Skip to content

R
rules
Commit 960b0cd6 by Sylvain Pelissier
Options

Add SHA3 (Keccak) round constants

parent 8b93f1fd
Showing with 67 additions and 0 deletions
crypto/crypto_signatures.yar
......@@ -1492,4 +1492,70 @@ rule ecc_order {
$secp384r1 = { FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF C7 63 4D 81 F4 37 2D DF 58 1A 0D B2 48 B0 A7 7A EC EC 19 6A CC C5 29 73 }
condition:
any of them
}
rule SHA3_constants {
meta:
author = "spelissier"
description = "SHA-3 (Keccak) round constants"
date = "2020-04"
version = "0.1"
strings:
$c0 = { 0080008000000080 }
$c1 = { 0a00008000000080 }
$c2 = { 8080000000000080 }
$c3 = { 8b00000000000080 }
$c4 = { 8280000000000000 }
$c5 = { 8980000000000080 }
$c6 = { 0880008000000080 }
$c7 = { 0980008000000000 }
$c8 = { 0280000000000080 }
$c9 = { 0a00008000000000 }
$c10 = { 0380000000000080 }
$c11 = { 8b80000000000000 }
$c12 = { 0100008000000000 }
$c13 = { 0a80000000000000 }
$c14 = { 0980000000000080 }
$c15 = { 8000000000000080 }
$c16 = { 8800000000000000 }
$c17 = { 8b80008000000000 }
$c18 = { 8a00000000000000 }
$c19 = { 8180008000000080 }
$c20 = { 0100000000000000 }
$c21 = { 8a80000000000080 }
condition:
10 of them
}
rule SHA3_interleaved {
meta:
author = "spelissier"
description = "SHA-3 (Keccak) interleaved round constants"
date = "2020-04"
version = "0.1"
strings:
$c0 = { 010000008b800000 }
$c1 = { 0000000081000080 }
$c2 = { 0000000088000080 }
$c3 = { 000000000b000000 }
$c4 = { 0100000000800000 }
$c5 = { 010000008b000000 }
$c6 = { 0100000082800000 }
$c7 = { 0000000003800000 }
$c8 = { 010000008a000080 }
$c9 = { 0000000082800080 }
$c10 = { 0000000003800080 }
$c11 = { 000000008b000080 }
$c12 = { 0000000083000000 }
$c13 = { 000000000a000000 }
$c14 = { 0000000080800080 }
$c15 = { 0100000082000080 }
$c16 = { 010000000b000080 }
$c17 = { 0100000088800080 }
$c18 = { 0000000008000080 }
$c19 = { 0100000000000000 }
$c20 = { 0000000089000000 }
$c21 = { 0100000081000080 }
condition:
10 of them
}
\ No newline at end of file
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment