Enterprise Library Cryptography Application Block

1
Enterprise LibraryCryptography Application Block

• Tim Shakarian
• Software Design EngineerAvanade
• Ron JacobsProduct ManagerMicrosoft

Scott Densmore Software Design EngineerMicrosoft
2
Agenda

• Overview
• What you must know to use the block
• Defining your configuration
• Creating an instance of the cryptography provider
  object
• Executing the hash, encryption and decryption
• Getting beyond the surface
• Selecting the right option for cryptography
• For really advanced users
• Key extensibility points

3
patterns practicesArchitecture Guidance for
the Enterprise
Proven Based on field experience Authoritative
Offer the best advice available
Accurate Technically validated and tested
Actionable Provide the steps to success
Relevant Address real-world problems based on
customer scenarios
Available online http//www.microsoft.com/practi
ces Books available http//www.amazon.com/pract
ices
Application Blocks
Patterns
Reference Architectures
Atomic solutions to recurring problems
Sub-system-level guidance for common services
System-level guidance for common customer
scenarios
D
A
D
I
D
A
D
I
A
A
D
D
I
I
Guides Guidance for broad horizontal topics such
as security, performance, deployment and
operations
4
Sound familiar?

• Writing the same code over and over for the
  plumbing around cryptography (streams,
  initialization vectors, strings to byte array
  conversions, etc.)
• Fretting over which algorithm to use in your
  application code, knowing that changing
  algorithms will force application code changes
• Wrestling with how to manage cryptography keys

5
Poll When it comes to Cryptography

• Live Meeting Multiple Choice Poll. Use Live
  Meeting gt Edit Slide Properties... to edit.
• I have struggled with these issues
• I know how to use System.Security.Cryptography
• I know I need to do crypto but I worry about
  getting it right
• What is cryptography?

6
Why Cryptography?

• Confidentiality
• To ensure data remains private. Confidentiality
  is usually achieved using encryption.
• Data integrity
• To ensure data is protected from accidental or
  deliberate (malicious) modification.
• Authentication
• To assure that data originates from a particular
  party.

7
Cryptography Needs

• A simple way of hashing data and comparing hashed
  values
• A simple way of encrypting and decrypting data
• The ability to encrypt information without using
  keys, for use on a single machine
• The ability to write the same application code
  for different cryptography providers
• An easy way to adjust and validate the
  cryptography configuration settings

8
Common Application Threats with Cryptography
Countermeasures

• Configuration Management
• Retrieval of plaintext configuration secrets
• Sensitive Data
• Access to sensitive data in storage
• Network eavesdropping
• Data tampering
• Session Management
• Man in the middle attacks

Improving Web Application SecurityThreats and
Countermeasures Chapter 2 Threats and
Countermeasures http//msdn.microsoft.com/library/
default.asp?url/library/en-us/dnnetsec/html/Threa
tCounter.asp
9
Cryptography Threats and Countermeasures

• Threat Poor key generation or key management
• Countermeasures
• Use built-in encryption routines that include
  secure key management
• Use strong random key generation functions and
  store the key in a restricted location
• Encrypt the encryption key using DPAPI for added
  security
• Expire keys regularly

Improving Web Application SecurityThreats and
Countermeasures Chapter 2 Threats and
Countermeasures http//msdn.microsoft.com/library/
default.asp?url/library/en-us/dnnetsec/html/Threa
tCounter.asp
10
Cryptography Threats and Countermeasures

• Threat Weak or custom encryption
• Countermeasures
• Do not develop your own custom algorithms
• Use the proven cryptographic services provided by
  the platform
• Stay informed about cracked algorithms and the
  techniques used to crack them

Improving Web Application SecurityThreats and
Countermeasures Chapter 2 Threats and
Countermeasures http//msdn.microsoft.com/library/
default.asp?url/library/en-us/dnnetsec/html/Threa
tCounter.asp
11
Cryptography Threats and Countermeasures

• Threat Checksum Spoofing
• Do not rely on hashes to provide data integrity
  for messages sent over networks. Hashes such as
  Safe Hash Algorithm (SHA1) and Message Digest
  compression algorithm (MD5) can be intercepted
  and changed.
• Countermeasures
• Use a message authentication code (MAC) or hashed
  message authentication code (HMAC)

Improving Web Application SecurityThreats and
Countermeasures Chapter 2 Threats and
Countermeasures http//msdn.microsoft.com/library/
default.asp?url/library/en-us/dnnetsec/html/Threa
tCounter.asp
12
Cryptography Application Block

• Provides a simplified approach to implementing
  common cryptography scenarios
• Improve Security
• Considers threats and countermeasures
• Ease of use increases likelihood of adoption
• Other application blocks designed to work with
  the Cryptography Application Block

13
Enterprise Library v1
Caching
Exceptions
Legend
Security
Data Access
Logging
Dependency
Plug-in
Crypto
Configuration
Config Tool
14
Implementing Crypto

• ...in 2 easy steps

15
Step 1 Define your configuration

• You will need an app.config (or web.config) file
  for your application
• Use the Enterprise Library Configuration tool to
  create the configuration for the Cryptography
  Application Block
• Use a post-build step to copy config files to the
  runtime directory
• See http//www.ronjacobs.com/TipPostBuild.htm

16
Step 2 Call the Appropriate Cryptography Method

• Static method interface
• Enterprise Library Cryptography Application Block
  uses the Plugin Fowler pattern to create
  providers.

