Archive | Trop sérieux

Protégé : RSA public key : Behind the scene

Cette publication est protégée par un mot de passe. Pour la voir, veuillez saisir votre mot de passe ci-dessous :

Posted in Boulot, CryptoSaisissez votre mot de passe pour accéder aux commentaires.

L’arme est d’Euler

A ceux qui auraient tendance à voir une référence à autre choses (20 % d’armée + 80 % d’air, par exemple) : Passez votre chemin !

En mathématiques, l’indicatrice d’Euler est une fonction de la théorie des nombres.

Elle intervient en mathématiques pures, à la fois en théorie des groupes, en théorie algébrique des nombres et en théorie analytique des nombres.

En mathématiques appliquées, à travers l’arithmétique modulaire, elle joue un rôle important en théorie de l’information et plus particulièrement en cryptologie.

La fonction indicatrice est aussi appelée fonction phi d’Euler ou simplement la fonction phi, car la lettre φ est communément utilisée pour la désigner.

Elle est nommée en l’honneur du mathématicien suisse Leonhard Euler (17071783) qui fut le premier à l’étudier.

Sommaire

  Définition et calcul explicite

  Définition et exemple

Plus formellement :

\begin{array}{ccccl}\varphi&:&\N^*&\longrightarrow&\N^*\\&&n&\longmapsto&\mathrm{card}(\{m\in\N^*~|~m\le n~\text{et}~m\text{ premier avec }n\}).\end{array}

Par exemple :

  • φ(8) = 4 car parmi les nombres de 1 à 8, seuls les quatre nombres 1, 3, 5 et 7 sont premiers avec 8,
  • φ(1) = 1 car 1 est premier avec lui-même (c’est le seul entier naturel qui vérifie cette propriété, si bien que, pour tout entier n > 1, on peut remplacer m ≤ n par m < n dans la définition ci-dessus de φ(n)).
  • φ(2) = 1.

  Premières propriétés

Articles détaillés : Groupe cyclique et Anneau Z/nZ.

Dans ce paragraphe, n désigne un entier strictement positif.

Cette propriété est démontrée dans le paragraphe Structure additive de l’article Anneau Z/nZ.

Cette propriété est démontrée dans le paragraphe Groupe des unités de l’article Anneau Z/nZ.

  • Si u et v sont deux entiers strictement positifs et premiers entre eux, alors φ(u.v)=φ(u).φ(v).

Une telle fonction est dite multiplicative. On peut démontrer cette propriété à partir du théorème des restes chinois pour les groupes, selon lequel le groupe cyclique (Z/(uv)Z,+) est isomorphe au produit (Z/uZ)×(Z/vZ). Un couple (x,y) de ce groupe produit est générateur si et seulement si x est générateur de Z/uZ et y est générateur de Z/vZ. Le nombre d’éléments générateurs du groupe produit est donc égal à φ(u).φ(v). L’isomorphisme montre que cette valeur est égale au nombre d’éléments générateurs du groupe Z/(uv)Z, ce qui démontre la formule recherchée.

  Calcul

La valeur de l’indicatrice d’Euler s’obtient par l’expression de n donnée par le théorème fondamental de l’arithmétique :

\mathrm{Si}\quad n=\prod_{i=1}^q p_i^{k_i}\quad \mathrm{alors} \quad \varphi (n)=\prod_{i=1}^q (p_i-1) p_i^{k_i-1} = n \prod_{i=1}^q {\left( 1- \frac{1}{p_i} \right) }
Dans la formule, pi désigne un nombre premier et ki un entier strictement positif.

En effet, le caractère multiplicatif de l’indicatrice d’Euler et une récurrence montrent que :

\varphi(n) = \prod_{i=1}^q \varphi(p_i^{k_i})
Il suffit alors de dénombrer le nombre d’entiers non premiers avec une puissance d’un nombre premier et plus petit que celui-ci pour remarquer que :

\forall i \in [1, q] \quad \varphi(p_i^{k_i})= p_i^{k_i} - p_i^{k_i - 1}=(p_i-1).p_i^{k_i-1}
Ce qui permet de conclure la démonstration.

  Autres propriétés

  Arithmétique modulaire

L’indicatrice d’Euler est une fonction essentielle de l’arithmétique modulaire, elle est à la base de résultats fondamentaux, à la fois en mathématiques pures et appliquées.

Cette propriété est une conséquence directe du calcul explicite de l’indicatrice.

La cryptologie utilise largement cette fonction. Le code RSA se fonde sur le théorème d’Euler, indiquant que si n est un entier strictement positif et a un entier premier avec n, alors aφ(n) ≡ 1 (mod n).

Une autre branche de la théorie de l’information utilise l’indicatrice : la théorie des codes. C’est les cas des codes correcteurs, et particulièrement des codes cycliques. Ce type de code se construit à l’aide de polynôme cyclotomique et le degré du polynôme cyclotomique Φn d’indice n à coefficients dans les entiers est égal à φ(n). Plus précisément, on dispose des égalités suivantes :

X^n-1 \ = \ \prod_{d\mid n} \Phi_d (X) \quad \mathrm{et} \ \mathrm{donc} \quad \sum_{d\mid n}\varphi(d)=n
La somme et le produit sont étendus à tous les diviseurs positifs d de n.

