Projects, Sandbox

Playing with WPF Canvas

Leave a comment

I need to put together some 2D-ish editing tools for some home project work I’m doing.

I’m still working my way through WPF panels and controls so that seems like a good place to go with this.

Tonight I’m probably just going to try to get some basic mouse controlled drawing going in this thing. A throw-away toy program with some limited functionality to get familiar with the functions here.

In the end I may very well look at using 3D functions (and perhaps not WPF) to make this happen. Being able to do full renders would allow for some nice effects but if the 2D WPF functions are click enough I may make do.

Cryptography, Daily Blog, Thoughts

Cybersecurity and Cryptography

Leave a comment

It has been a wild ride this last year.

I’ve gone from someone who pays attention to cryptography and cyber-security to developing network cybersecurity architecture.

I’m always up for a challenge and this one has been a big one. So far things have gone well though.

It certainly has kept me busy as the lack of blog posts or significant GitHub commits will show.

I’m not far more deeply aware of the inner details of:

  • TLS 1.2 and TLS 1.3
  • TLS pre-shared key algorithms
  • TLS 1.3 session resumption
  • AES implementation choices.
  • Cryptographic random number generation and primary entripy source selection (this last a work in progress)
  • Elliptic curve cipher suites for TLS
  • SSH/SFTP protocol details and security implications in there.
  • Modern password hashing algorithms (BCrypt, SCrypt and PBKDF2)
  • Lots and lots of trade-offs between security, performance, implementation time and cost.
  • X.509 certificate details and ways of creating, managing and distributing certificates. PKI both big and small.
  • Some fun with trusted platform modules.

A wild ride indeed and not over yet. If this all keeps coming together though it should lead to a very satisfying conclusion.

This has certainly added a lot of tools to my toolbox. I’m now much better equipped to deal with secure networking issues and implementation. Once thing with network cyber-security work is that there’s always one more detail that needs to be addressed.

I am hoping to free up some time on the home front to get back to some of my home VR software projects this fall. Still dithering on whether to buy a resharper license. I’ll probably pick up ‘cluster’ again and try to move that to a more complete state. Might also play with some smaller VR toy programs…tempted to put together a very small gravitational system simulator in room scale. We’ll see how all that goes. I really need to get back in touch with Malcolm and Sam and see how they’re doing.

Daily Blog

A bad Week for Computer Hardware

Leave a comment

One of the drives in my disk array just failed this morning. Seems like it has been a bad week for computer hardware here. More irritating at the moment as this is an array and the remaining three disks are keeping things running.

Next step will be locating the failed drive when the replacement arrives sometime in the coming week. The new boot drive helps as well since it has space for working files in the interim.

Last weekend I spent a couple days working through issues around my boot SSD as I worked to upgrade to a 2TB drive to make space for working files on the fast volume. I remain nervous that this machine may start seeing more failures as it gets older. For now it is still doing reasonably well.

Working from home makes my local systems that much more important. I’m doing quite a bit of prototyping that involves network activity. My work laptop can’t see anything local once the VPN is engaged so all of the things I could have done with a USB network adapter creating a small local network for experimental use are off the table when I’m home. I have more compute resources on my home network than I have at work so this isn’t a big issue…but when my local systems have problems that spills over.

Hoping this will get me past most of the problems and next week will be smoother.

Ideas, Software Process, Thoughts

Software Process

Leave a comment

I watched a few conference sessions talking about software process yesterday evening.

Agile

There was one discussion of agile that I really liked. I’ve seen quite a few parts of agile processes that I think add value but I’m not convinced that the overall processes map well to the sorts of large, embedded software projects that I’ve generally been involved with.

Technical Debt

Another session made some very good points related to dealing with technical debt. The presenter had some very interesting thoughts on using source code control system information to direct refactoring efforts. It makes sense that modules with significant complexity and lots of ‘touches’ are good candidates for clean-up. He also made the excellent point that attacking issue counts will focus everyone’s attention on the small, low risk, low reward items that can run down the count quickly. Dealing with a thousand minor naming issues will do little to improve tangible code quality. Addressing a single, large snarl of complex interactions may result in huge improvements. I long ago realized that uncritical use of metrics can derail a team faster than anything else.

Functional Programming

There was also a short functional programming session that seemed decent. It still didn’t address my biggest pain points with functional though.

He made a decent case for the merits and limitations of functional approaches. I tend to buy them for ‘business logic’ type work.

