Rethinking the Weakness of Stream Ciphers and Its Application to Encrypted Malware Detection

Abstract

One critical vulnerability of stream ciphers is the reuse of an encryption key. Since most stream ciphers consist of only a key scheduling algorithm and an Exclusive OR (XOR) operation, an adversary may break the cipher by XORing two captured ciphertexts generated under the same key. Various cryptanalysis techniques based on this property have been introduced in order to recover plaintexts or encryption keys; in contrast, this research reinterprets the vulnerability as a method of detecting stream ciphers from the ciphertexts it generates. Patterns found in the values (characters) expressed across the bytes of a ciphertext make the ciphertext distinguishable from random and are unique to each combination of ciphers and encryption keys. We propose a scheme that uses these patterns as a fingerprint, which is capable of detecting all ciphertexts of a given length generated by an encryption pair. The scheme can be utilized to detect a specific type of malware that exploits a stream cipher with a stored key such as the DarkComet Remote Access Trojan (RAT). We show that our scheme achieves 100% accuracy for messages longer than 13 bytes in about 17 µsec, providing a fast and highly accurate tool to aid in encrypted malware detection.

Ensuring privacy and confidentiality of cloud data: A comparative analysis of diverse cryptographic solutions based on run time trend

“…The encryption time for NCS and EHS is non-patterned, non-deterministic, and unpredictable because of the disintegration of the keys through the application of a Fixed Sliding Window Algorithm and XORing of the keys and the plaintext which makes NCS and EHS resistant to breaking the resultant cipher through XORing any captured encoded text [ 48 ]. Again the randomization from the application of the Sliding Window Algorithm helps to increase the security of the encrypted data and also reduces the time complexity of the Non-Deterministic Cryptographic Scheme [ 49 , 50 ].…”

Extended-Chacha20 Stream Cipher With Enhanced Quarter Round Function

“…As such, exploring variant ciphers like EChacha20 strengthens the cryptographic defenses against emerging threats while guaranteeing long-term resiliency. • Weakness Mitigation in other ciphers: While to some extent the novel Chacha20 is considered to be robust, it is worth noting that other ciphers still exhibit some weaknesses and vulnerabilities [41]. Exploring EChacha20 is a step towards addressing some of these weaknesses by incorporating enhanced security features and strengthening the overall security posture.…”