La formule d’inversion de Möbius permet d’inverser cette somme :

\varphi(n)=\sum_{d\mid n} d \mu(n/d)
Ici, μ désigne la fonction de Möbius usuelle définie sur l’ensemble des entiers strictement positifs, la démonstration est proposée dans l’article associé.

  Théorie analytique des nombres

Les deux fonctions génératices présentées ici sont des conséquences directes du fait que :

\sum_{d|n} \varphi(d) = n.

Une série de Dirichlet utilisant \varphi(n) est

\sum_{n=1}^{\infty} \frac{\varphi(n)}{n^s}=\frac{\zeta(s-1)}{\zeta(s)}.

qui est dérivé depuis :

 \zeta(s) \sum_{n=1}^\infty \frac{\varphi(n)}{n^s} = \sum_{n=1}^\infty \left(\sum_{d|n} \varphi(d)\right) \frac{1}{n^s} = \sum_{n=1}^\infty \frac{n}{n^s} = \zeta(s-1),

ou \zeta(s) est la fonction zêta de Riemann.

Une série de Lambert utilisant \varphi(n) est

\sum_{n=1}^{\infty} \frac{\varphi(n) q^n}{1-q^n}= \frac{q}{(1-q)^2}

qui converge pour |q|<1.

dérivé de :

\sum_{n=1}^{\infty} \frac{\varphi(n) q^n}{1-q^n} = \sum_{n=1}^{\infty} \varphi(n) \sum_{r\ge 1} q^{rn}

avec

 \sum_{k\ge 1} q^k \sum_{n|k} \varphi(n) = \sum_{k\ge 1} k q^k = \frac{q}{(1-q)^2}.

  Croissance de la fonction

La croissance de \varphi(n) comme une fonction de n est une question intéressante. La première impression que l’on a pour les petits n est que \varphi(n) doit être notablement plus petit que n, ce qui est quelque peu erroné. Asymptotiquement, nous avons

n^{1 - \epsilon} < \varphi(n) < n\,

pour n’importe quel \epsilon > 0\, et n > N(\epsilon)\, . En fait, si nous considérons

\frac {\varphi(n)}{n}\,

nous pouvons écrire, à partir de la formule précédente, sous forme de produit de facteurs

1 - p^{-1}\,

où les p sont des nombres premiers divisant n. Par conséquent les valeurs de n correspondantes aux valeurs particulièrement petites du rapport sont les n qui sont le produit d’un segment initial de la suite de tous les nombres premiers. À partir du théorème des nombres premiers il peut être montré qu’une constante ε dans la formule précédente peut par conséquent être remplacée par

C \frac{\log\log {n}}{{\log n}}\, .

  Les 99 premières valeurs de la fonction φ

  Les 100 premières valeurs de la fonction φ
\varphi(n) +0 +1 +2 +3 +4 +5 +6 +7 +8 +9
0+ 1 1 2 2 4 2 6 4 6
10+ 4 10 4 12 6 8 8 16 6 18
20+ 8 12 10 22 8 20 12 18 12 28
30+ 8 30 16 20 16 24 12 36 18 24
40+ 16 40 12 42 20 24 22 46 16 42
50+ 20 32 24 52 18 40 24 36 28 58
60+ 16 60 30 36 32 48 20 66 32 44
70+ 24 70 24 72 36 40 36 60 24 78
80+ 32 54 40 82 24 64 42 56 40 88
90+ 24 72 44 60 46 72 32 96 42 60

On observe que, excepté pour n = 1 ou 2, \varphi(n) est pair, propriété qui est générale. En effet, en notant  n=2^k \prod_{i=1}^q p_i^{k_i} avec les p_i impairs et q éventuellement nul (produit vide), on a :

 \varphi (n)=2^{k - 1} \prod_{i=1}^q (p_i-1) p_i^{k_i-1}
Or si n > 2, alors k > 1 ou q > 0. Dans un cas comme dans l’autre, on obtient bien que \varphi(n) est pair.

  Autres formules impliquant la fonction φ d’Euler

\;\varphi(n^m) = n^{m-1}\varphi(n) pour m\ge 1
\sum_{d \mid n} \frac{\mu^2(d)}{\varphi(d)} = \frac{n}{\varphi(n)}
\sum_{1\le k\le n \atop (k,n)=1}\!\!k = \frac{1}{2}n\varphi(n) pour \;n>1
\sum_{k=1}^n\varphi(k) = \frac{1}{2}\left(1+ \sum_{k=1}^n \mu(k)\left\lfloor\frac{n}{k}\right\rfloor^2\right)
\sum_{k=1}^n\frac{\varphi(k)}{k} = \sum_{k=1}^n\frac{\mu(k)}{k}\left\lfloor\frac{n}{k}\right\rfloor
\sum_{k=1}^n\frac{k}{\varphi(k)} = \mathcal{O}(n)
\sum_{k=1}^n\frac{1}{\varphi(k)} = \mathcal{O}(\log(n))

  Inégalités

Certaines inégalités impliquant la fonction \varphi(n) sont :

 \varphi(n) > \frac {n} {e^\gamma\; \log \log n + \frac {3} {\log \log n}} pour n > 2, où \gamma\, est la constante d’Euler,
 \varphi(n) \ge \sqrt{\frac {n} {2} } pour n > 0,

et

 \varphi(n) \ge \sqrt{n} pour n > 6.