The place I run into trouble with functional (and to a less extent the JVM languages in general) relates to numerics work.

I’ve spent a chunk of time processing images and signals. I still don’t see how one can reasonably implement something like noise reduction or sharpening of a reasonable size image (say 5000 x 5000 RGB pixels) in a functional language. Immutable arrays would seem to leave the developer with a lose/lose/lose set of choices.

  • Direct approach – Process each pixel in series and create a new image array with the updated pixel. Repeat this 5000×5000 time, copying the array at each step.
    This obviously fails even in a garbage collected environment as the process of copying megabytes of data for each pixel update will kill you. It does mean that access to adjacent pixels should be reasonably fast as reads will be no different than in a procedural environment.
  • Partitioned Tree approach – Build your large array as a tree structure under the covers with (say) 32 elements per leaf node. This was the approach suggested by the presenter in the talk.
    This seems to be the worst of all possible worlds. Read access to each pixel requires traversing several levels of pointer indirection. If 32 pixels in a row are updated then we generate 31 ‘dead’ copies of the segment along the way. Locality of reference becomes a mess as adjacent items in the ‘array’ may be anywhere in memory.
  • Process and Reassemble approach – Run through the entire source image and generate a change list to be applied. Once you’ve finished with the image, generate a new array with all of the specified changes in place.
    This will potentially generate a list of tens of millions of update entries in memory. I’m also not sure how one implements the ‘create a new array based on this array with these updates’ in an immutable environment. I guess this is the bottom line of all of the functional coding I’ve run across…the functional environment seems to always assume that there is procedural ‘magic’ to make the ends meet. I suspect that the answer would involve writing the image processing primitives in a ‘real’ language and then exposing them as unitary operations on the functional side. This rather strongly suggests that functional languages will always be a specialty item and not the ‘main course’.

Daily Blog

Weekend Update with Blender and Unity

Leave a comment

Pushing forward with Blender 2.8 and unity with more detailed comments here.

Creative Things

Looking to be a varied and busy winter and spring. I’m hoping to move my unity and blender knowledge forward significantly. I want to get Cluster to a point where it is more a game and less a sand-box for VR experimentation.

Work

Work looks like it is going to be a wild ride as well as I step into a cyber-security role in a big way. I’ve got to finish defining the network and local security design for the product and generate sufficient documentation to convince the FDA that we’ve done our due diligence. Should be do-able but I’m expecting it to keep be very busy.

OpenSSL

I’m looking at getting a Visual Studio 2019 debug build of OpenSSL together locally as well so that I can look into some functionality that I want/need to understand better.

In particular, the ‘envelope’ functionality that provides encryption at rest with multiple access based on private key encryption of a one-time symmetric key could solve a variety of interesting problems.

I need windows (and ideally bcryptlib) based versions of this functionality that inter-operate with the OpenSSL version if possible. Being able to build some sample code and then step through with the visual studio debugger would help quite a bit.

Daily Blog

The End of One Year and the BeginniNG of Another

Leave a comment

The last year has been rather busy. Changing jobs, coming up to speed at Dräger, unity programming, motion capture and a variety of other pursuits.

Work

The last few months have been largely consumed by the tail end of my time at KMC Systems and coming up to speed at Dräger. I’m now stepping into a cyber-security role on our existing monitoring product. This is an area that I’ve had an interest in for some time but until recently the medical device world has largely tried to meet their security needs with an external firewall with little internal security on the protected network.

The customer base and FDA appear to be rapidly becoming far more aware of computer security issues. I tend to put the down to the rash of recent activity where medical data is encrypted by criminals and a payment demanded for release of the keys. This hits organizations in the pocket book and impacts patient care at the same time (much more visible to these organizations than leaks of personally identifying information). We have rapidly moved from a universe where computer security was viewed as a nuisance to one where it is seen as a requirement.

Much reading and research over the last few weeks to back-fill any gaps in my knowledge I’m aware of and locate tangible back-up for things I know but wasn’t able to back up with authoritative sources. I feel like I’m just about over the steep part of the learning curve now…so next bit of busy will be writing up what I’ve pulled together.

I miss the people I worked with at KMC but I’m much happier with the challenges I’m being presented with here than I was helping out with the tail end of Newton development. Now that I’m finding a bit of breathing room, I need to drop email to some of my friends back at KMC. I know I’m not good at staying in touch, but I intend to work on being better…

VR

Work on VR coding has been pretty well shelved since the beginning of last summer. This is mostly down to the job change and various bits of being busy leading up to that.

