Practical Cryptographic Key Recovery - Jesse Kornblum

ePAPER READ

DOWNLOAD ePAPER

jessekornblum.com

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

START NOW

Current Methods• <strong>Key</strong> Schedule Search– Better brute force– Really identifying data that is not a key schedule– See "Cold Boot" paper by Halderman et al.

Google Earth Cache Forensics - Jesse Kornblum

Applying the Science of Similarity to Computer ... - Jesse Kornblum

Windows Memory Forensics and Direct Kernel ... - Jesse Kornblum

Windows Memory Analysis - Jesse Kornblum

Windows Memory Forensics and DKOM - Jesse Kornblum

Current Methods• Brute Force– Try every block of bytes as possible key– "Last resort of the incompetent"– See "Linear Scan" paper by Hargreaves and Chivers– Doesn't work for split keys

Current Methods• <strong>Key</strong> Schedule Search– Better brute force– Really identifying data that is not a key schedule– See "Cold Boot" paper by Halderman et al.

Page 6 and 7: Current Methods• Source code anal
Page 8: TPAM6
Page 12 and 13: BitLocker Drive Encryption• I am
Page 14 and 15: BitLocker Drive Encryption• Brute
Page 16 and 17: BitLocker Tool Marks• AES key sch
Page 18 and 19: AlgorithmPool TagAES key in schedul
Page 20 and 21: BitLocker Tool Marks• Not perfect
Page 22 and 23: Performance• Brute Force- O(nm)
Page 24 and 25: Questions?• Introduction• Targe
Page 26 and 27: References• BitLocker Drive Encry

Practical Cryptographic Key Recovery - Jesse Kornblum

Create successful ePaper yourself

Delete template?

Save as template?