Pour un nombre premier n, clairement \varphi(n) = n-1\,. Pour un nombre composé n, nous avons

 \varphi(n) \le n-\sqrt{n}

Pour tous les n>1  :

0<\frac{\varphi(n)}{n}<1

Pour un grand n aléatoire, ces bornes ne peuvent pas être encore améliorées, en effet :

\liminf \frac{\varphi(n)}{n}=0 \mbox{ et } \limsup \frac{\varphi(n)}{n}=1.

Une paire d’inégalités combinant la fonction \varphi et la fonction diviseur \sigma sont :

 \frac {6 n^2}{\pi^2} < \varphi(n) \sigma(n) < n^2 \mbox{ pour } n>1.

  Conjectures

  Voir aussi

© Copyright auteur(s) de Wikipédia – Cet article est sous licence CC BY-SA 3.0

Posted in Crypto0 commentaire

Mais pourquoi ma clé commence toujours par MIGf… ?

Read that f… RFC 1421 : Privacy Enhancement for Internet Electronic Mail

https://lapo.it/asn1js
https://docs.microsoft.com/en-us/windows/win32/seccertenroll/about-encoded-length-and-value-bytes
http://javadoc.iaik.tugraz.at/iaik_jce/current/iaik/x509/PublicKeyInfo.html

https://medium.com/@bn121rajesh/understanding-rsa-public-key-70d900b1033c

# Generate 1024 bit Private key
$ openssl genrsa -out myprivate.pem 1024# Separate the public part from the Private key file.
$ openssl rsa -in myprivate.pem -pubout > mypublic.pem# Display the contents of private key
$ cat myprivate.pem

—–BEGIN RSA PRIVATE KEY—–
MIICXQIBAAKBgQDRFNU++93aEvz3cV8LSUP9ib3iUxT7SufdVXcgVFK9M3BYzvro
A1uO/parFOJABTkNhTPPP/6mjrU2CPEZJ1zIkpaSNJrrhpp/rNMO9nyLYPGs9Mfd
BiWUPmHW5mY1oD0ye4my0tEsHOlgHC8AhA8OtiHr6IY0agXmH/y5YmSWbwIDAQAB
AoGAAj/IH3pUI6FqqTrF+/gYzCRsL4AXTLC8l8vwkR93GGPyRHJNjqtik8I3WrXJ
zUiBGZ0iNouIsL/+QQuNlGiw/c5i2X3nTntREDS9xs2M0x+MWD/5qI1sn0Qk0HNP
BbDczlvO8wXNFGIHiTiPVEawoeNwhMqJDyGcbsEOZp2pLokCQQDvlMBU6dOeOP9a
jnENFSlrvzNR0nugFeoGmfq6s4Czz2QtUd9baKqBfEBSdJskwFVHgxbFA1Dc7iFu
rJkoQEeFAkEA32j9ibSVryxLvWUZngKNwo2xE+wcYDAYVBMsYC3OBU3FXhVkFD06
ZVnJsY/4bd2VdQI+bI2KV99aHutMJG2WYwJABMn2ZjweTMVa5VZ/kAFiSJMT1Yjd
i7+kY+lkB6Na6T02BWnjixI2hkwThRJrn3pwufM2201Lqn7gEDRHA3T1eQJBAKZG
1RUNo6558HEo8vUIf4vCu33RaJkqkqDYmFmJHeISrQfGMfNiUrkmJ5iRR9w1ZExu
/Bj9C281XDTQ+Z3PNnMCQQCan+pvj0OZH6o0PAMJGBBwRECPpfZ6mUjwA2YD3g61
MHjtIYmKKGmn64Qs8zQ4mNEDboQqyaov3Ij/I6c0ZQlc
—–END RSA PRIVATE KEY—–

Privacy Enhanced Mail (PEM)

Privacy Enhanced Mail (PEM) is a Base64 encoded Distinguished Encoding Rules(DER)
PEM file is human readable as it uses 64 printable characters for encoding.
It is easy to share PEM file.

Display the contents of public key PEM file

# Display the contents of public key PEM file
$ cat mypublic.pem

—–BEGIN PUBLIC KEY—–
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDRFNU++93aEvz3cV8LSUP9ib3i
UxT7SufdVXcgVFK9M3BYzvroA1uO/parFOJABTkNhTPPP/6mjrU2CPEZJ1zIkpaS
NJrrhpp/rNMO9nyLYPGs9MfdBiWUPmHW5mY1oD0ye4my0tEsHOlgHC8AhA8OtiHr
6IY0agXmH/y5YmSWbwIDAQAB
—–END PUBLIC KEY—–

Distinguished Encoding Rules (DER) format of public key

DER is encoded in Type-Length-Value (TLV) format.
DER is in binary format for PEM file and follows certain structure for public key.

