[Interest] Integrate crypto in Qt project

Mon Jan 8 12:05:16 CET 2018

Thx for your feedback,

Don't worry I won't even imagine using some unknown third party code for
crypto in production code.

Since yesterday I've continued studying my case and my problem is that I'm
bounded to a specific format: I'm trying to implement some map (S63 format)
decryption.

This format is using
- blowfish as encryption/decryption method => so no real choice here for
me, but you are right I will use openssl instead of some other code for this
- DSA keys and signature are provided in plain text format (see below), so
my main concerne is to build the key or signature with those data in order
to launch DSA verify command. I'm now thinking of manually building the
data in DER/ASN.1 format but if I can do things directly it would be better.

Exemple of files:

Public key:
// Big p
C16C BAD3 4D47 5EC5 3966 95D6 94BC 8BC4 7E59 8E23 B5A9 D7C5 CEC8 2D65 B682
7D44 E953 7848 4730 C0BF F1F4 CB56 F47C 6E51 054B E892 00F3 0D43 DC4F EF96
24D4 665B.
// Big q
B7B8 10B5 8C09 34F6 4287 8F36 0B96 D7CC 26B5 3E4D.
// Big g
4C53 C726 BDBF BBA6 549D 7E73 1939 C6C9 3A86 9A27 C5DB 17BA 3CAC 589D 7B3E
003F A735 F290 CFD0 7A3E F10F 3515 5F1A 2EF7 0335 AF7B 6A52 11A1 1035 18FB
A44E 9718.
// Big y
063A C955 F639 B2F9 202E 070C 4A10 E82F 877A BC7F D928 D5F4 55C2 A3BF E928
92C5 9EB5 5DB0 ED6A 9555 ED8F 1C6E F218 DB62 FFFD F74E 5755 A989 44C7 6B50
9C41 B022.

Signature file:
// Signature part R:
3E94 FA3E 4600 B649 BC0A 3861 CB5E DC43 D34E D3A9.
// Signature part S:
A1E5 A1CF 54AC C380 CF8B FCFD 3A70 A1FE D761 2E59.
// Signature part R:
630A 2ADC 91FA AD4C 0B94 5B0C FE26 491E 29C6 0919.
// Signature part S:
097C 0019 403F E828 7326 4697 2FB2 D3F4 2621 9CD3.
// Big p
C16C BAD3 4D47 5EC5 3966 95D6 94BC 8BC4 7E59 8E23 B5A9 D7C5 CEC8 2D65 B682
7D44 E953 7848 4730 C0BF F1F4 CB56 F47C 6E51 054B E892 00F3 0D43 DC4F EF96
24D4 665B.
// Big q
B7B8 10B5 8C09 34F6 4287 8F36 0B96 D7CC 26B5 3E4D.
// Big g
4C53 C726 BDBF BBA6 549D 7E73 1939 C6C9 3A86 9A27 C5DB 17BA 3CAC 589D 7B3E
003F A735 F290 CFD0 7A3E F10F 3515 5F1A 2EF7 0335 AF7B 6A52 11A1 1035 18FB
A44E 9718.
// Big y
063A C955 F639 B2F9 202E 070C 4A10 E82F 877A BC7F D928 D5F4 55C2 A3BF E928
92C5 9EB5 5DB0 ED6A 9555 ED8F 1C6E F218 DB62 FFFD F74E 5755 A989 44C7 6B50
9C41 B022.

Thx,

Christophe

2018-01-08 11:27 GMT+01:00 Konrad Rosenbaum <konrad at silmor.de>:

> Hi,
>
> DON'T RUN YOUR OWN CUSTOM CRYPTO!
> [sorry for shouting, but this is kind of important]
>
> If you followed any IT news for the last year or so you know that it is
> incredibly easy to mess up. Even if you are an expert.
>
> I'm sorry to say, you do not seem to be an expert, otherwise you'd know a
> lot of crypto libs already. So stay clear of low-level functions. At least
> for the moment.
>
> On Sun, January 7, 2018 19:00, Christophe Thomas wrote:
> > I'm working on a projects that needs to integrate following crypto
> > functions:
> > - validate signature
>
> If you have a choice of signature type: use GnuPG as an external process.
> There is even libGpgME to make it easier to call and parse the output.
>
> Otherwise: what kind of signature is it? What standard does it implement?
> The answer to this will tell you which tool to use.
>
> > - compute hash ==> I found QCryptographiqueHash
>
> If it is just as a simple checksum (testing against accidental
> corruption): yes, QCryptographicHash is fine. Use one of the more modern
> hashes (SHA2 or SHA3 family).
>
> If you need to protect against attackers: use GnuPG signatures.
>
> > - manage certificate ==> I found QSslCertificate
>
> It is the right class, but:
> What exactly is the purpose of not using default certificates in your case?
>
> > - do some decryption/encryption using blowfish ==> I found some simple
> C++
> > implementation that I've added to my project
>
> Please don't.
>
> Use GnuPG for encryption. It is safe, proven, reliable. Anything you
> implement yourself is bound to be broken, even if it uses secure cyphers -
> as a non-expert you always forget to get one of the cryptographic
> primitives absolutely correct (e.g. did you know the clock is an important
> cryptographic entity? How secure is your random number generator?).
>
> > So I'm blocked on the first subject. I have to admit that I'm not
> > mastering
> > crypto subjects. What I understand:
> > - I have 3 data:
> > * a signature => (I only have 2 data named R & S)
> > * a hash of data (SHA1)
> > * a public key (p, g, g, y=pub data)
> > - I should use DSA
> > - I will get a Correct / Not Correct answer
>
> For your current project: use proven external tools and libraries. Do not
> implement the cypto yourself on any level!
>
> For your education: I suggest "Applied Cryptography" - it's a bit big, but
> a good read and written by one of the foremost experts in this field. Do
> not expect to be an expert after you read it! This takes longer.
>
> > Any hint on what to use? dive into openssl api ? use QCA project (
> > https://github.com/highfidelity/qca) ?
>
> For education? Yes.
>
> Just note that QCA is very low-level. OpenSSL is merely confusing. You may
> want to use GnuTLS instead - the API is easier.
>
> For everyday, productive projects? Hell no! Use complete tools and
> libraries:
>
> Encrypting and signing files or other static blobs: GnuPG.
>
> Online communication: use QSSLSocket - it is a very nice and easy to use
> wrapper around OpenSSL - unfortunately the direct OpenSSL API is easier to
> use incorrectly than to use correctly.
>
> Calculating checksums: QCryptographicHash is fine in most cases; if you
> need to protect against potential attackers use GnuPG instead (or in
> addition once you know how it works properly).
>
>
>    Konrad
>
> _______________________________________________
> Interest mailing list
> Interest at qt-project.org
> http://lists.qt-project.org/mailman/listinfo/interest
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.qt-project.org/pipermail/interest/attachments/20180108/ed63ca26/attachment.html>