Skip to main content

Posts

Cryptographic Primitive III: RSA Asymmetric Keys

RSA cryptosystems involves, a private key (which is kept private) and a public key, which is kept public i.e. known to everyone. The security of RSA hinges on the mathematically difficult problem of finding prime factorization of a very large number. Let's quickly disuss how a public, private key pair can be generated, Let, p and q be two large primes, then $n = q \times q$ $\phi(n) = (p-1) \times (q-1)$ Here, $\phi(n)$ is called euler's totient function Choose a random number $e$ such that, $e \in \left\{0,1,2...\phi(n)-1\right\}$ and $gcd(e,\phi(n)) = 1$ The gcd condition will ensure that we have an inverse of $e$ in $\mathbb{Z}_{26}$. Now, using extended euclidian algorithm one can get the inverse of e as d such that, $d \equiv e \pmod{\phi(n)}$ So, there we have it, the private key is $e$ and the public key is $(n,d)$. Few points to note here are, $p$ and $q$ are both $\geq 2^{512}$, although the recommened size is $2^{1024}$ $n$ is $\geq 2^{1024}$, although the recommended...

Cryptography Primitive II: Feistel Network

 Feistel Networks are building blocks of many stream cipher notably DES, SwordFish etc, wherein one performs a fixed number of rounds of the feistel network, for both excryptopn and decrypton. Feistel Network The abbreviations are as follows, F: Round function K i : Subkey for round i L i : Left half of the intermediate value at round i, L 0 would be the left half of clear text. R i : Right half of the intermediate value at round i, R 0 would be the right half of clear text. Micheal Luby and Charles Rackoff proved that,  If the round function is a cryptographically secure pseudorandom function, then 3 rounds are sufficient to make the block cipher a pseudorandom permutation, while 4 rounds are sufficient to make it a "strong" pseudorandom permutation. Strong psuedorandom permutation means that it remains pseudorandom even to an adversary who gets oracle access to its inverse permutation. Note that in one round of a feistal network, only the left half of the cleartext is enc...

Cryptography Primitives 1: Merkel - Damgard Construction

 This is basically a basic building block for constructing a hash function based on Ralph Merkel's PhD thesis which basically states that,  if an appropriate padding scheme is used and the compression function is collision-resistant, then the hash function will also be collision-resistant Block Diagram for Merkel Damgard Construction Important things to consider, Padding IV Padding is basically a long string of 1 followed by as many number of 0s as required and ends with a binary representation of the message length. So to pad a message, 1001101, we pad it with 1001101[100000...00111], where the part inside square brackets are the padded bits.

Reliability and Availability Metrics and Calculations

For a complex software solution, you usually have to stick to customer requirements for reliability and availability as defined in the SLA. For a monolithic appliance, this could be trivially determined, but most real world applications requires multiple physical nodes, VM or machine. Extrapolating the reliability and availability figures for a complex multi-tier software system could pose a challenge to an IT practitioner who is not familiar with reliability engineering. So, let's dine right into it. Let's first define some key terms, MTTF: Mean Time To Failure aka 'Average time betwwen two failure of a non-reparable component'. MTBF: Mean Time Between Failure aka 'Average time between two failures of a reparable component'. MTTR: Mean Time To Repair aka 'Average time to repair a component'. Now, let's estabish the concept of failure rate (λ) as , $\lambda = \frac{1}{MTBF}$ or $    = \frac{1}{MTTF}$ The reliability function is defined as,  $R(t) = ...

Reset root password RHEL/Rocky/CentOS 9

Unlike the earlier versions of Rethat variants, version 9 doesn't allow single user mode to change password, as maintanance mode in 9 requires root password . Single user mode (runlevel 1) can easily be obtained by appending the word ' single ' at the end of the line starting with 'linux' by editing the entry in boot menu by pressing ' e ' at boot menu. To reset the root password on the other hand, one requires to follow a specific set of commands, At the boot menu, edit rescue mode to append 'rd.break ' at the end of the line starting with kernel. Boot with the edited line by pressing Ctrl+X or F10. At the new prompt starting with switch_root, type the following commands, mount -o remount, rw /sysroot chroot /sysroot touch /.autorelabel passwd <new root password> exit reboot       

Updating OSM data in PostgreSQL snapshot schema from latest pbf

Getting pbf files from Geofabrik and uploading them into your own datastore has been discussed in this blog earlier. In this blog, we are gonna see how to update the data, as OSM data changes every day by millions of controbutors worldwide.  It is important to preseve the most recent pbf file in your hard drive, as we'll see in further. The steps to be followed are the following, Download the latest pbf file as per your business requirement. Generate the changes between the last pbf and the earlier version. Apply the change to your PostgreSQL data store. Let's follow this with a concrete example,  Assuming the last pbf we have applied is, india-20220122.osm.pbf dated Jan, 22, 2022. Download the most recent india osm pbf file, india-latest.osm.pbf Generate the change-log in xml format, osmosis-0.48.0/bin/osmosis --read-pbf file="india-latest.osm.pbf" --read-pbf file="india-20220122.osm.pbf" --derive-change --write-xml-change file=inddiff.osc Aplpy the changes...