// Encrypt using the named provider string
encyrptedValue Cryptographer.EncryptSymmetric("s
ymproviderName", "StringToEncrypt")
// Generate a hash value using the named
provider string hashedValue Cryptographer.Create
Hash("hashprovider", "MySecret")
17
View/Application Share Demonstration of
Cryptography Block

• Live Meeting View/Application Share. Use Live
  Meeting gt Edit Slide Properties... to edit.

18
Going deeper...

• ...this is where it gets interesting

19
Threats and Countermeasures

• Disclosure of Configuration Data
• The most sensitive configuration data used by
  data access code is the database connection
  string. If a compromised connection string
  includes a user name and password, the
  consequences can be greater still.
• Vulnerabilities
• Use of SQL authentication, which requires
  credentials to be specified in the connection
  string
• Embedded connection strings in code
• Clear text connection strings in configuration
  files
• Failure to encrypt a connection string
• Countermeasures
• Use Windows authentication so that connection
  strings do not contain credentials.
• Encrypt the connection strings and restrict
  access to the encrypted data.

Improving Web Application SecurityThreats and
Countermeasures Chapter 14 Building Secure
Data Access http//msdn.microsoft.com/library/defa
ult.asp?url/library/en-us/dnnetsec/html/ThreatCou
nter.asp
20
Storing Secrets

• Typical examples of secrets include
• SQL connection strings
• Credentials used for SQL application roles
• Fixed identities in Web.config
• Process identity in Machine.config
• Keys used to store data securely
• SQL Server session state
• Passwords used for Forms authentication against a
  database

Building Secure ASP.NET Applications Chapter 8
ASP.NET Security http//msdn.microsoft.com/library
/default.asp?url/library/en-us/dnnetsec/html/secn
etlpMSDN.asp
21
Options for Storing Secrets

• Pick and choose from platform options
• .NET cryptography classes
• Data Protection API (DPAPI)
• CAPICOM
• Crypto API
• Or use the Enterprise Library and the
  Cryptography Application Block for simplified and
  best practice use of the platform!

22
Encryption Algorithms

• Selecting an Algorithm
• Some encryption algorithms perform better than
  others while some provide stronger encryption.
  Typically, larger encryption key sizes increase
  security.
• A Common Mistake
• Developing your own encryption algorithms

Improving Web Application SecurityThreats and
Countermeasures Chapter 7 Building Secure
Assemblies http//msdn.microsoft.com/library/defau
lt.asp?url/library/en-us/dnnetsec/html/ThreatCoun
ter.asp
23
Storing Passwords

• For security reasons, you should not store
  passwords (clear text or encrypted) in the
  database.
• You should avoid storing encrypted passwords
  because it raises key management issues you can
  secure the password with encryption, but you then
  have to consider how to store the encryption key.
  If the key becomes compromised, an attacker can
  decrypt all the passwords within your data store.

Building Secure ASP.NET Applications Chapter 8
ASP.NET Security http//msdn.microsoft.com/library
/default.asp?url/library/en-us/dnnetsec/html/secn
etlpMSDN.asp
24
Store One-way Password Hashes (with Salt)

• The preferred approach is to
• Store a one way hash of the password. Re-compute
  the hash when the password needs to be validated.
• Combine the password hash with a salt value (a
  cryptographically strong random number). By
  combining the salt with the password hash, you
  mitigate the threat associated with dictionary
  attacks.

Building Secure ASP.NET Applications Chapter 8
ASP.NET Security http//msdn.microsoft.com/library
/default.asp?url/library/en-us/dnnetsec/html/secn
etlpMSDN.asp
25
Configuring the Hash Provider

• Using the Configuration Console

26
Configuring Hash Provider to use Salt

• Each provider has the option to use salt
• Salt value is generated by application block

27
Generating the Hash

• Call CreateHash with the name of the hash
  provider and the value to be hashed

• Dim hValue As String
• Cryptographer.CreateHash("hashprovider",
  "MyValue")

• Sample hash result

HCmamZDAnUkKRwULHNPeItrOyw4uC80qE2Zd6DZqm53A8uZb
28
Comparing Hash Values

• Call CompareHash with the name of the hash
  provider, comparison value, and the original
  hashed value

• boolean matched
• Cryptographer.CompareHash("hashprovider",
• 
  "MyValue.
• 
  hValue)

29
Salt Under the Covers

• Default salt length is 16 bytes (providers can
  override)
• Uses RNGCryptoServiceProvider (not Random) to
  decrease likelihood of repeated salt values
• Salt combined with value, then hashed
• Salt and hash are returned by CreateHash
• CompareHash extracts salt and uses it to compute
  comparison hash
• No worries the application block takes care of
  all this for you!