# Convert PEM file to DER format using openssl rsa
$ openssl rsa -pubin -inform PEM -in mypublic.pem -outform DER -out mypublic.der
# Dump the DER file in hex format.
$ xxd -g 1 -u mypublic.der | cut -c -57
00000000: 30 81 9F 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01
00000010: 05 00 03 81 8D 00 30 81 89 02 81 81 00 D1 14 D5
00000020: 3E FB DD DA 12 FC F7 71 5F 0B 49 43 FD 89 BD E2
00000030: 53 14 FB 4A E7 DD 55 77 20 54 52 BD 33 70 58 CE
00000040: FA E8 03 5B 8E FE 96 AB 14 E2 40 05 39 0D 85 33
00000050: CF 3F FE A6 8E B5 36 08 F1 19 27 5C C8 92 96 92
00000060: 34 9A EB 86 9A 7F AC D3 0E F6 7C 8B 60 F1 AC F4
00000070: C7 DD 06 25 94 3E 61 D6 E6 66 35 A0 3D 32 7B 89
00000080: B2 D2 D1 2C 1C E9 60 1C 2F 00 84 0F 0E B6 21 EB
00000090: E8 86 34 6A 05 E6 1F FC B9 62 64 96 6F 02 03 01
000000a0: 00 01

Structured DER file content

1:30 81 9F // Type: 30 (SEQUENCE) Length: 0x9F
2:| 30 0D // Type: 30 (SEQUENCE) Length: 0x0D
3:| | 06 09 // Type: 06 (OBJECT_IDENTIFIER) Length: 0x09
4:| | – 2A 86 48 // 9 bytes OID value. HEX encoding of
5:| | – 86 F7 0D // 1.2.840.113549.1.1.1
6:| | – 01 01 01
7:| | 05 00 // Type: 05 (NULL) Length: 0x00
8:| 03 81 8D // Type: 03 (BIT STRING) Length: 0x8D
9:| | – 00 // Number of unused bits in last content byte
10:| | 30 81 89 // Type: 30 (SEQUENCE) Length: 0x89
11:| | | 02 81 81 // Type: 02 (INTEGER) Length: 0x81
12:| | | – 00 // Leading ZERO of integer
13:| | | – D1 14 D5 3E FB DD DA 12 FC F7 71 5F 0B 49 43 FD
14:| | | – 89 BD E2 53 14 FB 4A E7 DD 55 77 20 54 52 BD 33
15:| | | – 70 58 CE FA E8 03 5B 8E FE 96 AB 14 E2 40 05 39
16:| | | – 0D 85 33 CF 3F FE A6 8E B5 36 08 F1 19 27 5C C8
17:| | | – 92 96 92 34 9A EB 86 9A 7F AC D3 0E F6 7C 8B 60
18:| | | – F1 AC F4 C7 DD 06 25 94 3E 61 D6 E6 66 35 A0 3D
19:| | | – 32 7B 89 B2 D2 D1 2C 1C E9 60 1C 2F 00 84 0F 0E
20:| | | – B6 21 EB E8 86 34 6A 05 E6 1F FC B9 62 64 96 6F
21:| | | 02 03 // Type: 02 (INTEGER) Length: 0x3
22:| | | – 01 00 01 // Public Exponent. Hex for 65537

DER file contains Object Identifier, Modulus and Public exponent in HEX format.

Lines 4, 5, 6 is the HEX encoding of OID.
Lines 13 to 20 is the modulus (n).
Line 22 is the public exponent.

Modulus and Public exponent from public key using openssl

# Get Modulus and Public exponent from public PEM file
$ openssl rsa -pubin -inform PEM -text -noout < mypublic.pemPublic-Key: (1024 bit) Modulus: 00:d1:14:d5:3e:fb:dd:da:12:fc:f7:71:5f:0b:49: 43:fd:89:bd:e2:53:14:fb:4a:e7:dd:55:77:20:54: 52:bd:33:70:58:ce:fa:e8:03:5b:8e:fe:96:ab:14: e2:40:05:39:0d:85:33:cf:3f:fe:a6:8e:b5:36:08: f1:19:27:5c:c8:92:96:92:34:9a:eb:86:9a:7f:ac: d3:0e:f6:7c:8b:60:f1:ac:f4:c7:dd:06:25:94:3e: 61:d6:e6:66:35:a0:3d:32:7b:89:b2:d2:d1:2c:1c: e9:60:1c:2f:00:84:0f:0e:b6:21:eb:e8:86:34:6a: 05:e6:1f:fc:b9:62:64:96:6f Exponent: 65537 (0x10001) Exponent and modulus printed by openssl rsa matches with the Public exponent and modulus from DER file content. OBJECT IDENTIFIER OID describes the object. It is a series of nodes separated by period. OID Value: 1.2.840.113549.1.1.1 OID description: Identifier for RSA encryption for use with Public Key Cryptosystem One defined by RSA Inc. OID Encoding: The first two nodes of the OID are encoded onto a single byte. The first node is multiplied by the decimal 40 and the result is added to the value of the second node. Node values less than or equal to 127 are encoded on one byte. Node values greater than or equal to 128 are encoded on multiple bytes. Bit 7 of all bytes except the rightmost byte is set to one. Bits 0 through 6 of each byte contains the encoded value. OID Encoding Example: Representing length in ASN.1 encoding If number of value bytes is < 128 then length is represented in 1 byte. In this case most significant bit is 0. (Ex:- Line 2, Line 3 in structured DER content above) If number of value bytes is >= 128 then length is represented in multiple bytes. Most significant bit (bit 7) of first byte is 1 indicating multiple byte length. Bits 0–6 represent number of subsequent bytes for length. (Ex:- Line 1, Line 4 in structured DER content above)

References

DER encoding of ASN.1 types (MSDN)
Public Key Info structure (Java doc)

Posted in Crypto, PKI, ICP, IGC1 Commentaire

Gestionnaires de mot de passe

Bien aimé cet article qui m’évitera de partir from scratch quand on me re-demandera mon avis sur le sujet.

