Merge pull request #362 from sylvainpelissier/chacha-constants

Add Chacha stream cipher constants for 128-bit and 256-bit key

Crypto/crypto_signatures.yar

@@ -1451,3 +1451,27 @@ rule DCP_DES_EncryptECB {
 	condition:
 		any of them
 }
+
+rule Chacha_128_constant {
+    meta:
+		author = "spelissier"
+		description = "Look for 128-bit key Chacha stream cipher constant"
+		date = "2019-12"
+		reference = "https://www.ecrypt.eu.org/stream/salsa20pf.html"
+	strings:
+		$c0 = "expand 16-byte k"
+	condition:
+		$c0
+}
+
+rule Chacha_256_constant {
+    meta:
+		author = "spelissier"
+		description = "Look for 256-bit key Chacha stream cipher constant"
+		date = "2019-12"
+		reference = "https://tools.ietf.org/html/rfc8439#page-8"
+	strings:
+		$c0 = "expand 32-byte k"
+	condition:
+		$c0
+}