Mobiconf 2018: Marcin Krzyzanowski, PSPDFKit GmbH
summary
CryptoSwift issues show most defects are dependency or platform mismatches (about 50%) and only ~10% are real crypto bugs. Common concrete mistakes: treating ciphertext as UTF‑8 instead of encoding with base64/hex, using AES‑CBC with CBC with null IV (default null IV in CommonCrypto breaks security), and using passwords without a KDF. Demonstrations include a padding‑oracle decryption (POODLE‑style) and interoperability quirks between OpenSSL, crypto‑js and platform libraries. Recommendation: use vetted primitives and protocols, not ad‑hoc constructions.
AI-written summary · about
chapters (7)
- 0:00Start
- 3:08CRYPTOSWIFT
- 18:24CIPHER MODE Stream Block
- 26:34PADDING ORACLE ATTACK
- 33:47KEY DERIVATION FUNCTIONS
- 35:12MAC MESSAGE AUTHENTICATION CODE
- 35:22MESSAGE AUTHENTICATION CODE ALSO KNOWN AS
related talks
47mWhy? Because I can - the stories from the crypt(ography)
01h 01mBroken crypto is broken
44mCryptography Pitfalls
40m 10 Things you Need to Know before Implementing Cryptography
54mBroken Crypto is Broken
18mCryptography in Swift
47mFootguns and factorisation: how to make users of your cryptographic library successful
42mBreak Crypto like a Pro!