Je le reprends donc ci-dessous intégralement en y intégrant mes commentaires afin que personne ne puisse penser qu’il puisse s’agir d’un abominable plagiat.

 

A couple of years ago, there was some debate over the usefulness of password managers. Some argue that password managers are a bad idea, because they create one vector of attack that can breach all of your online credentials. These concerns were hightened when OneLogin was subject to a major cyber attack on May 31st, 2017. From OneLogin:

“Our review has shown that a threat actor obtained access to a set of AWS keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US. Evidence shows the attack started on May 31, 2017 around 2 am PST. Through the AWS API, the actor created several instances in our infrastructure to do reconnaissance. OneLogin staff was alerted of unusual database activity around 9 am PST and within minutes shut down the affected instance as well as the AWS keys that were used to create it…

The threat actor was able to access database tables that contain information about users, apps, and various types of keys. While we encrypt certain sensitive data at rest, at this time we cannot rule out the possibility that the threat actor also obtained the ability to decrypt data. We are thus erring on the side of caution and recommending actions our customers should take, which we have already communicated to our customers.”

Troy Hunt of Have I Been Pwned fame argues that password managers are very necessary, you just need to choose a good one and practice good opsec (operational security) with your use of it. Keep in mind that he has an endorsement deal of some sort with 1Password, which is a password manager. But despite this possible conflict of interest, I think his advice is good:

“Your brain is a very bad password manager. It’s incapable of storing more than a couple of genuinely random strings of reasonable length (apologies if you’re a savant and I’ve unfairly characterised you in with the rest of our weak human brains). That leads to compromises. If you’re one of these people who says ‘I’ve got a formula that always gives me unique passwords that are strong,’ no you don’t, they probably aren’t and no they’re not. You’re making concessions on what we empirically know is best practice and you’re kidding yourself into thinking you aren’t. I’ve had this debate many times before and there’s dozens of comments raging backwards and forwards about this in my post on how the only secure password is the one you can’t remember.”

My friend John Opdenakker‍ also has good advice about password managers. He likes the password manager that’s built into Firefox. While you’re there, I recommend you check out the rest of his very informative blog. But without further ado, here’s some of what he has to say about password managers:

“The security of most browser’s built-in password managers is still inadequate. At the moment Firefox is the most secure. The built-in password managers of the discussed browsers and Google’s (cloud-based) password manager still can’t compete with the most third party password managers. Both when it comes to security and integration of necessary features.

If you want to use a built-in password manager Firefox is the best choice at the moment. If you want to use a cloud-based password manager I recommend you to do some research and choose a third-party password manager that is most suitable for you. If a password manager is nothing for you use a password book that you keep close to you.

Keep in mind that the goal is to create strong passwords and store them in a secure way. Which tool you use is irrelevant, as long as it supports you to reach that goal.”

And here’s my own general advice about password managers, in a nutshell:

  • Using a password manager is better than not using a password manager. So use one! We all have dozens or perhaps hundreds of credentials for various websites and online services these days. Writing them down in a book can be vulnerable if other people can have physical access to where you keep the book at work or at home. Plus that method encourages users to come up with their own passwords. User created passwords are almost always less secure than randomly generated passwords that a password manager can create. And if your list of passwords is digital, like a text file on your local hard drive or on the cloud as a note in Evernote or Google Keep, that’s cleartext that can be exposed in a cyber attack. If you encrypt a local file with your credentials, that’s still a hassle as you need to execute your text editor or word processor each time you need a password. And the method still encourages weaker user-generated passwords. Pretty much all password managers can generate a much more secure, random password for you.
  • Be careful with the opsec of the phone, tablet, and PC endpoints that you keep your password manager on. A password manager on your home or work PC should be in a user account with a password. (Damn it! Ha.) You don’t want your family members or coworkers to be able to access your password manager without your operating system user account behind a password. The same applies to mobile devices. You could lose sight of your phone or tablet, make sure your mobile endpoints with password managers are protected with a lockscreen. And have a “find my device” service set up in case you lose your phone or tablet– which is also often a means of two-factor authentication.
  • On that note, have two factor authentication set up on as many of your online accounts as possible!

Alright, now here’s a brief rundown of the different password managers you could use.

