Sunday, June 12, 2016

Private Keys in Blockchain Transactions

If we can answer the question "Where is private keys?" for a secure feature, we almost understand the security framework. How about the private keys in blockchain transactions?

A private key is used to derive a public key and to make a signature in a transaction. A wallet program can use the same private key for each transaction but it is not secure because it is easy to trace a user's behavior of transaction and it has a risk of being compromised.

Bitcoin Developer Guide states: "For both privacy and security, we encourage you to build your applications to avoid public key reuse and, when possible, to discourage users from reusing address."

Please image that there are 1000 different private keys generated if we have 1000 transactions. Do we need to store the all private keys? I consider the answer is No because the private key is useless after the transaction is finished. Therefore a wallet program can clean the unused private keys if it can generate a unique private key for each transaction.


Tuesday, March 15, 2016

The padding problem between Java Security and Windows CryptoAPI

If we use Windows CryptoAPI to encrypt plaintext with RSA to get ciphertext, the Java BadPaddingException exception happens when we use Java Security to decrypt the ciphertext with RSA.

We suppose that it is padding problem between Java Security and Windows CryptoAPI, but Windows CryptoAPI default uses PKCS1Padding in RSA, and our Java program uses Cipher.getInstance("RSA/ECB/PKCS1Padding"). Therefore both padding algorithms are same. Where is the problem?

The problem is, ciphertext encrypted by Windows CryptoAPI is little-endian, but Java Security consider ciphertext is big-endian. We can reverse ciphertext before calling RSA decrypt of Java Security.


Tuesday, March 1, 2016

Apple Watch Wrist Detection

If we enable password in Apple Watch, it will be locked when we take it off at 15th second in default. There are two cases of the lock scenario as the below picture.

Case A: The watch is initially worn and locked.

  • 0 sec: A user inputs password to unlock the watch.
  • 0 - 15 sec: The unlocked period is 15 seconds in default. The period can be specified on the watch. If the user clicks the watch in the period, the period will be reset.
  • 15+ sec: If the watch is worn, it is keep being unlocked (Case A), otherwise it locks itself (Case A.1).

Case B: The watch is not initially worn and locked.

  • 0 sec: A user inputs password to unlock the watch.
  • 15 sec: The watch locks itself at the time.

How does Apple Watch detects wrist? I suppose the mechanism is run by photodiode sensors not by G-sensor. There are two rules of wrist detection.

  1. Primary rule: Sensors detect distance between watch and wrist via infrared LEDs.
  2. Secondary rule: Sensors detect lighting change to determine locking.

The primary rule is easy to be proved. How about the secondary rule? I uses the 3 methods to cheat Apple Watch to keep wearing (unlocking) status.
  1. Shake a paper below the watch.
  2. Put watch on an iPad that is playing video.
  3. Put watch on a glass and shake a paper below the glass. 
Photo 1

Photo 2

Photo 3


Saturday, February 27, 2016

Connect MacBook to Ubuntu in Gen8 via AFP

The steps, referred to the page, of connecting MacBook to Ubuntu in Gen8 via AFP are as below.

1. Install AFP Server in Ubuntu
>sudo apt-get install netatalk
>sudo apt-get install avahi-daemon

2. Specify the config of Avahi
>sudo gedit /etc/avahi/services/afpd.service

<?xml version="1.0" standalone='no'?><!--*-nxml-*-->
<!DOCTYPE service-group SYSTEM "avahi-service.dtd">

<name replace-wildcards="yes">%h</name>




3. Specify the shared directories.
>sudo gedit /etc/netatalk/AppleVolumes.default

/home/your_home "your_home"
/media/your_hdd "your_hdd"

4. Restart the service

sudo service netatalk restart
sudo service avahi-daemon restart

5. Open MacOS Finder to connect the AFP server.

Input the IP address of the server. For example,


Then the shared directories will display. For example.



Tuesday, February 23, 2016

Why XOR can be a symmetric encryption and decryption?

Why does Bluetooth security use XOR as an operation of symmetric encryption and decryption? The formula of symmetric as follows.

C = Enc (P, K)
P = Dec (C, K)

C is cypher text.
P is plain text.
Enc is a symmetric encryption algorithm.
Dec is a symmetric decryption algorithm
K is a key of the encryption and decryption.

The true table of XOR is as follows.

