Automated Identification of Cryptographic Primitives in Binary Code with Data Flow Graph Isomorphism
Automated Identification of Cryptographic Primitives in Binary Code with Data Flow Graph Isomorphism
复制标题
DOI：
10.1145/2714576.2714639
复制
发表时间：
2015-04
期刊：
影响因子：
--
通讯作者：
Pierre Lestringant;Frédéric Guihéry;Pierre-Alain Fouque
中科院分区：
文献类型：
--
作者：
Pierre Lestringant;Frédéric Guihéry;Pierre-Alain Fouque
软件使用加密算法来保护其通信和保护其内部数据。然而，算法的选择，它的实现设计和它的输入参数的生成方法可能会对它最初应该保护的数据的安全性产生巨大的影响。因此，要评估涉及密码学的二进制程序的安全性，分析人员需要检查这些点是否会导致系统漏洞。这意味着，作为第一步，要精确地识别和定位二进制程序中的密码。由于二进制分析是一项困难而繁琐的任务，因此设计一种自动检索密码原语及其参数的方法是有趣的。本文提出了一种自动识别对称密码算法及其参数的新方法。我们的方法是静态的，基于DFG同构。为了科普由不同源代码以及不同编译器和选项产生的二进制代码，使用代码重写机制对DFG进行规范化。我们的方法不同于以往的作品，要么使用统计标准导致不精确的结果，或依赖于重型动态仪器。为了验证我们的方法，我们提出了一组合成样本，包括几个加密算法，二进制代码的知名的加密库和参考源代码的实现使用不同的编译器和选项编译的实验结果。
Softwares use cryptographic algorithms to secure their communications and to protect their internal data. However the algorithm choice, its implementation design and the generation methods of its input parameters may have dramatic consequences on the security of the data it was initially supposed to protect. Therefore to assess the security of a binary program involving cryptography, analysts need to check that none of these points will cause a system vulnerability. It implies, as a first step, to precisely identify and locate the cryptographic code in the binary program. Since binary analysis is a difficult and cumbersome task, it is interesting to devise a method to automatically retrieve cryptographic primitives and their parameters. In this paper, we present a novel approach to automatically identify symmetric cryptographic algorithms and their parameters inside binary code. Our approach is static and based on DFG isomorphism. To cope with binary codes produced from different source codes and by different compilers and options, the DFG is normalized using code rewrite mechanisms. Our approach differs from previous works, that either use statistical criteria leading to imprecise results, or rely on heavy dynamic instrumentation. To validate our approach, we present experimental results on a set of synthetic samples including several cryptographic algorithms, binary code of well-known cryptographic libraries and reference source implementation compiled using different compilers and options.