Rust Programming Language Rust Zürichsee, 11 Mar 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Encrypted File System for Applications by Stefan Schindler - Rust Zürisee Feb 2023

Description

How does one handle a secret with multiple keys?
Stefan presents us his master thesis where he solved that problem with his rust crate and built a basic virtual file-system that is fully encrypted and can be synced over multiple devices.

Follow/Hire Stefan: https://estada.ch/
Slides: https://github.com/rust-zurichsee/meetups/tree/master/2023-02-21_applied-cryptographics

-- Chapters --
00:00 Intro
01:11 Why encrypt in the application?
09:52 Master Key Management
18:55 File Content Encryption and Virtual FileSystem
27:01 Native Integration
35:27 Questions

Checkout our other videos: https://www.youtube.com/playlist?list=PL85XCvVPmGQipj690WrVgsnU4K4x7qFGy
Come to our events: https://www.meetup.com/Rust-Zurich/

A

In 2017.- and we did that mainly to organize fast Fest is currently in hibernation, I'll say it's a little bit complicated.

B

But there is a rust conference called.

A

Oerogast, which is similar and will be in October in Brussels, so if you want to go there, but almost it's nice, this talk is my master thesis. So I will indulge a little bit more because we're not that time restricted but yeah. It won't be too long. So for my record 1956- and you have to remind me to take a note of the time when you're done so I don't have our checking compress it for the defense.

A

Thank you. So why encrypt in the application? Like there's a lot of cryptography, there's a lot of systems that work we have looks on Linux. We have BitLocker on Windows, they have apples thing. It's called yeah Android uses X4 file, encryption works as well. Why do we need another one? All the the trouble is.

A

How do we manage it right? How do we manage it, independent from the operating system, or how do we deal with the fact that people who maybe switch their phone or lose it and for the Developers?

A

How hard is it to use BitLocker correctly, like how many group policies do you need to enable that phone I guess it's at least a two digit number, so a lot of fun also the backup a lot of the systems, especially the Google ones,.

B

They don't consider.

A

Backup they just sync to the cloud. So what kind of security companies do we need? Can we stop offline attackers just like the the first time someone steals my device and.

C

I'm lucky it's powered.

A

Off, can we prevent that answers? Yes, what if someone with three digitizers, something does something to my Hardware manipulates.

B

The filter can I trust the device, no.

A

B

A

What if someone installs new software like on the phone I, have to trust, Google or Apple, or whoever manufacturers tab? They can change the operating system. They can also inject code into any application, I install and actually it's a feature now, if you notice the Google feed, they have new features since last so spring, I think where they can press the applications depending on the end device. So Google know this device.

A

Is that specific configuration, so they throw out all the things that your application doesn't need, repackage it they can do whatever we can protect them so same with zero days.

A

It's basically as soon as someone has the hardware like before they're done. Is it a debugger yeah sure? Is it something else if.

C

We encrypt the memory.

A

Our application still leads to use that right. We still need to have the master key some time. Maybe it's protected some of the time, but we need to get access to it once we need it. So I have a conscious weight and then they get it. So it's just notification and it's annoying. You can piss off attackers, it might be fun but yeah.

A

C

What technology.

A

I don't know so.

C

A

Safety is really nice, so.

A

B

Very proud of this.

A

Forbid unsafe code, because.

C

In the beginning, I was like oh.

A

An implementing a file system, basically so I guess I- need to cheat sometimes but turns out. We can do that in a safe way, maybe a little bit slower, but it's safe.

A

Then we can upgrade all the software we use, so we can exchange with Article 2. We can replace AES, we charge our 20 and we don't have to sift through the endless amounts of is mode. We can just use poly 1305, and then we have the signature included in one step very nice, the professor that is running the Institute I'm with Hazard project called tikido, quick sidecar. It is an identity manager and they have the stars that they're, like okay facial recognition technology is coming.

A

We can't prevent it, there's lots of Bad actors, so they want to offer an alternative and say: okay, you want these mean features: okay, here's the way less intrusive than just scan the whole planet and then make a database every phase in the planet.

A

So, if you're into building security, digital is a thing where, when you walk up to a building, your device goes to the company and says: okay, my user is in front of building 15 now upload the.

C

A

And then the building will recognize a while you're there when you're at home. Your.

B

A

Is like I, don't know, 30 years, so the building won't recognize you. It's also nice. If someone hacks the building, if they just have one building, they have the facial data of the people that are at that time near that building or inside it. Everyone else is just like all right.

