Enterprise Library Cryptography Application Block

1. Enterprise LibraryCryptography Application Block Scott Densmore Software Design EngineerMicrosoft Tim Shakarian Software Design EngineerAvanade Ron JacobsProduct ManagerMicrosoft

2. Overview What you must know to use the block Defining your configuration Creating an instance of the cryptography provider object Executing the hash, encryption and decryption Getting beyond the surface Selecting the right option for cryptography For really advanced users Key extensibility points Agenda

3. D A D I A D I patterns & practicesArchitecture Guidance for the Enterprise ProvenBased on field experience Authoritative Offer the best advice availableAccurateTechnically validated and testedActionableProvide the steps to success RelevantAddress real-world problems based on customer scenarios Available online: http://www.microsoft.com/practices Books available: http://www.amazon.com/practices Patterns Application Blocks Reference Architectures Atomic solutions to recurring problems Sub-system-level guidance for common services System-level guidance for common customer scenarios D A D I D A D I A A D D I I Guides Guidance for broad horizontal topics such as security, performance, deployment and operations

4. Sound familiar? • Writing the same code over and over for the plumbing around cryptography (streams, initialization vectors, strings to byte array conversions, etc.) • Fretting over which algorithm to use in your application code, knowing that changing algorithms will force application code changes • Wrestling with how to manage cryptography keys

5. Poll: When it comes to Cryptography • [Live Meeting Multiple Choice Poll. Use Live Meeting > Edit Slide Properties... to edit.] • I have struggled with these issues • I know how to use System.Security.Cryptography • I know I need to do crypto but I worry about getting it right • What is cryptography?

6. Why Cryptography? • Confidentiality To ensure data remains private. Confidentiality is usually achieved using encryption. • Dataintegrity To ensure data is protected from accidental or deliberate (malicious) modification. • Authentication To assure that data originates from a particular party.

7. Cryptography Needs • A simple way of hashing data and comparing hashed values • A simple way of encrypting and decrypting data • The ability to encrypt information without using keys, for use on a single machine • The ability to write the same application code for different cryptography providers • An easy way to adjust and validate the cryptography configuration settings

8. Common Application Threats with Cryptography Countermeasures • Configuration Management • Retrieval of plaintext configuration secrets • Sensitive Data • Access to sensitive data in storage • Network eavesdropping • Data tampering • Session Management • Man in the middle attacks Improving Web Application SecurityThreats and Countermeasures Chapter 2 – Threats and Countermeasures http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/ThreatCounter.asp

9. Cryptography Threats and Countermeasures • Threat: Poor key generation or key management • Countermeasures • Use built-in encryption routines that include secure key management • Use strong random key generation functions and store the key in a restricted location • Encrypt the encryption key using DPAPI for added security • Expire keys regularly Improving Web Application SecurityThreats and Countermeasures Chapter 2 – Threats and Countermeasures http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/ThreatCounter.asp

10. Cryptography Threats and Countermeasures • Threat: Weak or custom encryption • Countermeasures • Do not develop your own custom algorithms • Use the proven cryptographic services provided by the platform • Stay informed about cracked algorithms and the techniques used to crack them Improving Web Application SecurityThreats and Countermeasures Chapter 2 – Threats and Countermeasures http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/ThreatCounter.asp

11. Cryptography Threats and Countermeasures • Threat: Checksum Spoofing • Do not rely on hashes to provide data integrity for messages sent over networks. Hashes such as Safe Hash Algorithm (SHA1) and Message Digest compression algorithm (MD5) can be intercepted and changed. • Countermeasures • Use a message authentication code (MAC) or hashed message authentication code (HMAC) Improving Web Application SecurityThreats and Countermeasures Chapter 2 – Threats and Countermeasures http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/ThreatCounter.asp

12. Cryptography Application Block • Provides a simplified approach to implementing common cryptography scenarios • Improve Security • Considers threats and countermeasures • Ease of use increases likelihood of adoption • Other application blocks designed to work with the Cryptography Application Block

