News for hackers. Stuff that matters.

A comment on AES Finder – the utility to find AES keys in running process memory. Parent comment

Re:AES Finder – the utility to find AES keys in running proc... by EE84M3i on Sunday September 06, 2020 @02:17PM (#24393414)
What do you mean by "problem"? Are you talking about obfuscation?
[ Parent | on HN ]
Re:AES Finder – the utility to find AES keys in running proc... by hinkley on Sunday September 06, 2020 @02:39PM (#24393588)
> looking for an expanded set of round keys[2] using their expected layout in memory

The problem is predictability of the layout, right? The layout is chosen for throughput, but CPU caches can cope well with some nonlinear layouts.

[ Parent | on HN ]
Re:AES Finder – the utility to find AES keys in running proc... by EE84M3i on Sunday September 06, 2020 @03:23PM (#24393926)
Keys having an expected layout in memory is not a problem, nor is being able to dump encryption keys from process memory if you have access to it. That's the security model these processes operate in.

Processes could conceivably put keys in memory in a non-standard way that is more difficult to write a tool to scan for, but the fact that they don't is not a problem, and even if they did it would not make it impossible to write a tool.

[ Parent | on HN ]
Re:AES Finder – the utility to find AES keys in running proc... by panpanna on Sunday September 06, 2020 @05:21PM (#24394771)
The point is that if we could move the pieces of key schedule around freely it would increase the complexity of the tool significantly since it will have to match each potential block against a number of other potential blocks.
[ Parent | on HN ]