A

Should elaborate why I want to replace AES now yeah that's little dice, so there are two papers: I've read, one is actually quite old, it's from 2005 and it's from bierstein and he noticed stuff. If es is not accelerated in Hardware, then it relies on memory movement which relies on Cache lines, and then we know this latency difference between in register L1, L2, L3 memory, and with these differences we can extract the key it's been known since 2005 has been fixed mostly by running into the hardware.

A

Until last year. Her people noticed that with the latest microcode updates, there is time differences depending on the key and the input. So yeah ice is fine over the network. But if you have a shared virtual host, maybe tricky another.

C

A

It works with Xboxes and honestly, that's the opinion of as sort of part of as I do not fully understand. I can read it and then I'm like sure.

A

So why not have xor integer Edition shift with role and.

C

That's all the things I know it's.

A

Still a little bit magical but yeah it works. It works better. I can follow that more. So what about speed? We have in every device since at least 2010. We have a hardware accelerated, as how does it compare we're lucky so on the left, the first two chips: don't have Hardware acceleration.

A

The last one has so back. In the day this was from 2008 I think it was half the speed, but it's still half a gigabit right. That's fine! Without any Hydro acceleration at a very faster active devices that don't happen. Granted that case has gone. Every device has a yes nowadays, but if we stay sound as over the next 20 years, maybe we'll just reallocate that silicon for something else.

A

B

Does matter there's.

A

A good chance that the modern accelerators will be more fpga-like or it can be.

C

A

Them at some point or your firmware can configure them so we'll see what the future breaks, but at least for chapter 20 speed is not the issue, because it's xor ads and shift.

B

A

So we're good CPUs can do it very well.

A

C

Made it through.

A

The first part: okay, praise yourself now, there's the crypto, you ready.

A

So I would like to keep the master key in bottom place. That's.

B

A

Possible exactly, but it can keep it in a few places as possible. Then I need to update the notes the number used ones, so you can use the type system for us to update that automatically. Who here knows about the drop trade.

A

Afternoon anymore,.

A

Who knows about this Factor from other languages?

A

B

It's basically the.

A

Same except you cannot call the drop as a function called it's a language feature and the drop function. That's in a standard library is literally an empty function that just absorbs the object into the scope and the scope runs the function, and then we can have references, update answers, call other functions automatically flash all the things to the disk since the device that will be running the software is most likely to be someone networked I will lock all the fields. So this is traditional file lock and there's a new thing called the rustics.

A

Even more okay rustics is an abstract lip C, like library that just implements all the system called buildups in Rust, it's very promising- and it's very fast- it's very nice to compile because we have full types. So it's not like the lip C crate, where it just have an orgy of constants, and if you want to do something with the file you have to know. Okay I can use these 50 constants, but not the 500 other ones.

A

So rustics makes that very nice, and you also safe already to do that's the drop rate. You can implement the trades for all your types.

A

So, as I promised the math in the first part, you have green and yellow green.

B

A

What we generate when we start a new air folder volume whatever and yellow, is the user input I calculated that we need 42 characters of user input should be very random or something equivalent? So if we want to have something that people can remember like a big sentence or a selection of I, don't know a couple verbs, then this needs to be longer, because the entropy depends on the input.

A

We need 32 bytes of input, 256 bits, that's the entropy strength we would like to have. If we use something longer, we can like paper, Keys they're.

B

A

That strong but they're wrong.

A

Now we generate the key slot by using argon2, and what article does it takes? Our input. I've just stretches it so of 256 bit minimum input length will generate twice as much if our input is longer because we use a less sophisticated scheme. Let's say we only use the digits just zero to nine.

A

We need a very longer input than 42 numbers, but we can still use the same function and it will generate a key that upholds the same guarantee that it has this strength of 256 bit once we have that we slice it into three parts: I'm sure you cannot read it. So it's just one two: three: we xor the first two slices with the generated, keys and store that and the last slice is our check value.

A

Because how do you know when you decrypt something that's supposed to be random, that you decrypted the right thing and the check value is not encrypted, but.

C

You can only get the correct.

A

Check value, if you have the correct impact and then there's all flows down here in blue all the things we store with me so far.

A

Yes, how do we reverse that so and glue again what we have stored user input? We.

B

Do the same thing, we take the input.

A

We generate our keys. Three salt is also stored, so we can just use that and then we have the check value from before this last slice. If it's wrong, you just don't use that key. We Loop through all the keys, if you can't find any user, doesn't know the input password or any of the important passwords. If.

B

We find one already. We.

A

Can xor and then we have the master key back? It's really neat.

A

It took me three attempts and uh three quarters over here to come up with this scheme. Yeah.

A

That's it questions.

A

So I validated this by the way by asking Philip jovanovic. He used to be with my professor, but now he's his own professor in University College in Longview and he said, looks good.

B

B

A

Sexy name it's very long, though uh I called it encrypted file, system, storage,.

A

Yeah I'm, not the marketing department.

A

There's another thing we need to do: we have this non-system. We keep updating all the time.

A

The master keynons is used for the index file, Every Time We Touch that we need to update that loss. Every time we add a files remove a file, maybe a trace or change any of the attributes. We need to update the notes. You don't have the other Keys. You just have this one key: that the user or the TPM or the Hardware security module, gave us and we have the new nodes and.

B

C

A

We don't even need to keep that around, because we just have the old nodes when we decrypted it and we have the new one, which is usually just plus one, and then we can Loop through the stored Keys, including our own. We don't need to know which one is our key. The.

C

A

C

A

So we have the temporary value and then xor is back with a new value and store it back. That's really neat. Don't.

C

A

A

And now you've heard it: let's wear some flowers took the picture this afternoon, isn't that nice.

A

B

A

How did the compute.

B

The the input length.

A

C

In complaints for the minimum of the 42, yes,.

A

It's a very complicated procedure called dry zots, so we have eight by eight bits in a byte but roughly six point, something, let's say six- that you can actually input with ASCII. So it's just 256 divided by 6, 45 8., no matches good guys to know so now we can use it now. We have our key management solved.

A

Okay, now we actually need to store the files and yeah Bernstein is on a lot of my things in the most of the crypto I use, and there is the ring crate. It's okay, it's clearly done by people that do a lot of math and not a lot of programming, but it works. It's reliable and the dogs are reasonable, so it has C and assembly code from boarding SSL. Anyone know that one. It's not safe. Well,.

A

Google considered it safe enough is.

C

That a good argument.

B

A

They thought of SSL, which is a plus and core quality, as we all know, I think the last really bad expert happened two weeks ago, so cute and here's the thing you don't use a whole lot of open, SSL or boring. At that point, we only use the very tried and true modern parts, and most of the exploits come down to weird parsers, that for some reason people still insist in writing in C and all that lyrics I mean if you export md4. Are you really that a little of a hacker?

A

Yes? So how can we do this? Let's go through it with hashmap easy. The left half is the path. Thank you and the right hand is stored info. So when we load up the storage, it could contain hundreds of megabytes of sales. We don't want to touch that until we have to so. We just load the index and do nothing until someone requests access to a thing that you can check. If it exists, we can load it.

A

The size that is reported is wrong. Ae Ade has padding for the Box Cipher and then attack. So we could say Okay an average we're about 12 times too long, it's not too bad, but if you really base your algorithm in file size, you actually have to load into this to know how long the file actually is.

A

But is that really the use case? Because this is intended.

C

A

Storing your picture, maybe a facial fingerprint, the driver sizes so not stuff that we need to know the exact length. Oh so it should be fine and, of course, every file, that's open. The backing. Storage is all locked. So if we have the directory or the share, which is the thing you can do with the system, but you don't need to have something like certain thing or rsync or whatever to Translate bubble. Thank you. Thank you very much.

A

C

Lock it if the share supports file, locking so sambar.

A

Nfs very good can have multiple instances running on the same thing they just lock and since lock exclusive, we can guarantee that what we read back is actually in the store. So there's no rewrite of over multiplying stuff makes design way easier, yeah profile loading on demand, and, of course, since we have to drop, we can automatically release the file into a Hospitality table.

A

So before we get into the native integration, I'd like to say the thing about how to handle files in the beginning, I was like yeah: okay, let's just use a pointer or an arc. Anyone know where Arts. So it's Atomic reference counting for the others. It's.

C

The thing that the.

A

Jvm does a default. It makes it a little hard because then it's read only so we needed mutex. So now we have a mutex per open file. That's annoying, so I moved all the mutexes up. Two, the.

B

A

Structure so I hope this is really good. This is a generated view of all the structs that are in the crane. Everything in blue is from the standard Library. Everything in gray and red font is from my library.

A

Everything black and white is from something else. Yeah, you see, there's not much else and of course there is a bug because it doesn't recognize these types correctly, but it's good enough. So what we do is crypto FS has mutex Arc and then the wheel takes is over there.