13. Enterprise Library v1 Caching Exceptions Legend Security Data Access Logging Dependency Plug-in Crypto Configuration Config Tool

14. Implementing Crypto ...in 2 easy steps

15. Step 1: Define your configuration • You will need an app.config (or web.config) file for your application • Use the Enterprise Library Configuration tool to create the configuration for the Cryptography Application Block • Use a post-build step to copy config files to the runtime directory • See http://www.ronjacobs.com/TipPostBuild.htm

16. Step 2: Call the Appropriate Cryptography Method • Static method interface • Enterprise Library Cryptography Application Block uses the Plugin [Fowler] pattern to create providers. • // Encrypt using the named provider • string encyrptedValue = Cryptographer.EncryptSymmetric("symproviderName", "StringToEncrypt"); • // Generate a hash value using the named provider • string hashedValue = Cryptographer.CreateHash("hashprovider", "MySecret");

17. View/Application Share: Demonstration of Cryptography Block • [Live Meeting View/Application Share. Use Live Meeting > Edit Slide Properties... to edit.]

18. Going deeper... ...this is where it gets interesting

19. Threats and Countermeasures • Disclosure of Configuration Data • The most sensitive configuration data used by data access code is the database connection string. If a compromised connection string includes a user name and password, the consequences can be greater still. • Vulnerabilities • Use of SQL authentication, which requires credentials to be specified in the connection string • Embedded connection strings in code • Clear text connection strings in configuration files • Failure to encrypt a connection string • Countermeasures • Use Windows authentication so that connection strings do not contain credentials. • Encrypt the connection strings and restrict access to the encrypted data. Improving Web Application SecurityThreats and Countermeasures Chapter 14 – Building Secure Data Access http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/ThreatCounter.asp

20. Storing Secrets • Typical examples of secrets include: • SQL connection strings • Credentials used for SQL application roles • Fixed identities in Web.config • Process identity in Machine.config • Keys used to store data securely • SQL Server session state • Passwords used for Forms authentication against a database Building Secure ASP.NET Applications Chapter 8 – ASP.NET Security http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/secnetlpMSDN.asp

21. Options for Storing Secrets • Pick and choose from platform options • .NET cryptography classes • Data Protection API (DPAPI) • CAPICOM • Crypto API • Or use the Enterprise Library and the Cryptography Application Block for simplified and best practice use of the platform!

22. Encryption Algorithms • Selecting an Algorithm • Some encryption algorithms perform better than others while some provide stronger encryption. Typically, larger encryption key sizes increase security. • A Common Mistake • Developing your own encryption algorithms Improving Web Application SecurityThreats and Countermeasures Chapter 7 – Building Secure Assemblies http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/ThreatCounter.asp

23. Storing Passwords • For security reasons, you should not store passwords (clear text or encrypted) in the database. • You should avoid storing encrypted passwords because it raises key management issues — you can secure the password with encryption, but you then have to consider how to store the encryption key. If the key becomes compromised, an attacker can decrypt all the passwords within your data store. Building Secure ASP.NET Applications Chapter 8 – ASP.NET Security http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/secnetlpMSDN.asp

24. Store One-way Password Hashes (with Salt) • The preferred approach is to: • Store a one way hash of the password. Re-compute the hash when the password needs to be validated. • Combine the password hash with a salt value (a cryptographically strong random number). By combining the salt with the password hash, you mitigate the threat associated with dictionary attacks. Building Secure ASP.NET Applications Chapter 8 – ASP.NET Security http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/secnetlpMSDN.asp

25. Configuring the Hash Provider Using the Configuration Console

26. Configuring Hash Provider to use Salt Each provider has the option to use salt Salt value is generated by application block

27. Generating the Hash Call CreateHash with the name of the hash provider and the value to be hashed Dim hValue As String = Cryptographer.CreateHash("hashprovider", "MyValue") Sample hash result HCmamZDAnUkKRwULHNPeItrOyw4uC80qE2Zd6DZqm53A8uZb

28. Comparing Hash Values Call CompareHash with the name of the hash provider, comparison value, and the original hashed value boolean matched = Cryptographer.CompareHash("hashprovider", "MyValue“. hValue);

29. Salt Under the Covers Default salt length is 16 bytes (providers can override) Uses RNGCryptoServiceProvider (not Random) to decrease likelihood of repeated salt values Salt combined with value, then hashed Salt and hash are returned by CreateHash CompareHash extracts salt and uses it to compute comparison hash No worries: the application block takes care of all this for you!

