Part 2 - working with encryption keys🔑

In order for a system to encrypt/decrypt data, the cryptographic algorithm must have access to the encryption keys.

Let's talk more about retrieving keys from memory .

First we have to identify them.

And how?

Since we know that the key data has a higher entropy than the non-key data, one way to
to find the key is to divide the data into small sections, measure
the entropy of each section and map the places where
entropy is particularly high.
Search for certain known patterns in memory, such as a key graph, that are specific to certain types of encryption. These patterns may also consist of known
memory offsets, specific lengths of high entropy memory regions, or known entropy patterns.
There are many types of encryption, but for an example I will give you the AES key identification.
AES is a substitution-permutation (SP) network cipher. A cipher that works on 128-bit blocks and can use either 128, 198, or 256-bit keys.

Some are nearly impossible to decrypt
without the correct key .Modern symmetric key cryptosystems are built using multiple applications of a simpler function, with several iterations or "rounds" being performed. From the master key, the derivation function extracts the different connections used in each round. This is known as the key scheduling algorithm, and many researchers argue that this information needs information.
Many researchers argue that this information needs to be present in memory . So what is it to ? This knowledge of the cryptosystem can be used to find the key pattern in memory .

The search criterion is the presence of a mathematical relationship between the master key and the connectors.
It is noteworthy that the key schedule for a 128-bit AES key is represented in memory as a flat array of bytes, where the first 16 bytes (or 128 bits) constitute the source key. The remaining 160 bytes are round keys derived from that key. For larger AES keys, a corresponding key schedule is used.
It's best to perform a memory grab closer to the beginning of the ransomware run to make sure that the necessary keys are still present in memory.In the case of a ransomware attack
where the user can still interact with the operating system after the initial encryption is complete, such as Phobos ransomware, a second AES key may be in memory. This key is used to perform any subsequent encryption activities, such as any new files created. This approach is probably used to prevent the recovery of the original key and protect the original encryption.

Well, it's time to end .🧩
Encryption is a big topic but I hope you understood my short explanation.
For a more specific understanding please go to the archive with articles below - there are many useful articles and information beyond that described above.

Thank you for reading❣️ . And remember even if you get lost in the dark forest you will come out to the castle of the queen of hearts🃏♥️
#cryptography #forensics #virus #revers #ransomware