Brute Force.
Brute Force.
Ok I am sure this has been discussed before but just thought I would check it out. If Sony is using an encryption standard (which I am sure they are) couldn't it be possible to find the key through brute force. Once done this would let us decode any PSP files we like. I know it would take ages but once found we could look for floors in game and firmware code to exploit. And assuming they can't change the key (old games wouldn't play any more) this could be used for the life of the PSP letting us tackle any firmware upgrades they throw at us. Any suggestions or ideas how you might go about this please post.
"You can't do biology with beer cans."
-John R. Searle
-John R. Searle
Hehe i was thiking about that today, when i was working at the gov. I did set a seti on the network. I was in the top 10 for a few weeks =P (1200 computers). So i was wondering if we could brute force, setting up a clusters of ppl allowing they computer to decrypt key.
Or we get some PS3 do to the work they are so good =P
Or we get some PS3 do to the work they are so good =P
Some guys have been bruteforcing 64 bit viaccess for at least five years now without any result. Bruteforcing 65 bits will take twice the time of 64 nad so on. If we assume that bruting 64 bit aes will take two years, it will take 2 * 2^192 years.
And there is also another problem. The binaries are digitally signed and keys used for signing are generally at least 2048 bit long.
And there is also another problem. The binaries are digitally signed and keys used for signing are generally at least 2048 bit long.
Ah, looks like a dead end. From looking at the forums the encryption used on psp files seems to be AES 128 bit (please tell me if im wrong or if it is unknown). Can anyone see obvious problems with, encrypting some known files, working out which parts of the PSP file headers are important. Find the same version of an encrypted and decrypted psp file and try encrypting the non-encrypted file with all possible keys and checking the output against the encrypted PSP file until we get an exact match, wouldn't this give us the key? Not too sure of the time implications of this method, but directly accessing the encryption and decryption functions of a v1.0 psp would make the checking very quick since it has to do this on large files while loading games. Again any problems or suggestions on methods of doing this please post.
"You can't do biology with beer cans."
-John R. Searle
-John R. Searle
First off, known plaintext as the attack is called, is not effective against certain types of encryption. AES just happens to be one of them. Best scenario for AES is 2^72 keyspace on a 128-bit key. Still far too big a space to be feasible. (AFAIK, 2^64 is the limit before something is considered feasible, since it could be cracked before the lifespan of the algorithm is up, which is roughly 10-20 years)
Plus, we currently don't know that AES is the only thing preventing something from being valid. RSA is also used, and exactly how it interacts with AES is unknown.
For all we know, RSA could be used to 'sign' the binary with the private key that sony has locked away, and the AES key is in the open within this signature. It still keeps the binary secure in the sense that you know ONLY Sony could have encrypted the binary.
Plus, we currently don't know that AES is the only thing preventing something from being valid. RSA is also used, and exactly how it interacts with AES is unknown.
For all we know, RSA could be used to 'sign' the binary with the private key that sony has locked away, and the AES key is in the open within this signature. It still keeps the binary secure in the sense that you know ONLY Sony could have encrypted the binary.
Check out http://www.cryptosystem.net/aes/.
They post information on attacks on the AES sytem. Unfortunately, the best attack is an algebraic attack, which is still entirely theoretical.
More advanced theories have gotten AES-256 down to somewhere between 2^87 and 2^100, which is pretty respectable. However, without an actual implementation of such an attack, it is pretty worthless.
They post information on attacks on the AES sytem. Unfortunately, the best attack is an algebraic attack, which is still entirely theoretical.
More advanced theories have gotten AES-256 down to somewhere between 2^87 and 2^100, which is pretty respectable. However, without an actual implementation of such an attack, it is pretty worthless.
thanks for URL. Anyway I can read:
But breaking AES is not a problem in the PSP case, as said in a previous post, just because the key should be located inside the file. Only the SONY private key used for signature is not known and will be the main problem to execute home-made code.
Now just hope someone find another software door in the 1.5 firmware :-)
( Rijndael is the algorithm selected and called now AES)In practice the algorithm XL fails (quite miserably) to break Rijndael
There is no working proof of such keyspace reduction now, even if these works seems promising.There is no doubt that attacks such as XL and XSL do work in many interesting cases. Unfortunately they are heuristic, and their behaviour is not well understood
But breaking AES is not a problem in the PSP case, as said in a previous post, just because the key should be located inside the file. Only the SONY private key used for signature is not known and will be the main problem to execute home-made code.
Now just hope someone find another software door in the 1.5 firmware :-)