  The continuing use of proprietary cryptography in embedded systems across
many industry verticals, from physical access control systems and
telecommunications to machine-to-machine authentication, presents a significant
obstacle to black-box security-evaluation efforts. In-depth security analysis
requires locating and classifying the algorithm in often very large binary
images, thus rendering manual inspection, even when aided by heuristics, time
consuming.
  In this paper, we present a novel approach to automate the identification and
classification of (proprietary) cryptographic primitives within binary code.
Our approach is based on Data Flow Graph (DFG) isomorphism, previously proposed
by Lestringant et al. Unfortunately, their DFG isomorphism approach is limited
to known primitives only, and relies on heuristics for selecting code fragments
for analysis. By combining the said approach with symbolic execution, we
overcome all limitations of their work, and are able to extend the analysis
into the domain of unknown, proprietary cryptographic primitives. To
demonstrate that our proposal is practical, we develop various signatures, each
targeted at a distinct class of cryptographic primitives, and present
experimental evaluations for each of them on a set of binaries, both publicly
available (and thus providing reproducible results), and proprietary ones.
Lastly, we provide a free and open-source implementation of our approach,
called Where's Crypto?, in the form of a plug-in for the popular IDA
disassembler.
