0

When investigating an application I found a cryptographic key. Based on the documentation related to how the key is used I know it's some form of symmetric key. However I don't know what cipher it is used in and I can't find out from the application as that would require reverse engineering compiled c++, A skill I don't possess. The key does not appear to be user chosen and is represented as 64 hexadecimal characters (256 bits). My question is, is there any program or test that could be easily preformed on the key to determine if it is valid for common ciphers? Such as a check to see if it's a valid aes-256 key or similar. Thanks

  • 2
    You mean, given a key, determine what cypher was used? To determine if it is valid, you would need to decrypt something ... – schroeder Nov 9 '16 at 20:02
  • I think you're going to need to do some debugging - if you can make the app use it, you can see the context it does that in. There's a BruCon presentation from some KPN folks that gives an example of this and the tools they use - youtube.com/watch?v=iTGvbi_wLE0 - the binary analysis starts at 32 minutes in. They work through identifying the key and the cipher - not quite a tutorial, but pretty close. – crovers Nov 9 '16 at 20:04
  • Schroeder, you are correct, I am trying to determine the cipher, by valid I mean could the key be hypothetically used with the cipher, does it meet the ciphers constraints on acceptable keys – Justin Gerhardt Nov 9 '16 at 20:21
  • 1
    I don't think there is anything like "constraints on acceptable keys". A key for a computer encryption/decryption algorithm is simply a sequence of bits. Most ciphers require the key to be of a certain length, but apart from that, as @schroeder already pointed out, you need to use the key on a ciphertext to find out if it decrypts. – Pascal Nov 9 '16 at 20:30
2

As mentioned, there are no constraints on valid keys. This would limit the keyspace, making the algorithm less secure. You say you don't have reverse engineering skills to throw at this problem, and you don't mention the app used. This leaves us at a dead end because we can't help as far as i can see. You could however try detecting the magic constants with an IDA plugin like FindCrypt (http://www.hexblog.com/?p=27), that would require only basic use of RE tools.

-4

Can you open it with a certificate tool like Cleopatra? If you are on Windows give it a crt or pem file extension and Windows will usually open it in their Certificate viewer.

  • 2
    I don't think it could be possible for the key to be a certificate. As far as I know all certificates are based on asymmetric crypto and this is definitely symmetric. Additionally the data is only 256 bits so there is no way a key and all certificate data could fit. – Justin Gerhardt Nov 9 '16 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.