Statistical key finding

In general for most cryptographic systems the cryptographic keys should be as random as possible. For most symmetric ciphers the keys can and should be a truly random set of bits. For most asymmetric ciphers the private keys are either numbers chosen at random with certain constraints (such as primality or being generators in a group) or are the result of computations based on a set of random numbers with some constraints. In either case the key material exhibits high entropy. In contrast to this, most uncompressed data in a computer's memory has relatively low entropy. As a result, if a key is known to exist in memory in its raw form then it is likely to stand out against the background of non-key data by virtue of its high entropy and an attacker needs to only test for matching keys in areas of memory or storage that have high entropy.

High entropy keys stand out visually against background low-entropy data.

The contrast between the low entropy of most data and the high entropy of key data is sufficient as to be apparent by visual inspection. The image to the right shows an example of this.

Analytical key finding

While statistical key finding can be effective for reducing the amount of memory that needs to be searched, it still requires high-entropy areas to be tested to check if they contain the correct key material. In certain cases, particularly in the context of public key encryption systems, it is possible to determine patterns that must occur in the key material and then limit the search to areas where these patterns are found.

Shamir and van Someren^[1] demonstrated one example of this analytical approach for finding private RSA keys where the public key is known and has a small public exponent. In the RSA system the public key is a pair ${\displaystyle (n,e)}$, where ${\displaystyle n=p.q}$ with p and q being two large primes. The corresponding private key is ${\displaystyle (n,d)}$ (or sometimes ${\displaystyle (p,q,d)}$ or some variant thereof) where ${\displaystyle e.d\equiv 1{\pmod {\phi (n)}}}$, which is to say that e multiplied by d is equivalent to 1, modulo ${\displaystyle \phi (n)}$ where φ represents Euler's totient function and is the size of the multiplicative group modulo n. In the case of an RSA key:

${\displaystyle \phi (n)=(p-1)(q-1)=n-p-q+1}$

Finding the value of ${\displaystyle \phi (n)}$ from n allows for the factorization of n and the security of the RSA cryptosystem rests on the difficulty of doing so. As such an attacker cannot determine d exactly, given e and n. An attack can however know a fair amount about what d looks like, given the knowledge that p and q are typically chosen to be the same length in bits and are both 'close' to the square root of n. Thus an attacker can approximate a guess of:

${\displaystyle \phi (n)\approx \phi '(n)=n-2{\sqrt {n}}}$

and typically this approximation will be correct in the more significant half of its bits of its binary representation. The relationship of e and d means that:

${\displaystyle d=(1+k.\phi (n))/e}$

where the exact value of k is unknown but ${\displaystyle 0<k<e.}$ Using this fact and the approximation ${\displaystyle \phi '(n)}$, the attacker can enumerate a set of possible values for the top half of the binary representation of d for each possible value of k. These binary patterns can be tested for many orders of magnitude faster than performing a trail decryption. Furthermore, in the common case of ${\displaystyle e=3}$ it can be shown that ${\displaystyle k=2,}$ which allows the top half of the bits of d to be determined exactly and searched for directly.