  • Google Chrome, Mozilla Firefox, Opera, Microsoft’s Edge, and Apple’s Safari all have built-in password managers in their most recent versions on PC and mobile devices. For convenience, you may want to use the built-in password manager in your favourite web browser. I don’t recommend Chrome these days due to Google’s tendency to profit from selling your data. Firefox’s, Opera’s, Edge’s, and Safari’s built-in password managers are all pretty good. I personally use Firefox’s password manager.
  • Third-party password managers, unlike the password managers built into web browsers, tend to not be freeware. But because they are maintained by entities that are separate from the web browser platforms, that separation may be good from a security perspective. Cyber attacks to Google, Mozilla, Apple, and Microsoft’s cloud servers may put their browser-stored credentials at risk while leaving the third-party password management platforms unscathed. And pretty much all third-party password managers have web browser plugins for most popular browsers on desktop and mobile. It also occurs to me that perhaps, by paying a fee rather than using freeware, they may have extra incentive to secure their credential storage. Here are some third-party password managers for you to consider:
  • 1Password has apps for macOS, iOS, Windows, Android, Linux, and Chrome OS, with 24/7 email support. Prices range from $2.99 to $7.99 per month, depending on your personal or business needs and they offer a 30 day free trial. Check it out here.
  • Bitwarden has apps for Windows, macOS, Linux, Android, and iOS, with web browser plugins for Chrome, Firefox, Opera, Microsoft Edge, Safari, Vivaldi, Brave, and Tor Browser. There’s a free version, plus subscription options from $1 to $5 per month depending on your personal or business needs. Check it out here.
  • Dashlane has apps for Windows, macOS, Linux, Android, and iOS. The free version can store up to 50 passwords, the paid version has Dark Web monitoring, a VPN, and unlimited password storage for $3.33 per month. Check it out here.

https://www.peerlyst.com/posts/so-you-need-a-password-manager-kimberly-crawley

Posted in Boulot, CyberDefense0 commentaire

RESTful API for the dummies

An Application Program Interface aka API is code that allows two software programs to communicate with each another. The API spells out the proper way for a developer to write some code requesting services from an operating system or other applications. In a web context, APIs allow communication between two webapps (or a web app and a client that is not always a brose) without any browser.

A RESTful API, also referred to as a RESTful web service, is an Application Program Interface that uses HTTP requests to GET, PUT, POST and DELETE data.

A RESTful API  is based on REpresentational State Transfer (REST) technology, an architectural style and approach to communications often used in web services development.

REST technology is generally preferred to the more robust Simple Object Access Protocol (SOAP) technology because REST leverages less bandwidth, making it more suitable for internet usage.

The REST used by browsers can be thought of as the language of the internet. With cloud use on the rise, APIs are emerging to expose web services. REST is a logical choice for building APIs that allow users to connect and interact with cloud services. RESTful APIs are used by such sites as Amazon, Google, LinkedIn and Twitter.

 

 

A la base, j’aimais bien cet article pour une partie de son contenu mais pas pour le plan de construction et comme j’avais besoin d’expliquer pourquoi certaines API ne respectaient pas les concepts REST, j’ai eu besoin de ré-écrire cette introduction.

Posted in Boulot, Clic, Trop sérieux0 commentaire

Protégé : Big data : Renault en a sous le capot (décryptage)

Cette publication est protégée par un mot de passe. Pour la voir, veuillez saisir votre mot de passe ci-dessous :

Posted in Trop sérieuxSaisissez votre mot de passe pour accéder aux commentaires.

How do I configure a Splunk Forwarder on Linux?


From Splunk Command Line Reference:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/AccessandusetheCLIonaremoteserver

Note: the CLI may ask you to authenticate – it’s asking for the LOCAL credentials, so if you haven’t changed the admin password on the forwarder, you should use admin/changeme

Steps for Installing/Configuring Linux forwarders:

Step 1: Download Splunk Universal Forwarder: http://www.splunk.com/download/universalforwarder (64bit package if applicable!). You will have to create an account to download any piece of Splunk software

Step 2: Install Forwarder

tar -xvf splunkforwarder-6.6.3-e21ee54bc796-Linux-x86_64.tgz -C /opt

It will install the splunk code in /opt/splunforwarder directory

Step 3: Enable boot-start/init script:

/opt/splunkforwarder/bin/splunk enable boot-start

(start splunk: /opt/splunkforwarder/splunk start)

Step 4: Enable Receiving input on the Index Server

Configure the Splunk Index Server to receive data, either in the manager:

  • using the web GUI : Manager -> sending and receiving -> configure receiving -> new
  • using the CLI: /opt/splunk/bin/splunk enable listen 9997
Enable receiving on Iddexer

Enable receiving on Iddexer

Where 9997 (default) is the receiving port for Splunk Forwarder connections

Step 5: Configure Forwarder connection to Index Server:

/opt/splunkforwarder/bin/splunk add forward-server hostname.domain:9997

(where hostname.domain is the fully qualified address or IP of the index server (like indexer.splunk.com), and 9997 is the receiving port you create on the Indexer

Step 6: Test Forwarder connection:

/opt/splunkforwarder/bin/splunk list forward-server

Step 7: Add Data:

/opt/splunkforwarder/bin/splunk add monitor /path/to/app/logs/ -index main -sourcetype %app%

Where

/path/to/app/logs/ is the path to application logs on the host that you want to bring into Splunk,
%app% is the name you want to associate with that type of data

This will create a file: inputs.conf in /opt/splunkforwarder/etc/apps/search/local/

— here is some documentation on inputs.conf: http://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf

Note: System logs in /var/log/ are covered in the configuration part of Step 7. If you have application logs in /var/log/*/

Step 8 (Optional): Install and Configure UNIX app on Indexer and nix forwarders:

On the Splunk Indexer, go to Apps -> Manage Apps -> Find more Apps Online -> Search for ‘Splunk App for Unix and Linux’ -> Install the « Splunk App for Unix and Linux’ Restart Splunk if prompted, Open UNIX app -> Configure

Once you’ve configured the UNIX app on the server, you’ll want to install the related Add-on: « Splunk Add-on for Unix and Linux » on the Universal Forwarder.

