nelsonic/learn-crypto

A simple introduction to crypto for people who JavaScript.

Learn Crypto

> GOTO: https://github.com/dwyl/learn-cryptography

Cryptography is a fascinating topic worthy of many fantastic books! see: http://amzn.to/cthr46

Password Hashing

"* Speed is exactly what you don’t want in a password hash function*." ~ Thomas Ptacek

Using bcrypt means there is a "work factor" for computing the hash of each password. Each increment in work-factor (beyond 8) roughly doubles the amount of time required to compute the hash.

bcrypt time required to derive hash

// "cost" | ms required
{
'1' : '27ms',
'2' : '27ms',
'3' : '27ms',
'4' : '27ms',
'5' : '28ms',
'6' : '28ms',
'7' : '28ms',
'8' : '32ms',
'9' : '65ms',
'10': '120ms',
'11': '226ms',
'12': '447ms',  // sweet spot for web apps (page/API response under 1 sec)
'13': '914ms',
'14': '1810ms',
'15': '3673ms',
'16': '7634ms',
'17': '15449ms',
'18': '28531ms',
'19': '51857ms',
'20': '98165ms' // 98 seconds
}

Node.js Modules

• Core Crypto: http://nodejs.org/api/crypto.html
• bcrypt: https://www.npmjs.com/package/bcrypt
• *bcrypt.js: https://github.com/dcodeIO/bcrypt.js
• scrypt: https://www.npmjs.com/package/scrypt
• js-scrypt: https://www.npmjs.com/package/js-scrypt (mostly borrowed from: https://code.google.com/p/javascript-bcrypt/)

Further Reading

This is a huge and fascinating topic, don't skip the background (general) reading if you are serious about understanding security!

General

• Basic Principals: http://www.thegeekstuff.com/2012/07/cryptography-basics/
• Comprehensive intro: http://www.ciphersbyritter.com/LEARNING.HTM
• CS255: Introduction to Cryptography (Stanford Course): https://crypto.stanford.edu/~dabo/cs255/
• Cryptography: An Introduction (3rd Edition Full Book PDF): http://www.cs.umd.edu/~waa/414-F11/IntroToCrypto.pdf

Passwords

• How To Safely Store A Password: http://codahale.com/how-to-safely-store-a-password/
• Securing Passwords: http://www.securityfocus.com/blogs/262

Background Reading

• Proof of Work: https://en.wikipedia.org/wiki/Proof-of-work_system
• Cryptographic hash function http://en.wikipedia.org/wiki/Cryptographic_hash_function
• Asymptotic analysis: http://en.wikipedia.org/wiki/Asymptotic_analysis
• Bcrypt: http://en.wikipedia.org/wiki/Bcrypt
• Blowfish: http://en.wikipedia.org/wiki/Blowfish_(cipher)
• Scrypt: https://en.wikipedia.org/wiki/Scrypt

Videos

• The Lazy Programmer's Guide to Secure Computing http://youtu.be/eL5o4PFuxTY?t=1m3s

learn-crypto's Issues

Read Matasano article on JS crypto

http://matasano.com/articles/javascript-cryptography/
need 20 mins to read & digest this...

Just how large is a 64-bit address?

http://cnx.org/contents/1f63fe3d-9c85-4516-8707-394c471c618b@2/Just_how_large_is_a_64-bit_add

Found a few more links to add...

• http://security.stackexchange.com/questions/5668/where-can-i-learn-cryptography-cryptanalysis-the-hard-way-without-going-to-scho
• https://www.schneier.com/crypto-gram/archives/1999/1015.html
• Self-Study Course in Block Cipher Cryptanalysis: https://www.schneier.com/paper-self-study.html

  https://www.schneier.com/paper-self-study.pdf

• Max Password Length: http://security.stackexchange.com/questions/39849/does-bcrypt-have-a-maximum-password-length
• How to hash long passwords with blowfish:
  http://stackoverflow.com/questions/16594613/how-to-hash-long-passwords-72-characters-with-blowfish/16597402#16597402
• Seven ways to screw up bcrypt: http://blog.ircmaxell.com/2012/12/seven-ways-to-screw-up-bcrypt.html

SHA hash on client then bcrypt on server?

This is how we did it @grpn (mostly because _internally_ someone refused to use https)
but apparently its does not make a difference: http://crypto.stackexchange.com/questions/6280/hashing-a-password-with-sha256-on-the-client-then-bcrypt-on-the-server

Stronger Encryption and Decryption

http://vancelucas.com/blog/stronger-encryption-and-decryption-in-node-js/

Add section on Secure Remote Password Protocol (SRPP)?

http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol

Update the link to the Coursera Crypto Course

https://www.coursera.org/course/crypto