30. Configuring a Symmetric Encryption Provider Using the Configuration Console

31. Symmetric Key Creation Generate creates key of appropriate length for algorithm provider Displayed as hex string value Import allows you to use an existing key

32. Key Storage • Failing to secure encryption keys is one of the most common mistakes made when using cryptography • Use the following techniques to help prevent key storage vulnerabilities: • Use DPAPI to avoid key management • Do not store keys in code • Restrict access to persisted keys Improving Web Application SecurityThreats and Countermeasures Chapter 7 – Building Secure Assemblies http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/ThreatCounter.asp

33. Symmetric Key Management • Key is saved in securityCryptographyConfiguration.config file as Base 64 encoded string • Protecting the config file • File system access control • Encrypting File System (EFS) • The Configuration Console allows you to encrypt the config file using DPAPI

34. Exporting the Symmetric Key Saves the key to a text file If supplied, password is used to encrypt the exported key Protect your keys!

35. Using the DPAPI Provider Avoids key management (managed by operating system) User and machine mode Entropy is saved to config file

36. Encrypting a Secret Call EncryptSymmetric with the name of the provider and the value to be encrypted Dim encryptedString As String = _ Cryptographer.EncryptSymmetric(“symmProvider”, _ “MySecret") Return value is Base 64 encoded string "Iu3A8HVNSIcXMHWUc79DRALf5vwm9XTquE90kyfalvo="

37. Decrypting a Secret Call DecryptSymmetric with the name of the provider and the value to be encrypted Dim decryptedString As String = _ Cryptographer.DecryptSymmetric(“symmProvider”, _ encryptedString) Return value is unencrypted string “MySecret"

38. Common Cryptography Functionality • Enterprise Library includes simple cryptography capability in a common assembly • Not externally configurable • Does not require Cryptography Application Block (it is used by the block) • Allows Configuration Console to encrypt/decrypt configuration settings without requiring Cryptography Application Block

39. Storing Connection Strings • Enterprise Library provides applied guidance through proven practices engineered in code • Connection strings are managed through configuration with the Configuration Application Block • With the default XML Storage Provider • Connection strings are saved in the file dataConfiguration.config • Configuration files are saved as plain text by default • Enterprise Library includes the Cryptography Application Block which can be used to encrypt the connection string automatically • In just 2 easy steps!

40. Securing Connection Strings • The encryption configuration determines how the application block configuration will be encrypted

41. Step 1a: Set Encryption Settings

42. Step 1b: Set Encryption Settings

43. Step 2: Mark the configuration section as encrypted • Whether to encrypt configuration information is determined by each application block’s configuration settings

44. Key Extensibility Points • Custom hash provider • Custom symmetric encryption provider • Plus… • Anything and everything – you have the source code! • Please post extensions and suggestions to the community • http://workspaces.gotdotnet.com/entlib

45. Additional Resources • Improving Web Application Security http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/ThreatCounter.asp • Improving .NET Application Performance and Scalability http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag/html/scalenet.asp • Application Architecture for .NET http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnbda/html/distapp.asp • PatternShare.org • Enterprise Library Communityhttp://go.microsoft.com/fwlink/?linkid=39209&clcid=0x09 • www.ronjacobs.com • Slides • Tech Tips • Podcasts

46. Announcing: Enterprise Library 1.0 Download it Today! http://www.microsoft.com/practices

47. patterns & practices Live! • Slides, Hands On Labs, On Demand Webcasts • Upcoming Live Webcasts • 3/24 Enterprise Library Security Application Block • 3/28 Building your own block • 3/31 Enterprise Library Applied http://www.pnplive.com

48. http://www.microsoft.com/practices