0

During my research on a java application, I discovered that the nextInt(64) function of the java.Random() class is used to generate the encryption key.

The key size is 16 bytes. I know that this generator is not recommended because it is vulnerable. Especially in this case, the value of each byte of the key is selected from a short range from 0x0 to 0x40.

I already got acquainted with the fact that it is possible to predict the next values ​​of the generator using the previous values. But in my case meyan has no data about the previous values (The key is encrypted and I don't have access to its values), so here we are talking about iterating over the key values. I don't understand how can I use the data that each next value depends on the previous one (oldseed parameter)?

protected int next(int bits) {
        long oldseed, nextseed;
        AtomicLong seed = this.seed;
        do {
            oldseed = seed.get();
            nextseed = (oldseed * multiplier + addend) & mask;
        } while (!seed.compareAndSet(oldseed, nextseed));
        return (int)(nextseed >>> (48 - bits));
}

How to reduce the number of enumeration for such a 16-byte key?

Sergey Unk
  • 1
  • Are the 16 bytes obtained with next(6) meaning you are using " from 0x0 to 0x40" to mean in [0, 0x40-1] ? Then hint: assume a single thread during key generation, and simplify accordingly what this code does. Then find which bits of the seed have an influence on the 16-byte key. Conclude how many such 16-byte keys there can be, and how to enumerate them. Perhaps, investigate how the seed is chosen, which may allow to enumerate the actual key much faster. – fgrieu Apr 11 '22 at 07:13
  • 1
    @fgrieu there is no next(6) - nextInt(64) is used. This means each byte of the 16 digit key is a number in the range [0;63] (decimal system) – Sergey Unk Apr 11 '22 at 08:27
  • 1
    That's clearer, and key bytes are from 0x0 to 0x3F included. Revised hints in light of the above: understand how nextInt(64) uses next(31), and why nextInt(64) is precisely equivalent to next(6). Then assume a single thread during key generation, and simplify the question's code accordingly. Find which bits of the seed have an influence on the 16-byte key. Conclude how many such 16-byte keys there can be, and how to enumerate all of them at feasible cost. Perhaps, investigate how the seed is chosen, which may allow to enumerate the actual key much faster. – fgrieu Apr 11 '22 at 08:42

0 Answers0