News for hackers. Stuff that matters.

A comment on AES Finder – the utility to find AES keys in running process memory. Parent comment

Re:AES Finder – the utility to find AES keys in running proc... by EE84M3i on Sunday September 06, 2020 @03:23PM (#24393926)
Keys having an expected layout in memory is not a problem, nor is being able to dump encryption keys from process memory if you have access to it. That's the security model these processes operate in.

Processes could conceivably put keys in memory in a non-standard way that is more difficult to write a tool to scan for, but the fact that they don't is not a problem, and even if they did it would not make it impossible to write a tool.

[ Parent | on HN ]
Re:AES Finder – the utility to find AES keys in running proc... by panpanna on Sunday September 06, 2020 @05:21PM (#24394771)
The point is that if we could move the pieces of key schedule around freely it would increase the complexity of the tool significantly since it will have to match each potential block against a number of other potential blocks.
[ Parent | on HN ]