I think I’m finally at a point where I can get back to work on that front. I expect to spend some time learning blender 2.8 first. This should help me make more interesting items to incorporate in my unity games.

Once I’ve gotten to where I’m happy with an initial level of blender competency, I’ll switch back to working on the cluster game (see more details on pandamallet and cluster-1 in my github account. I finally uploaded the latest version of the game game code over the holiday…I hadn’t realized that I had done that much work without pushing code but I expect to keep things more in sync now.

I expect to get back to working with 3D tracking of optical beacons with multiple cameras sometime in the future, but probably not until I’ve got much more done with Cluster.

I am clearing the decks in the basement to free up a larger working area for the room-scale VR. Hoping to have most of the back half of the finished part of the basement cleared and the working boundaries expanded appropriately.

Lots more to play with on the VR front, but I’m going to try to limit my distractions in order to get Cluster to a playable point before shooting off in another direction.

Networking, Projects

Cybersecurity and Cryptography

Leave a comment

I’ve been getting more deeply involved in the cybersecurity and cryptography end of things in the last few weeks.

Did some serious work looking into current best practices for password management. Found that the bcrypt algorithm I had been familiar with has been long ago superseded (no surprise there) and that there is a hash iteration algorithm that can be used to bump up the work involved in computing an off the shelf HMAC to levels where it is suited for use as a password hash (PBKDF2 and here).

I’ve been looking at TLS and related technologies. In the past I’ve tended to treat them as black box components. I’m digging a bit deeper on a few fronts now.

I knew that elliptic curve algorithms were available in the TLS cypher suite but had not realized that they were in active use. Last time I looked at elliptic curve algorithms the community was viewing them with suspicion after the Dual_ED_DRBG fiasco. I think that the reduced computational complexity when processing them may have also lent an air of insecurity to them. At this point it sounds as if they’ve passed muster and are in serious use. I picked up a book (Modern Cryptography and Elliptic Curves, A Beginner’s Guide) to get a better handle on the underlying mathematics and will be taking a closer look on a broader scale.

I’m setting up my raspberry pi controllers (at least a few of them) as TLS/DTLS test endpoints. I’ve loaded and built OpenSSL on them over the weekend and will be coding up some samples to play with in the evenings this week. I’ve got machines ranging from pi-2 to pi-4 so they should provide a nice range of performance for testing.

TLS on TCP

I expect to initially put together some simple TLS over TCP code to make sure I’ve got everything working properly and that my certs are set up correctly.

DTLS on UDP

Once I’ve got TLS working I’ll likely try to transition to point-to-point DTLS as that is also a standardized protocol and a good stepping stone to the proposed multicast adaptation.

Multicast on UDP

I haven’t worked with multicast datagram traffic much (pretty much never) so I’ll likely move on to simple, un-encrypted multicast traffic from there. If I can get some of the machines to join a multicast group and ping traffic off of them, I’ll count that as a win.

Multicast over DTLS on UDP

The final step of this exercise will involve taking the multicast sample and the DTLS sample and attempting to implement the proposed approach to providing multicast support to DTLS. This isn’t a standards track proposal, but seems like the closest thing we’ve got to secure multicast traffic support.

Hoping this comes together. It seems like an interesting exercise. If I can get this work done entirely off hours, I’ll share the resulting code on my github account…

Ideas, Security, Topics

Fun with Password Hashing

Leave a comment

I’ve been spending some time looking into password hashing best practices over the last week.

I’ve know about the BCrypt algorithm for a long time as the old BSD standard ‘high effort’ hashing algorithm designed to make brute forcing hashes difficult.

I’ve found that there is a new effort called SCrypt intended to generate a modern equivalent for dedicated password hashing as well as a ‘password expansion’ algorithm that appears to be in wide used called PBKFD2.

The PBKDF2 algorithm applies an HMAC using the key input to inject the salt and then to chain iterations of the process. It takes a user selected number of iterations that allows the work-load to generate the hash to be tuned to the scope of expected attacks (and to the performance of the target hardware). This allows modern high performance algorithms such as SHA-256 to be applied in a manner that makes the total calculation of the final salted hash resource intensive enough to reduce the likelihood of a successful brute force attack.

Engineering execution and creativity mixed for the best results…