Opensteetmap Data Models

Opensteetmap is the crowdsourced mapping of the planet and can be accessed at https://opensteetmap.org The map data is freely downloadable and can be hosted locally for any purpose whatsoever under GPL license. Map data is downloadable in multiple archive formats like pbf  (Protocolbuffer Binary Format) and others. OSM's internal data model is represented as shown in the ER diagram above, but when it's imported from the PBF, it has to be efficient, fast and easy to use. Primarily, OSM databases can either be, Snapshot or  Historical Snapshot databases don't contain historical infromation (for instance, how a river changed it's course of the years or how landuse of a forested land changed over the year) whereas, Historical database contains this information. Naturally, historical databases are much more complex and requires more effort. Various parameters on how to judge various data stores are, Updatability Transactibility Concurrent Read/Writability Snapshot/Historical...

GoF Design Patterns

Design Patterns listed out in GoF  Creational Pattern Abstract Factory Builder Factory Method Prototype Singleton Structural Pattern Adaptor Bridge Composite Decorator Facade Flyweight Proxy Behavioral Pattern Chain of Resposibility Command Interpreter Iterator Mediator Momento Observer State Strategy Template Method Visitor

Secugen Hamster Fingerprint reader API cannot function without the device

For those who are familiar with Secugen Devices, might know that there are two function calls to initialize the device API.   The Init(long devName) and  The InitEx(long width, long height, long dpi) As per the official Javadoc, the first one is meant to " Initialize the SecuGen libraries using attached SecuGen fingerprint sensor. This method should be called after Open() is called."  while the second one is for " Initializes the SecuGen libraries using image parameters. Only 8bits per pixel raw images are supported."  For the same function, the C++ documentation says , "Use when running fingerprint algorithm module without a SecuGen reader." I had a use case wherein, I want to do the fingerprint verification/matching at server-side. This made me wonder if I can use the second initialization function at the server end without the device and use the fingerprint matching APIs. I tried using the aforementioned approach, but the InitEx() method was failing ...

PostgreSQL with SSL auth (Java client)

PostgreSQL Server 1. Generate certificates Download easyrsa2 from github and extract it   # ./easyrsa build-ca # ./easyrsa build-server-full postgresql-server # ./easyrsa build-client-full postgresql-client   This will generate ca.crt in pki folder, postgres-server.crt , postgres-client.crt in pki/issued folder and postgres-server.key and postgres-client.key in pki/private folder.   PostgreSQL JDBC library cannot read .key file, which is why we have to convert the key to DER format (.pk8) file.   openssl pkcs8 -topk8 -outform DER -in postgres-client.key -out postgres-client.key.pk8 -nocrypt    Give proper unix permissions to the certificates and keys, for eg.   # chown postgres:postgres postgres-server.key  # chown postgres:postgres postgres-server.crt # chmod go-r postgres-server.key     2. Edit postgresql.conf ssl = on          ssl_cert_file = '/opt/postgres-sec/postgres-server.crt...

Importing OSM (PBF file) to PostGIS (PGSNAPSHOT schema)

OSM Data can be used for variety of usecases like rendering, searching, data analytics etc. Each usecase yield quickest result in a particular data format. Due to the large volume of data, this can cause significant difference in the response times.  Some of these formats are, PBF  -- A highly compressed format used almost exclusively for storage and downloads owing to the small sizes. These format are not human readable and gzip compressed. PostgreSQL with PostGIS extension -- A data format backed up by PostgreSQL database. There are various schemas supported for multiple use cases which can greatly impact the response time as indexes and normalization are used to speed up queries. Some popular schemas along with their usecase and certain features are as below. The table is taken directly from openstreetmap wiki. Schema name Created with Used by Primary use case Updatable Geometries ( PostGIS ) Lossless hstore  columns Database osm2pgsql osm2pgsql Mapnik ,  Kothic...

Extend virtual disk size of a VDI image

BACK UP EVERYTHING BEFORE TRYING THIS. The entire process can be split into 4 stages. 1. Physically increasing the vdi file size on the host machine. This requires help from the hypervisor OEM. For VDI, which is a native VirtualBox image, we'll use VBoxManage. VBoxmanage modifyhd centos.vdi --resize 100000 If the above command doesn't work and throw an error about this feature not being implemented, you might try the following instead. Create a new disk with higher capacity VBoxManage clonemedium --existing 2. Resize the LVM. For this we'll use GParted to resize the image. Boot up a GParted live CD and resize the required LVM partition to suit your need. 3. Resize the LVM-2 Boot up the machine with the newly extended image and check df -h and fdisk -l. You'll see that the disk has indeed grown, but LVM hasn't. Use the following command to resize LVM to full size. pvresize /dev/sda2 (assuming your LVM partition is sda...

