Automatic Detection and Decryption of AES Using Dynamic Analysis

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21240%2F22%3A00359188" target="_blank" >RIV/68407700:21240/22:00359188 - isvavai.cz</a>

Result on the web

<a href="https://doi.org/10.1007/s42979-022-01222-w" target="_blank" >https://doi.org/10.1007/s42979-022-01222-w</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1007/s42979-022-01222-w" target="_blank" >10.1007/s42979-022-01222-w</a>

Result language

angličtina

Original language name

Automatic Detection and Decryption of AES Using Dynamic Analysis

Original language description

In this paper we propose a set of algorithms that can automatically detect the use of AES and automatically recover both the encryption key and the plaintext, assuming that we can control the code flow of the encrypting program, e.g., when an application is performing encryption without the user’s permission. The first algorithm makes use of the fact that we can monitor accesses to the AES S-Box and deduce the desired data from these accesses; the approach is suitable to software-based AES implementations, both naïve and optimized. To demonstrate the feasibility of this approach we designed a tool which implements the algorithm for Microsoft Windows running on the Intel x86 architecture. The tool has been successfully tested against a set of applications using different cryptographic libraries and common user applications. We also discuss the options of recovering the same data when hardware-assisted AES implementations on Intel-compatible architectures are used.

Czech name

—

Czech description

—

Type

J_ost - Miscellaneous article in a specialist periodical

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

<a href="/en/project/EF16_019%2F0000765" target="_blank" >EF16_019/0000765: Research Center for Informatics</a><br>

Continuities

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Publication year

2022

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Name of the periodical

SN Computer Science

ISSN

2662-995X

e-ISSN

—

Volume of the periodical

2022

Issue of the periodical within the volume

338

Country of publishing house

SG - SINGAPORE

Number of pages

13

Pages from-to

—

UT code for WoS article

—

EID of the result in the Scopus database

2-s2.0-85132415486