Go to http://apps.splunk.com/ and find the « Splunk Add-on for Unix and Linux » (Note you want the ADD-ON, not the APP – there is a big difference!).

Copy the contents of the Add-On zip file to the Universal Forwarder, in: /opt/splunkforwarder/etc/apps/.

If done correctly, you will have the directory « /opt/splunkforwarder/etc/apps/Splunk_TA_nix » and inside it will be a few directories along with a README & license files.

Restart the Splunk forwarder (/opt/splunkforwarder/bin/splunk restart)

Note: The data collected by the unix app is by default placed into a separate index called ‘os’ so it will not be searchable within splunk unless you either go through the UNIX app, or include the following in your search query: “index=os” or “index=os OR index=main” (don’t paste doublequotes).

You also will have to install sysstat if you want to monitor your server resources.

Step 9 (Optional): Customize UNIX app configuration on forwarders:

Look at inputs.conf in /opt/splunkforwarder/etc/apps/unix/local/ and /opt/splunkforwarder/etc/apps/unix/default/ The ~default/inputs. path shows what the app can do, but everything is disabled.

The ~local/inputs.conf shows what has been enabled – if you want to change polling intervals or disable certain scripts, make the changes in ~local/inputs.conf.

Step 10 (Optional): Configure File System Change Monitoring (for configuration files): http://docs.splunk.com/Documentation/Splunk/4.3.2/Data/Monitorchangestoyourfilesystem

 

Note that Splunk also has a centralized configuration management server called Deployment Server. This can be used to define server classes and push out specific apps and configurations to those classes. So you may want to have your production servers class have the unix app configured to execute those scripts listed in ~local/inputs at the default values, but maybe your QA servers only need a few of the full stack, and at longer polling intervals.

Using Deployment Server, you can configure these classes, configure the app once centrally, and push the appropriate app/configuration to the right systems.

Enjoy !

Need Help troubleshooting ?

Do the same on Microsoft Windows Platform : click, click, click …

Splunk official how-to on that part: http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Useforwardingagentstogetdata

Posted in Boulot, Splunk0 commentaire

Playing with Splunk and REST API

SPLUNK and REST API

SPLUNK and REST API

How to Stream Twitter into Splunk in 10 Simple Steps ?

January 8, 2014/in Splunk /by Discovered Intelligence

My Original Tweet

My Original Tweet

Many people talk about the need to index tweets from twitter into Splunk, that I figured I would write a post to explain just how easy it is.

Within 10 steps and a few minutes, you will be streaming real-time tweets into Splunk, with the fields all extracted and the twitter data fully searchable.

Assumptions

  1. Splunk is installed and running. If you don’t have Splunk, you can download it from http://splunk.com/download
  2. Splunk will run fine on your laptop for this exercise.
  3. You have a working Twitter account

The 10 Steps

1. Go to https://dev.twitter.com/ and log in with your twitter credentials

2. At the top right, click on “My applications”

3. Click on the “Create New App” button and complete the box for Name, Description and Website. You don’t need a callback URL for this exercise. Once you have completed these three fields, click on the “Create Your Twitter Application” button at the bottom of the screen.

4. Your application is now completed and we now need to generate the OAuth keys. You should see a series of tabs on the screen – click on the ‘API Keys’ tab. At the bottom of the screen when in the API Keys tab, click on the “Create my access token” button.

5. Wait about 30 seconds or so then click on the ‘Test OAuth‘ button at the top right of the screen. You should see all fields completed with cryptic codes. If you don’t, hit back, then click the ‘Test OAuth’ button again after another 30 seconds or so. Keep this page handy – we will need it in a couple of minutes.

6. Ok, now log into your Splunk environment search head, where we are going to install the free REST Api modular input application. Copy the following URL and replace mysplunkserver with whatever your splunk server name is, then click on the “Install Free” button.

Splunk REST Modular Input

Splunk REST Modular Input

https://mysplunkserver:8000/en-US/manager/search/apps/remote?q=rest+api.

If you are not using SSL/TLS, change it to http rather than https. You can alternatively install the application from the Splunk app store here: http://apps.splunk.com/app/1546/

7. Click on the button to “Restart Splunk” after installation of the app.

8. This app adds a new data input method to Splunk called REST. Once logged back into Splunk, click on “Settings” (top right) then “Data Inputs” from the Settings menu.

9.The Data Inputs screen will be displayed and you will see a new data input method called REST. Click on this link, then click on the “New” green button to bring up a new REST input configuration screen.

