Merge pull request Yara-Rules#362 from sylvainpelissier/chacha-constants

Add Chacha stream cipher constants for 128-bit and 256-bit key
k0ko380 · Jan 7, 2020 · 6a600e7 · 6a600e7
2 parents b7d98af + d2337bd
commit 6a600e7
Showing 1 changed file with 24 additions and 0 deletions.
diff --git a/Crypto/crypto_signatures.yar b/Crypto/crypto_signatures.yar
@@ -1451,3 +1451,27 @@ rule DCP_DES_EncryptECB {
 	condition:
 		any of them
 }
+
+rule Chacha_128_constant {
+    meta:
+		author = "spelissier"
+		description = "Look for 128-bit key Chacha stream cipher constant"
+		date = "2019-12"
+		reference = "https://www.ecrypt.eu.org/stream/salsa20pf.html"
+	strings:
+		$c0 = "expand 16-byte k"
+	condition:
+		$c0
+}
+
+rule Chacha_256_constant {
+    meta:
+		author = "spelissier"
+		description = "Look for 256-bit key Chacha stream cipher constant"
+		date = "2019-12"
+		reference = "https://tools.ietf.org/html/rfc8439#page-8"
+	strings:
+		$c0 = "expand 32-byte k"
+	condition:
+		$c0
+}