A

That goes to the live keys and then, if there is an open file, you get access to the actual file. This Arrow, this Arrow W file. This is 505 structure. All it does is lock the file and on the.

C

Other hand we have the secure file.

A

Handler- and this is uh also reference counted, also Atomic, but who knows week guys two three people before yes, so.

B

What's the problem with reference.

A

Counting objects, like the garbage collection program. If you have reference company, yes, service, weak, solves that problem, which.

C

Week we can tell this.

A

Is a strong reference versus this is a weak reference, so all we have to do is check the secure file. Handler with every access is our main crypto EFS. Still, there is not from there. If, yes continue. That's all there is the RAS guarantees that the backing memory will be around for as long as needed, but the drop will have been cold, so you cannot touch the memory and expect something reasonable from that, but it's sound also. Instead of battery now this.

B

A

Key ID that's running around: it's basically hiding a new end, a new 60 for it, and that's the beauty of this interaction as well. I have to talk to Android, which we'll talk about soon, so I don't have to copy a pointer and Care. Oh okay, I have to sample hide the implementation and moving memory back and forth. You know I just copy this end and that's the tag. It will be different from everyone. It starts at one I think or zero.

A

Just goes up every time you open a file, it goes up and up and up passing back and forth in super easy. So very nice classify all right back to the beauty, slides so native integration. That's the really big thing for the digital project and.

B

The biggest store.

C

Is mobile devices, especially.

A

Androids, so let's get into that, how do we do that? We have a build system, it's called Gradle. It was supposed to replace Maven, somehow still use the same payment. I, don't know. Okay, we need a native. We.

B

Need a native tool chain.

A

Rasta can bring that okay, we.

C

A

A

Is independent comes from COC plus plus very powerful, and then we.

C

A

The cotton runtime we need that for all the interactive stuff, so permissions and all the user. The application wants to store files. Where do you want it because in the latest, two Androids you, as the user, can choose where you store the data? Okay, also access to the fingerprint reader or facial ID or whatever your device supports all Java or quality interfaces. So we have to use that.

A

Who has worked with after writer knows how this will end.

A

Will it um yay it just worked or um I see the horror Okay so.

A

C

A

A very big system um it does stuff, sometimes it works. Sometimes the dogs are right. Sometimes it talks, just don't exist, yeah. So.

C

What are the the major problems that hit me? Anyone want to guess.

A

Okay, let's go on so I started the project in summer, the Android project and then I did it and had a working prototype in the second on Friday last week, I hoped Android student was like hey. You need to update.

A

Cool okay, I start a new default project, just nothing in it between empty activity enter the name, run, build phase yeah, because some part of Android decided that it needs a Gradle 7.6.

A

If you do that, not only in the files which you can't do to be fair, but.

B

You have to know that Google decided.

A

The infinite with stack that non-catch versions don't have the dot zero. At the end, why I mean why everything else is free numbers separated by two dots but the first one, not okay.

A

If you stumble over the UI long enough, then at some point you will find there is a drop down menu that lists all the things in the correct values, but yeah now I saved you a day of Google you're welcome.

A

Another thing is the fingerprint sensor, there's a very nice tutorial on how to verify that the user is present. That is very nice. It's like yeah, here's a snippet, here's a slipper they're, not consistent, because that's too easy, but you can see. Okay, that's the thing! That's the thing it works.

A

There's also method calls that you can put any smallish value into the auto security module and get it out, but there's no examples and I'm, not an expert on Android so doesn't work and, of course they are like oh yeah kotlin. This is really nice and it fixes all the problems of java.

A

But how do you generate the headers for cross compilation for ffi? The answer? Is you don't because a kotlin team has a lot uh I can't say that yeah, you haven't come around to writing that too, and the Java age tool has been discontinued and the Java C dot h, prompt is only for Java code because it's part of the Java compiler, the easiest way is just compile and see the error message go from there. Let the Linker guide you work surprisingly. Well, the other fun side. Note.

A

Look for the little ones in the function name because sometimes they insert the ones I, don't know what they mean but they're there, especially if you pass more than one.

C

String and suddenly.

A

One start appearing in your functionally. Don't know why the other thing is. Cmake is very, very plug-in friendly to the point where Android Studio has a compiled commands.json for every architecture, barrier that you could encounter on any Android feeding. So.

B

If you want to just tell.

A

Cme, hey here's my finished compiled Library just linked with it. It will tell you you cannot find it so.

A

Another thing is the glue crate: it needs the cross completion tool chain, so you can go to Ubuntu router, just install every tool set in your main system, uh sort of works or you can use the SDK tool chain, but that doesn't work because for some reason, the AR, so the archive repackage binary it's called differently depending on the architecture and it's just called AR yeah.

A

So you can fix that with a lot of siblings, which I did still didn't work and then I found cargo ndk. The auto detection is very broken, but you can get it to work. So this is the state I have compiled all the things now. I need to link them so that that's easy right experience, C, plus programs linking easy, yay or nay.

A

I see the horror uh and we have two more platforms to go, but I guess these are easy because you can just use proper rust code and don't do any weird stuff. Another fun side note is. You can use a virtual TPMS now Microsoft overstanding their cloud. Oh I mean it's their Cloud, it's their Hardware. It's 30 pm.

A

Means a lawyer.

B

That this is more secure than nothing, but.

B

A

Made it is that nice.

A

It's the policy so like over an hour from here very nice, there's a waterfall which we cannot see in this picture. You should go there, it's free, just walk up there very nice and that's it any questions.

A

The time thank you, it's 20 31, so 46 minutes or 45 Plus actually very good question. Yes, there we go I, think there's a second mic somewhere yeah.

A

A

We continue to generate a nice graph of your structure.

A

Yeah this one I wrote The Python script; okay,.

A

Initially, I wanted to use the suitable crate from the rust compiler, so the Elixir and whatnot and then turns out you need to have nightly and yeah and then I realized, I, don't need complex answers and if you use cargo format, your code is very easy to parse, like all the wheelchair cases are just gone, and then you only have to deal with like five different cases like public, create public, private and lifetime or low lifetime, and then yeah the price was created, generates Graphics graph, which is then just handed over to dot, which makes this PNG it's not great for zooming in, but for an overview.

A

B

Good enough, yes, sir, two questions uh rust until the beginning here uh number one: is you devoted a bit of time explaining how you will try to protect your.

C

Secrets in memory.

B

And in see on your system, you use a lot to ask the system. Please also this region out to some other storage capabilities. Is that something easy to reversed question two? You explain how the master key scheme Works. uh Is anyone considering trying to formalize it to running through program or some other uh formal verification system.

A

So the second one is easy to answer. Not me.

A

There is a chance that the another Master student or a grad student will be tasked with that. I say there is a chance. There are currently no plans, it uses a similar scheme than looks uses. It looks too actually that per version two, not one, but this one is not limited to Eight Keys, which is nice. So we can just add these. As long as we have storage uh the first question: how do we protect it in memory? So that's what operating system depending question on Linux we can try to Market some guaranteed an address.

A

We can't yeah on Mac OS. We can't on Windows we can, but the operating system can lie so yeah. I did not bother to do that. If.

B

A

To reverse engineer the binary I mean it's weird, it's open source, but they could.

A

You would probably find the memory location at some point, because the pattern is really easy right. It's guarded between an arc and the mutex, and then it's just the first field, so yeah, but you can attach a debugger to the process Okay. So.

A

I forgot to include the reference to uh um PhD thesis of one of my colleagues that does the try to prove that you can hide something and in the process he made the proof that you can't, and it just boils down to the thing at some point. You have a legitimate access path to the thing and then you can construct the legs as well.

A

Yes, another question: did you measure performance sure file rights? Not yet, but the tests are like within a second time so for small files, it's good enough and also I haven't turned on release mode. Yet so, oh yeah for all the new rust people. So when you say cargo run or test or something default is a compiles. Your binary with all the debug information. The target binder even includes the source code of your project, like all of it, so very nice for debugging. You can attach any here for your debuggers. You can step through.

A

um You cannot step back yet, although you can repeat the stack frame, so you can't restart functions so very nice when we turn that off and go into release mode internal optimization, throw away all the things we don't need usually gain a speed up of a factor of 20 sub times up to 400.

A

and if you do anything with graphics, for instance like a game or screen saver, or something it's very hard to develop, that in debug mode, so you just develop in release mode. The link time goes up quite a bit about the speed as well um once.

C

You're done with.

A

Development, you can turn on a link- type optimization, that's tripping, so we can enable another layer of optimization and stripping. We take out all the symbols that are not accessed or visible, and then the binary becomes small fast, so I had another application. It's a Memory collect anything when you run it in debug mode. The binary is almost 50 megabytes inside and just collect some stats. It doesn't feel and then outputs the promises text file when we enable all the optimization the binary goes down to 1.8 megabyte and it runs in zero milliseconds.

A

So I cannot time that anymore, so yeah so.

B

Speed up there will be a speed.

A

Up I have measure.