30
Configuring a Symmetric Encryption Provider

• Using the Configuration Console

31
Symmetric Key Creation

• Generate creates key of appropriate length for
  algorithm provider
• Displayed as hex string value
• Import allows you to use an existing key

32
Key Storage

• Failing to secure encryption keys is one of the
  most common mistakes made when using cryptography
• Use the following techniques to help prevent key
  storage vulnerabilities
• Use DPAPI to avoid key management
• Do not store keys in code
• Restrict access to persisted keys

Improving Web Application SecurityThreats and
Countermeasures Chapter 7 Building Secure
Assemblies http//msdn.microsoft.com/library/defau
lt.asp?url/library/en-us/dnnetsec/html/ThreatCoun
ter.asp
33
Symmetric Key Management

• Key is saved in securityCryptographyConfiguration.
  config file as Base 64 encoded string
• Protecting the config file
• File system access control
• Encrypting File System (EFS)
• The Configuration Console allows you to encrypt
  the config file using DPAPI

34
Exporting the Symmetric Key

• Saves the key to a text file
• If supplied, password is used to encrypt the
  exported key
• Protect your keys!

35
Using the DPAPI Provider

• Avoids key management (managed by operating
  system)
• User and machine mode
• Entropy is saved to config file

36
Encrypting a Secret

• Call EncryptSymmetric with the name of the
  provider and the value to be encrypted

• Dim encryptedString As String _
• Cryptographer.EncryptSymmetric(symmProvider,
  _
• 
  MySecret")

• Return value is Base 64 encoded string

"Iu3A8HVNSIcXMHWUc79DRALf5vwm9XTquE90kyfalvo"
37
Decrypting a Secret

• Call DecryptSymmetric with the name of the
  provider and the value to be encrypted

• Dim decryptedString As String _
• Cryptographer.DecryptSymmetric(symmProvider,
  _
• 
  encryptedString)

• Return value is unencrypted string

MySecret"
38
Common Cryptography Functionality

• Enterprise Library includes simple cryptography
  capability in a common assembly
• Not externally configurable
• Does not require Cryptography Application Block
  (it is used by the block)
• Allows Configuration Console to encrypt/decrypt
  configuration settings without requiring
  Cryptography Application Block

39
Storing Connection Strings

• Enterprise Library provides applied guidance
  through proven practices engineered in code
• Connection strings are managed through
  configuration with the Configuration Application
  Block
• With the default XML Storage Provider
• Connection strings are saved in the file
  dataConfiguration.config
• Configuration files are saved as plain text by
  default
• Enterprise Library includes the Cryptography
  Application Block which can be used to encrypt
  the connection string automatically
• In just 2 easy steps!

40
Securing Connection Strings

• The encryption configuration determines how the
  application block configuration will be encrypted

41
Step 1a Set Encryption Settings
42
Step 1b Set Encryption Settings
43
Step 2 Mark the configuration section as
encrypted

• Whether to encrypt configuration information is
  determined by each application blocks
  configuration settings

44
Key Extensibility Points

• Custom hash provider
• Custom symmetric encryption provider
• Plus
• Anything and everything you have the source
  code!
• Please post extensions and suggestions to the
  community
• http//workspaces.gotdotnet.com/entlib

45
Additional Resources

• Improving Web Application Security
• http//msdn.microsoft.com/library/default.asp?url
  /library/en-us/dnnetsec/html/ThreatCounter.asp
• Improving .NET Application Performance and
  Scalability
• http//msdn.microsoft.com/library/default.asp?url
  /library/en-us/dnpag/html/scalenet.asp
• Application Architecture for .NET
• http//msdn.microsoft.com/library/default.asp?url
  /library/en-us/dnbda/html/distapp.asp
• PatternShare.org
• Enterprise Library Communityhttp//go.microsoft.c
  om/fwlink/?linkid39209clcid0x09
• www.ronjacobs.com
• Slides
• Tech Tips
• Podcasts

46
Announcing Enterprise Library 1.0

• http//www.microsoft.com/practices

Download it Today!
47
patterns practices Live!

• Slides, Hands On Labs, On Demand Webcasts
• Upcoming Live Webcasts
• 3/24 Enterprise Library Security Application
  Block
• 3/28 Building your own block
• 3/31 Enterprise Library Applied

http//www.pnplive.com
48
http//www.microsoft.com/practices