Research on RSA Padding Identification Method in IoT Firmwares

Abstract

Cryptography is a fundamental mechanism for security, various cryptographic algorithms are widely used in IoT firmwares, and identifying cryptographic algorithms is paramount for IoT security. RSA algorithm is the most popular asymmetric key cryptographic algorithm in use. Insecure RSA padding mode may result in padding oracle attack, causing certificate leakage, random number prediction, and plaintext recovery. In this paper, we show how to extract binaries from IoT firmwares, then describe 7 padding modes in RSA algorithm, and identify RSA padding in two methods -- function-name matching and IR expression constant analysis. We use Angr VEX model to translate specific code block into intermediate representation, and analyze their constant value to track RSA parameter int padding. We collect and filter 159 firmwares from 6 different vendors, analyze 7 kinds of RSA paddings using function-name matching, and 4 kinds of RSA paddings in RSA functions which contain parameter int padding using IR expression constant analysis. Then we identify 335 RSA paddings, and find out that flawed padding is still broadly in use in IoT environment.

Membangun Framework Repository Source Code Algoritma Komputer pada Platform Web

“…Oleh demikian hadirnya repository source code algoritma komputer akan memberikan kemudahan dalam membangun website (builder web berdasarkan jenis algoritma) sehingga peneliti akan mudah mendapatkan source code HTML, PHP, CSS + Algoritma (metode: Fuzzy, Ant System, Decission Tree, C5. C4.5, CBR, Forward & Backward Chaining, Genetika, Swarm, Topsis, Promethe, AHP,SAW, ACO, Moora, Tabu search, DSA, RSA, DH, ECC, Quantum, C 4.5, K-Means, Support Vector Machines, Apriori, Expectation Maximisation Algorithm, PageRank,k-Nearest Neighbors, Naıve Bayes,WP, Certainty Factor, Dempster Shafer, B/C Ratio, IRR, NPV, FMADM, dsb, sehingga akan mudah menyelesaikan penelitian (Mu, Yang, Chen, & Wang, 2020;PM, Batubulan, & Fauziyyatul'Iffah, 2019;Sari, Khatimi, & Rusiana, 2020;Widhianto, Supianto, & Setiawan).…”