Merge pull request Yara-Rules#415 from sylvainpelissier/ecc_order

Add BLS12-381 subgroup order
k0ko380 · Aug 5, 2021 · 1967dff · 1967dff
2 parents 05f0665 + 0550041
commit 1967dff
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/crypto/crypto_signatures.yar b/crypto/crypto_signatures.yar
@@ -1483,8 +1483,8 @@ rule ecc_order {
     meta:
 		author = "spelissier"
 		description = "Look for known Elliptic curve orders"
-		date = "2020-01"
-		version = "0.1"
+		date = "2021-07"
+		version = "0.2"
 	strings:
 		$secp192k1 = { FF FF FF FF FF FF FF FF FF FF FF FE 26 F2 FC 17 0F 69 46 6A 74 DE FD 8D}
 		$secp192r1 = { FF FF FF FF FF FF FF FF FF FF FF FF 99 DE F8 36 14 6B C9 B1 B4 D2 28 31}
@@ -1493,6 +1493,7 @@ rule ecc_order {
 		$secp256k1 = { FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FE BA AE DC E6 AF 48 A0 3B BF D2 5E 8C D0 36 41 41 }
 		$prime256v1 = { FF FF FF FF 00 00 00 00 FF FF FF FF FF FF FF FF BC E6 FA AD A7 17 9E 84 F3 B9 CA C2 FC 63 25 51 }
 		$secp384r1 = { FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF C7 63 4D 81 F4 37 2D DF 58 1A 0D B2 48 B0 A7 7A EC EC 19 6A CC C5 29 73 }
+		$bls12_381_r = { 01 00 00 00 FF FF FF FF FE 5B FE FF 02 A4 BD 53 05 D8 A1 09 08 D8 39 33 48 7D 9D 29 53 A7 ED 73}
 	condition:
 		any of them
 }