A reused key attack on an encrypted mobile app database: Case study on KakaoTalk and ProtonMail. (June 2022)

• Record Type: Journal Article
• Authors: Hur, Uk; Park, Myungseo; Kim, Jongsung
• Is Part Of: Journal of information security and applications. Volume 67(2022)
• Publication Date: 2022-06
• Subjects: Mobile forensics -- Reused key attack -- Data decryption; Computer security -- Periodicals; Information technology -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.jisa.2022.103181
• Languages: English
• ISSNs: 2214-2126

Abstract

Abstract: Many mobile apps use encryption to protect user data. Therefore, research on the use of encrypted data in forensic investigations is warranted. When encrypting data, developers can incorporate data such as user information and passwords during the encryption key generation process. Currently, encryption keys can be protected by hardware security modules such as KeyStore and KeyChain using an OS-provided API. Hardware security modules use a built-in random number generator to create random keys and securely store them. As a result, it is practically impossible to decrypt data that have been encrypted using a hardware security module. However, cryptographic algorithm misuse, regardless of whether encryption keys are acquired, present an opportunity for data acquisition. In this paper, we show that a reused key attack that exploits a vulnerability caused by encryption scheme misuse can be used against a secure email service, ProtonMail, and Korea's representative instant messenger KakaoTalk.