10. Ok, last step! We are going to complete the configuration details to get our Twitter data. I have only included the fields you need to configure and everything else can be left blank, unless you need to enter in a proxy to get out to the internet.
> REST API Input Name: Twitter (or whatever you want to call the feed)
> Endpoint URL: https://stream.twitter.com/1.1/statuses/filter.json
> HTTP Method: GET
> Authentication Type: oauth1
> OAUTH1 Client Key, Client Secret, Access Token, Access Token Secret: Complete from your Twitter Developer configuration screen in Step 5 above.
> URL Arguments: track=#bigdata,#splunk^stall_warnings=true
The above URL arguments are examples. In this case, I am selecting to bring in tweets that contain the hashtag of #bigdata and #splunk. I am using the ‘track’ streaming API parameter to do this. At this point, you should read here: https://dev.twitter.com/docs/streaming-apis/parameters#track. Also note, that if you want to track multiple keywords, these are separated by a comma. However, the REST API configuration screen expects a comma delimeter between key=value pairs. Notice that I have used a ^ delimiter instead, as I need to use commas for my track values.
> Response Type: json
> Streaming Request: Yes (ensure the box is checked)
> Request Timeout: 86400
Here we are setting the timeout to be 86400 seconds which is the number of seconds in a day. As long as you have at least one tweet come through per day, then you will be ok. If the timeout window is less than the amount of time between tweets streaming in, then the data input will timeout and not recover without re-enabling the input or I would imagine a Splunk restart.
> Delimeter: ^ (or whatever delimeter you used in the URL arguments field)
> Set Sourcetype: Manual
> Sourcetype: Tweets (or whatever sourcetype name you want)
> More Settings: Yes (check the box). Optionally provide a host name and an index you want the tweets to go into. The default index is main.Note: For reference, the above configuration is stored in etc/system/local/inputs.conf

This is what the final screen will look like. Hit the “Save” button when everything looks good.
twitter_finalstep10

Search the Tweets!

You are all done! After hitting save, the tweets should start coming in immediately. Assuming you used a sourcetype of twitter, you can now go to the search bar in Splunk and run this query:

sourcetype=twitter earliest=-1h

You should see data coming in. You will notice that Twitter includes a TON of fields with each tweet – it is quite awesome actually. All the usernames, hashtags, users in the tweets, URLs (even translated URLs) are all extracted and searchable.

Of course, the above does simplify things. You should definitely read the the Twitter API documentation properly.

Posted in Boulot, Splunk0 commentaire

Ca bouge à l’Etat-Major !

Le commandant de la cyberdéfense sera, au 1er septembre… un terrien : le général Olivier Bonnet de Paillerets.

Succédant au vice-amiral Arnaud Coustillière, le général de brigade Olivier Bonnet de Paillerets devient, au 1er septembre prochain, officier général commandant de la cyberdéfense à l’état-major des armées (EMA). Le décret du Président de la République du 30 juin, a été publié au journal officiel du 2 juillet.

Dans son discours à Rennes le 12 décembre 2016, l’ancien ministre de la défense Jean-Yves Le Drian avait annoncé la création d’un commandement spécialisé en cyberdéfense. Il a été créé par le décret du 4 mai dernier et l’arrêté du même jour.
Le nom précis de son commandant est « officier général commandant de la cyberdéfense », il est intégré à l’organigramme de l’État-Major des Armées et placé sous la responsabilité directe du chef d’état-major des armées (le CEMA, le général François Lecointre, élevé aux rang et appellation de général d’armée le 19 juillet 2017, lui même ancien Chef du cabinet militaire d’Emmanuel Macron).

Le premier titulaire du poste créé le 1er juillet 2011 fut le vice-amiral Arnaud Coustillière nommé depuis DGSIC (Directeur Général des Systèmes d’Information et de Communication) par décret du 2 août 2017 et qui pour le coup glane sa quatrième étoile et prend rang et appellation de Vice-Amiral d’Escadre.

C’est un officier général avec son propre état-major et des effectifs : 2 600 militaires et 600 experts de la DGA (à l’horizon 2019). Les investissements devraient passer de 150 à 440 millions d’euros. Des chiffres annoncés pour la Loi de programmation militaire actuelle (LPM 2014-2019), mais avant le changement de gouvernement et la polémique budgétaire récente.

Posted in CyberDefense0 commentaire

GDPR on the rise …

Is GDPR  the new spam TT ?

Is GDPR the new spam TT ?

New messages dealing with General Data Protection Regulation are flooding my mailbox today warning that countdown to GDPR enforcement has begun.

GDPR is approaching fast, but don’t panic you’ve still got some time to get compliant (25th of May, 2018).

General Data Protection Regulation (GDPR) proposed by the European Commission will strengthen and unify data protection for individuals within the European Union (EU), whilst addressing the export of personal data outside the EU.

The announcement of an agreement to finalize GDPR was made in December 2015 and following a vote by the EU parliament, the compliance deadline for GDPR was set for May 2018.

The GDPR requirements as well as the amount of internal collaboration that will be needed to address them means organizations need to plan for compliance now.

For editors and IT security consulting firms, it’s one more time the right event for shaking cash machine.

The primary objective of the GDPR is to give citizens back control of their personal data. Once GDPR takes effect it will harmonize previous and other data protection regulations throughout the EU.

Gemalto

Gemalto

If you are still unclear on the GDPR basics, Gemalto can help clarify your questions : Visit our GDPR resource centre now!

(article démo d’aggrégation de contenus externes)

Posted in Trop sérieux0 commentaire