0 0 0
0 1 1
1 0 1
1 1 0

C XOR B = (A XOR B) XOR B =  A XOR (B XOR B) = A XOR 0 = A

Therefore we got the formula.

Lets rename A to P (plain text), and B to K (key), and keep C (cipher).

Transform it.
C = XOR (P, K)
P = XOR (C, K)

We proof that XOR can be a symmetric encryption and decryption.


Wednesday, December 30, 2015

Chinese Text in XBMC Cannot Display on Mac OS

English is the default language in XBMC.

After you chose Language as Chinese (Traditional), the skin displays strangely. 

Please change Language back to English.
Go to Appearance - Settings, and change Fonts from Skin default to Arial based.

Then the Chinese skin displays.

Then you can install the Add-On, AtMovies Movie Scraper.


Tuesday, December 29, 2015

Use Java Security to read a certificate generated by OpenSSL

The following example uses Java Security to read a certificate that is generated by OpenSSL command and to verify the certificate with the public key that is also generated by OpenSSL command.

Generate a RSA-2048 private kay.
>openssl genrsa -out prv.pem 2048
>openssl rsa -in prv.pem -pubout > pub.pem

Convert public key portino in DER format (so Java can read it)
>openssl rsa -in prv.pem -pubout -outform DER -out pub.der

Convert private key to PKCS#8 format (so Java can read it).
>openssl pkcs8 -topk8 -inform PEM -outform DER -in prv.pem -out prv.der -nocrypt

Generate a CSR signed by prv.pem
>openssl req -new -key prv.pem -out test.csr
password 1234

Generate a certificate, signed by prv.pem, for the CSR.
>openssl x509 -req -days 365 -in test.csr -signkey prv.pem -sha1 -out test.cert
password 1234

Generate another RSA-2048 private kay.
>openssl genrsa -out prv2.pem 2048

Convert public key portion in DER format (so Java can read it)
>openssl rsa -in prv2.pem -pubout -outform DER -out pub2.der

Run the java program to read certificate and to verify it.
D:\Cyber Space\Examples\JavaSecurity

>java ReadCert

The portion Java program,, is as below.

// Read an X.509 certificate from "test.cert".

FileInputStream fis = new FileInputStream ("test.cert");
BufferedInputStream bis = new BufferedInputStream (fis);
CertificateFactory cf = CertificateFactory.getInstance ("X.509");
if (bis.available () == 0) {
    System.exit (0);

// Dump the certificate.
// cert = cf.generateCertificate (bis);
System.out.println (cert.toString());

// Get public key of the certificate.

PublicKey pub = cert.getPublicKey ();
System.out.println ("Get the public key of the certificate with " + pub.getEncoded().length + " bytes.");

// Verify the cert with public key (pub).

System.out.println ("Verify the certificate with the public key.");
try {
    cert.verify (pub);
catch (Exception e) {
    System.out.println ("Exception.");

// Read public key (pub2) from the file (pub.der).

File f = new File ("pub.der");
fis = new FileInputStream (f);
DataInputStream dis = new DataInputStream (fis);
byte [] pubBlob = new byte [(int) f.length()];
System.out.println ("pubBlob.length = " + pubBlob.length);
dis.readFully (pubBlob);
KeyFactory keyFactory = KeyFactory.getInstance("RSA");
PublicKey pub2 = keyFactory.generatePublic(new X509EncodedKeySpec (pubBlob));
System.out.println ("Get the public key, pub2, from the file with " + pub2.getEncoded().length + " bytes.");

// Check if pub and pub2 are same.
// They should be same.

if (pub.equals (pub2)) {
    System.out.println ("pub and pub2 are same.");
} else {
    System.out.println ("pub and pub2 are different.");        

// Read another public key (pub3) from the file (pub2.der).

f = new File ("pub2.der");
fis = new FileInputStream (f);
dis = new DataInputStream (fis);
byte [] pub2Blob = new byte [(int) f.length()];
dis.readFully (pub2Blob);
keyFactory = KeyFactory.getInstance("RSA");
PublicKey pub3 = keyFactory.generatePublic(new X509EncodedKeySpec (pub2Blob));
System.out.println ("Get the public key, pub3, from the file with " + pub3.getEncoded().length + " bytes.");

// Verify the certificate with the public key (pub3).
// The verification should be failed.

System.out.println ("Verify the certificate with the public key, pub3.");
try {
    cert.verify (pub3);
catch (Exception e) {
    System.out.println ("Error. An exception occurs. The result is expected.");