# Cryptographic Algorithm Identification Guide

## Overview

Malware frequently uses cryptographic algorithms for encryption, hashing, and obfuscation. Identifying which algorithms are in use is critical for decrypting C2 communications, extracting configurations, and understanding data exfiltration methods.

## Identification by Constants

### AES (Advanced Encryption Standard)
- **S-box**: 256-byte table starting with `63 7C 77 7B F2 6B 6F C5`
- **Inverse S-box**: Starts with `52 09 6A D5 30 36 A5 38`
- **RCON**: `01 02 04 08 10 20 40 80 1B 36`
- **Key sizes**: 128-bit (16 bytes), 192-bit (24 bytes), 256-bit (32 bytes)

### RC4
- **KSA initialization**: Sequential byte array 0x00 through 0xFF (256 bytes)
- **Code pattern**: Two nested loops, swap operations, modular arithmetic
- **No constants**: RC4 is identified by its algorithmic structure rather than constants

### MD5
- **Init values**: `0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476` (little-endian)
- **T-table**: 64 values derived from sine function, first is `0xD76AA478`
- **Rotation amounts**: `7, 12, 17, 22` (round 1), `5, 9, 14, 20` (round 2)

### SHA-1
- **Init values**: `0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0`
- **Round constants**: `0x5A827999, 0x6ED9EBA1, 0x8F1BBCDC, 0xCA62C1D6`
- Note: First 4 init values shared with MD5

### SHA-256
- **Init values**: `0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19`
- **Round constants (K)**: 64 values, first is `0x428A2F98`

### DES / 3DES
- **Initial permutation table**: `58, 50, 42, 34, 26, 18, 10, 2, 60, 52, ...`
- **S-boxes**: Eight 4x16 tables
- **PC-1 and PC-2**: Key schedule permutation tables

### Blowfish
- **P-array**: 18 values starting with `0x243F6A88, 0x85A308D3, 0x13198A2E`
- **S-boxes**: Four 256-entry tables derived from pi digits

### ChaCha20 / Salsa20
- **String constant**: `"expand 32-byte k"` (ASCII)
- **Quarter-round**: ADD, XOR, ROL operations in specific pattern

### RSA
- **No constants**: Look for big-number arithmetic libraries
- **Indicators**: Large number operations, modular exponentiation
- **Common public exponents**: `0x10001` (65537), `0x03`, `0x11`

## Identification by Structure

### Feistel Networks (DES, Blowfish)
- Split data into two halves
- Multiple rounds of F-function applied
- XOR between halves, then swap

### Substitution-Permutation Networks (AES)
- SubBytes (S-box lookup)
- ShiftRows (byte rotation)
- MixColumns (matrix multiplication)
- AddRoundKey (XOR with key)

### Stream Ciphers (RC4, ChaCha20)
- Generate keystream byte-by-byte
- XOR plaintext with keystream
- State array updated for each byte

### Hash Functions (MD5, SHA)
- Message padding to block boundary
- Initialization of state variables
- Compression function applied per block
- Final output is concatenated state

## Tools for Identification

| Tool | Description |
|------|-------------|
| **findcrypt** (IDA plugin) | Scans for crypto constants in IDA |
| **crypto_identifier** (Ghidra) | Ghidra script for constant detection |
| **signsrch** | Standalone signature scanner |
| **KANAL** (PEiD plugin) | Crypto analyzer for PEiD |
| **function_identifier.py** | This skill's constant scanner script |

## Common Malware Crypto Usage

| Purpose | Typical Algorithms |
|---------|-------------------|
| C2 encryption | AES-CBC, RC4, XOR |
| Config encryption | RC4, XOR, custom |
| String obfuscation | XOR, ROT13, Base64 |
| File hashing | MD5, SHA-256 |
| Key exchange | RSA, Diffie-Hellman |
| Data integrity | CRC32, MD5 |
| Password hashing | MD5, SHA-1, bcrypt |