3 ms·
This source file provides a better history for looking for AES keys. It looks like Sam Trenholme developed the technique originally but I know of it because of
by jonstewart 6y ago
This source file provides a better history for looking for AES keys. It looks like Sam Trenholme developed the technique originally but I know of it because of Jesse Kornblum’s subsequent work. Simson Garfinkel then embedded relevant code inside of bulk_extractor. The technique is over a decade old:
https://github.com/simsong/bulk_extractor/blob/master/src/scan_aes.cpp https://github.com/simsong/bulk_extractor/blob/master/src/sc...
- makomk 6y agoIt looks like this particular fork of this code has a few nice features that aren't in older versions, such as support for dumping memory and actually knowing about the other common formats of AES key schedule that are commonly found in the wild. It's really annoying to run a search over a dump that you suspect contains an AES key schedule and coming up with nothing because the encryption library used a slightly different way of storing it than the one expected by the tool.