Multimaster replication with Symmetric DS

Symmetric DS is an awesome tool for trigger based replication whcih works for all major database vendors, including but not limited to PostgreSQL, MySQL, MSSQL, Oracle and many others. Symmetric-DS is a java application and can execute on any platform on whcih JRE is available including Windows and Linux. Trigger based replication, in constrast to disk based (eg. DRBD ) or transaction log file shipping based or statement based , works by registering triggers on DMLs and sending the data thus generated to remote machines. Another very popular trigger based DB replication tool is Slony . Symmetric-DS in addition to being database agnostic also supports multi-master replication (MMR). MMR usecase involves multiple database nodes, connected in a pool with DML updates coming from any of them. This is different from the normal master-slave replication, where slaves are not expected to generate any data events, and the sole authority of database is the master. MMR requirement causes d...

SSL cIpher suits and what they mean?

I'm sure you have wondered at all those cipher suits SSL supports and watched in wonder as to what the hell does all those weird abbreviation mean. To find out what all cipher suits your openssl installation supports try, $ openssl ciphers -v ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA384 ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA384 ECDHE-RSA-AES256-SHA    SSLv3 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA1 ECDHE-ECDSA-AES256-SHA  SSLv3 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA1 SRP-DSS-AES-256-CBC-SHA SSLv3 Kx=SRP      Au=DSS  Enc=AES(256)  Mac=SHA1 S...

RabbitMQ and SSL

RabbitMQ is an AMQP provider i.e. it can reliably queue, service and maintain messages according to a range of policies and parameters. By default, it listens to plain old TCP connections and sends and receives messages over plaintext. This feature just works "out of the box". For users who wish to use SSL over TCP aka TLS, it requires a bit more work on their part. First, let's create a bunch of certificates and sign them with our own CA. For this, we'll use easyrsa3 . Easyrsa is a CLI tool to create, sign and manage your own certification authorities. It's maintained by OpenVPN team. Download easyrsa using your native package manager i.e. yum or apt-get $cp -Rp /usr/share/easy-rsa ~/easy-rsa-3   $cd ~/easy-rsa-3 $./easyrsa init-pki $./easyrsa build-ca $./easyrsa build-server-full broker [nopass] $./easyrsa build-client-full client1 [nopass] This creates three entities (collection of private keys, public keys and certificates) for a CA, a s...

PC Power supply and hacks

For posterity and myself, I'm leaving some tips and tricks of PC Power Supply Unit (PSU) whcih is an SMPS (Switched Mode Power Supply). There are a variety of uses of a +12V, +5V and +3V DC power supply like lighting up an LED strip or powering a raspberry pi. There are various colored cables in a typical ATX 12V SMPS. I'll list out the various color lines and what they mean, Sr. No Cable color Number of cables in a PSU Use 1 Green exactly one (1) Wake up signal from motherboard. Pressing PC power button makes this signal carry wake up signal to PSU to start. Green needs to be touched with the any ground to make the SMPS start. For self-starting PSUs, green needs to be connected with one black all the time. 2 Blue exactly one (1) -12V 3 Purple exactly one (1) +5V standby. When power supply is on standby mode (not on by signalling green), this line can give 1-2 A current. 4 Gray exactly one (1) Power good signal. When PSU levels has reached specificati...

My Experience with Free SeedBoxes

More people are becoming more and more tech-savy, Internet content is increasing by the second into humongous proportions. Internet bandwidth from the days of dial-up modem (256 kbps) to ADSL (~2 Mbps) to Fiber (+10 Mbps) have increased the connect of people with Internet. Today, torrents form a large part of the traffic flowing through the Internet allowing people share music, open source softwares and literally everything under the sun. Along with torrents come the task of seeding etiquettes. Simply being a leecher is not encouraged in the torrent sharing community as you are supposed to keep the torrent healthy by sharing your 'bit', no pun intended. Keeping your desktop powered on all the time for seeding and leeching is not advisable for a variety of reasons including but not limited to Security: A seedbox will normally be out of the jurisdiction of your 'evil' state. Infact, you are not even installing a bittorrent client on your machine. So, no worries of l...

Simple python script for creating an image listing in HTML

Just a code snippet without any adieu... #!/usr/bin/python import sys, os foldername = sys.argv[1] file_list = os.listdir(foldername) file_list.sort() output = "<html><body>" for file in file_list: output += "<img width='100%' src='" + foldername + os.path.sep + file + "'></img>" print output Simply redirect the output to a file with a .html extension and open the html file in browser.