Skip to content

R
rules
Commit 821bcff2 by Sylvain Pelissier
Options

Add rules for SipHash and Aria, remove duplicate rule and update Chacha rule

parent 6636eafa
Showing with 30 additions and 11 deletions
crypto/crypto_signatures.yar
...@@ -1057,25 +1057,26 @@ rule RijnDael_AES_CHAR ...@@ -1057,25 +1057,26 @@ rule RijnDael_AES_CHAR
$c0 $c0
} }
rule RijnDael_AES_CHAR_inv rule ARIA_SB2
{ meta: { meta:
author = "_pusher_" author = "spelissier"
description = "RijnDael AES S-inv [char]" description = "Aria SBox 2"
//needs improvement date = "2020-12"
date = "2016-07" reference="http://210.104.33.10/ARIA/doc/ARIA-specification-e.pdf#page=7"
strings: strings:
$c0 = { 48 38 47 00 88 17 33 D2 8A 56 0D 8A 92 48 38 47 00 88 57 01 33 D2 8A 56 0A 8A 92 48 38 47 00 88 57 02 33 D2 8A 56 07 8A 92 48 38 47 00 88 57 03 33 D2 8A 56 04 8A 92 } $c0 = { E2 4E 54 FC 94 C2 4A CC 62 0D 6A 46 3C 4D 8B D1 5E FA 64 CB B4 97 BE 2B BC 77 2E 03 D3 19 59 C1 }
condition: condition:
$c0 $c0
} }
rule RijnDael_AES_LONG rule RijnDael_AES_CHAR_inv
{ meta: { meta:
author = "_pusher_" author = "_pusher_"
description = "RijnDael AES" description = "RijnDael AES S-inv [char]"
date = "2016-06" //needs improvement
date = "2016-07"
strings: strings:
$c0 = { 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 CA 82 C9 7D FA 59 47 F0 AD D4 A2 AF 9C A4 72 C0 } $c0 = { 48 38 47 00 88 17 33 D2 8A 56 0D 8A 92 48 38 47 00 88 57 01 33 D2 8A 56 0A 8A 92 48 38 47 00 88 57 02 33 D2 8A 56 07 8A 92 48 38 47 00 88 57 03 33 D2 8A 56 04 8A 92 }
condition: condition:
$c0 $c0
} }
...@@ -1472,8 +1473,10 @@ rule Chacha_256_constant { ...@@ -1472,8 +1473,10 @@ rule Chacha_256_constant {
reference = "https://tools.ietf.org/html/rfc8439#page-8" reference = "https://tools.ietf.org/html/rfc8439#page-8"
strings: strings:
$c0 = "expand 32-byte k" $c0 = "expand 32-byte k"
$split1 = "expand 3"
$split2 = "2-byte k"
condition: condition:
$c0 $c0 or ( $split1 and $split2 )
} }
rule ecc_order { rule ecc_order {
...@@ -1558,4 +1561,19 @@ rule SHA3_interleaved { ...@@ -1558,4 +1561,19 @@ rule SHA3_interleaved {
$c21 = { 0100000081000080 } $c21 = { 0100000081000080 }
condition: condition:
10 of them 10 of them
}
rule SipHash_big_endian_constants {
meta:
author = "spelissier"
description = "Look for SipHash constants in big endian"
date = "2020-07"
reference = "https://131002.net/siphash/siphash.pdf#page=6"
strings:
$c0 = "uespemos"
$c1 = "modnarod"
$c2 = "arenegyl"
$c3 = "setybdet"
condition:
2 of them
} }
\ No newline at end of file
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment