Reverse Engineering
Cryptographic Implementation Review in Binaries
We examine whether cryptography is correctly implemented in compiled code. We identify issues such as hard-coded keys and weak random number generation.
What it is
A strong cryptographic algorithm does not provide protection if used incorrectly. The review assesses how cryptography is implemented in the compiled code. We look for implementation issues such as hard-coded keys, weak random number generation and incorrect cipher mode use. These mistakes undermine protection even if the algorithm itself is correct.
Scope
- Identifying cryptographic algorithms and modes used in the compiled code
- Identifying hard-coded keys and passwords
- Assessing adequacy of random number generation
- Identifying mistakes in cipher mode and initialization vector use
- Identifying outdated algorithms
The need
When organizations need it
- When you need to confirm correct cryptography implementation in a product without source code.
- When a device or software implements its own cryptography and it requires review.
- When you need to determine whether outdated algorithms remain in the product.
Method
How we work
-
Identify
We identify which cryptographic algorithms and modes are used in the compiled code.
-
Review
We assess key usage, random number generation and mode selection.
-
Report
We document each implementation issue with its impact and location in the code.
Outcome
What you have at the end
A clear assessment of whether cryptography in the product is correctly implemented, with a breakdown of issues found, their impact and a fix.
Frequently asked questions
Is using the right algorithm enough?
It is not. A hard-coded key or weak random number generation can render even the strongest algorithm ineffective. Mistakes are usually in the implementation.
Which references do you use?
We refer to sources such as NIST SP 800-131A for algorithms and key lengths, and NIST SP 800-90A for random number generation.
Reverse Engineering
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting