parameter is supposed to be used. Thanks! Ron Teitelbaum

1 0

PKCS formated files Question and Update
by Ron Teitelbaum 03 Aug '06

03 Aug '06

Hello All, After getting that question from Suman who is writing a patch for OpenSSL it occurred to me that if OpenSSL doesn't currently support the Windows Certificate Store should we? I did some research and found out that they support PKCS formatted files. I saw they are also support different way to support key storage on hardware, like smartcards and such. Can anyone help me with what the current thinking is on storing and protecting a user's private key and / or certificate using only software? Does it make sense for us to support PKCS formatted files. Is this all that is needed for software protection? Should we support MS CryptoAPI. I also noticed that MS CryptoAPI was (ta da!) Nist certified http://www.microsoft.com/technet/archive/security/topics/issues/fipseval.msp x?mfr=true . What that means exactly I'm not sure since programs need to follow the security policy to also be Nist Certified but I haven't been able to find the requirements or the policy yet. We could tap into more of the crypto functions of MSCryptAPI which would allow programs written in squeak for windows at least to be certifiable. Any thoughts? As an update I'm writing the TLS/ssl interface for Squeak. It's moving along very nicely. I point a browser to squeak and so far I've been able to read and parse the client hello (ssl 2.0, ssl 3.0, tls 1.0 and tls1.2), to select a security suite for communication, to send back a server hello, and now I'm working on the certificate management part. The cryptoAPI stuff is working nicely with FFI. The FFI stuff is hit and miss but I should be able to get though it within a few more days. Ron Teitelbaum Squeak Cryptography Team Leader

1 0

Windows Certitificate Store C++ Code samples
by Ron Teitelbaum 02 Aug '06

02 Aug '06

Suman, Well I'm still fighting with it trying to get it to work, but sure I would be happy to share with you. I've been researching code samples from the API documentation. This is what I found. The code samples don't work as written there were header files and libs missing. The following setup works. Header: #include <stdio.h> #include <windows.h> #include <wincrypt.h> #include <cryptuiapi.h> #include <tchar.h> #pragma comment (lib, "crypt32.lib") #pragma comment (lib, "cryptui.lib") #pragma comment (lib, "Advapi32.lib") #define MY_ENCODING_TYPE (PKCS_7_ASN_ENCODING | X509_ASN_ENCODING) void MyHandleError(char *s); void main(void) { } // End of main. void MyHandleError(char *s) { printf("An error occurred in running the program.\n"); printf("%s\n",s); printf("Error number %x\n.",GetLastError()); printf("Program terminating.\n"); exit(1); } Then you can use this to: Open Certificate store This is the default user certificate store. if(hCertStore = CertOpenStore( CERT_STORE_PROV_SYSTEM, // System store will be a // virtual store 0, // Encoding type not needed // with this PROV NULL, // Accept the default HCRYPTPROV CERT_SYSTEM_STORE_CURRENT_USER, // Set the system store location in the // registry L"MY")) // Could have used other predefined // system stores // including Trust, CA, or Root { fprintf(stderr,"The store has been opened. \n"); } You can open select dialog by: if(!(pCertContext = CryptUIDlgSelectCertificateFromStore( hCertStore, NULL, NULL, NULL, CRYPTUI_SELECT_LOCATION_COLUMN, 0, NULL))) { MyHandleError("Select UI failed." ); } Then in your code you should clean up by doing the following: Clean up CertFreeCertificateContext(pCertContext); CertCloseStore(hCertStore,0); printf("The function completed successfully. \n"); Ultamately you can to access your private key by: CryptExportKey http://msdn.microsoft.com/library/default.asp?url=/library/en-us/seccrypto/s ecurity/cryptexportkey.asp this is how a private key exported with CryptoExportKey is structured: the numbers are encoded LSB first. privatekey: 07 PUBLICKEYSTRUC.bType = PRIVATEKEYBLOB 02 PUBLICKEYSTRUC.bVersion 0000 PUBLICKEYSTRUC.reserved 00002400 PUBLICKEYSTRUC.aiKeyAlg = CALG_RSA_SIGN "RSA2" RSAPUBKEY.magic 00000400 RSAPUBKEY.bitlen 00010001 RSAPUBKEY.pubexp publicmodulus ( = prime1 * prime2 ) 29 f9 be 03 f9 d6 b2 d2 62 29 dc 81 5d 0d 19 18 53 1d 35 7d 2a 6a 23 9a ec 4d 3f 08 47 8e aa a9 dd de c8 dd 87 fc 67 46 0b d8 2e d4 1a 0a d9 9e e8 6b 16 2a 66 6e 46 60 47 bf 22 03 9a 62 d8 e5 d8 1e f7 74 f6 b3 dd 0e 70 26 20 d8 76 41 b5 70 df b5 21 79 ee 98 ee 88 43 1d af f7 ea f0 87 74 a3 e1 f5 dc c3 33 57 ed f7 6c 45 a1 e5 ff 46 bf 8d 2f 2c 1d 30 1c fe 10 6b da 12 db 07 ab a4 ca prime1 f3 53 4b c9 60 29 bb 12 e7 46 23 f0 68 7e d5 58 cf 9b 41 97 5b 08 e4 51 d4 32 31 80 93 00 ce cd 43 db f6 e5 ed 9c 48 06 d8 64 8b 17 32 2d 0e 52 c8 12 00 aa 6e d9 53 cf 84 ce 52 75 e0 ee 3b f4 prime2 73 71 3e 76 7c 47 6f aa 04 76 1e 59 8b 26 5e 70 7a fc 1b f7 30 11 eb 07 73 86 0e d1 fe 52 ab c6 60 6a b8 bb ed 66 91 16 ba 63 7a f2 e7 67 20 7c c8 cc 02 ed 44 63 38 ac 41 35 2a 9b 97 ce 67 d4 exponent1 ( = d mod (prime1 - 1) ) 97 13 50 ea 36 38 46 9e 28 3f b7 d4 54 e6 92 58 b5 dc 04 2e ba 16 da d5 b5 ac c9 6d 2c 4c 00 0e cf 3a a7 9c 4f 8f 9d 1d 7c 03 25 ec 0e 60 69 e6 a7 99 fd 34 37 4a 16 93 b5 cb 08 57 92 a1 74 d8 exponent2 ( = d mod (prime2 - 1) ) 7f 5b 63 19 48 f8 15 1a 5e 97 e5 df e4 f4 2a b7 9a 5b 22 c0 1e 77 5d c6 b5 0d 68 5d b2 5d 45 98 38 3b 4c 8c 4c 95 a1 71 54 fc ad e4 94 11 fb b9 7d a8 7e dd a8 8a be e1 79 9d 1a f6 b8 5e a5 c5 coefficient (such that : coefficient*prime2 (mod prime1)==1 ) bb ba cd 52 15 d7 3a 40 9e 02 8d ad da 6e 70 49 9b b6 4f 7f ba f7 cb e6 73 0b 06 0a db e0 e9 53 0c a0 ba 06 94 ff a2 83 7e 7e 55 a2 0f d2 fb 33 e3 eb 6a 1d 6f 05 c3 4f 8e d9 5a 12 f8 d8 48 a1 private exponent ( d ) e9 da d0 33 9c c7 54 1e 60 aa 26 44 0d 8d ad 25 ad fc 49 66 90 1c 3a cc 61 ea 46 67 67 4b 32 14 b3 04 49 1c 9d 0a 03 1d 35 0f d5 9d 57 8c 27 78 de 4c 7c 2b 0a 47 5c 68 e3 8b b3 3b b6 25 3f 2d 85 11 90 b4 a6 30 52 b2 a7 31 26 0b 13 9d 34 17 c0 93 34 53 5d c1 7d b4 99 38 1b b2 2c 2e 07 19 fd 9c 44 ac 38 2d 75 ab f9 52 b0 15 57 d9 9d 2b b0 15 b4 e5 59 e4 15 02 38 f6 f0 ca 60 a4 31 08 I hope that helps, good luck on your project. Ron Teitelbaum President / Principal Software Engineer US Medical Record Specialists Squeak Cryptography Team Leader > -----Original Message----- > From: Suman Karumuri [mailto:mansuk@gmail.com] > Sent: Tuesday, August 01, 2006 9:41 PM > To: Ron(a)usmedrec.com > Subject: Re: Suggestions for C++ or DLL code > > Hi Ron, > > I am currently working on an engine for openssl, that can talk to the > windows certificate store. So, is there any chance that you can share > the code that you have written to access the windows certificate store > from your program? If not the whole code base, even relevent snippets > would ease writng my patch. > > Please note that this code will be opensourced with due credits. > > Thanks for your time, > -Suman > > On 7/30/06, Ron Teitelbaum <Ron(a)usmedrec.com> wrote: > > > > > > > > > > Hello all, > > > > > > > > I'm currently working on a TLS / SSL implementation and on windows I am > > planning to support the Certificate Store that is built in. This > requires > > me to use the CryptoAPI dlls. The code is complex and it uses a number > of > > header files and many steps. I built some C++ code that does what I'm > > looking for so now I would like to incorporate this into Squeak. > > > > > > > > I'd assumed that FFI was like DDL/C connect in VW but that's not what > I'm > > seeing. So my question is: What is the best way to get this working? > > Should I hack away at FFI and support the api directly, and is that even > > possible? Should I create DLL's to call and use them with FFI, or > should I > > compile some sort of plugins? My preference would be to call the api > > directly without having to create dll's, duplicating my C++ code in > > Smalltalk if possible. > > > > > > > > Some direction and comparisons of different options would be very > helpful. > > > > > > > > Thank you for your help! > > > > > > > > Ron Teitelbaum > > > > > > > >

1 0

Suggestions for C++ or DLL code
by Ron Teitelbaum 01 Aug '06

01 Aug '06

Hello all, I'm currently working on a TLS / SSL implementation and on windows I am planning to support the Certificate Store that is built in. This requires me to use the CryptoAPI dlls. The code is complex and it uses a number of header files and many steps. I built some C++ code that does what I'm looking for so now I would like to incorporate this into Squeak. I'd assumed that FFI was like DDL/C connect in VW but that's not what I'm seeing. So my question is: What is the best way to get this working? Should I hack away at FFI and support the api directly, and is that even possible? Should I create DLL's to call and use them with FFI, or should I compile some sort of plugins? My preference would be to call the api directly without having to create dll's, duplicating my C++ code in Smalltalk if possible. Some direction and comparisons of different options would be very helpful. Thank you for your help! Ron Teitelbaum

6 11

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Cryptography August 2006