K-Hunt: A Dynamic Analysis Framework for Identifying and Securing Cryptographic Keys in Executable Code

In the realm of cryptographic code analysis, identifying crypto primitives and keys securely remains a significant challenge. This paper presents K-Hunt, a dynamic analysis system designed to detect and evaluate cryptographic keys within executable code. Unlike previous systems that rely on pre-defined templates or extensive offline analysis, K-Hunt utilizes lightweight heuristics to identify both proprietary ciphers and crypto keys with minimal impact on program execution. The system differentiates itself by focusing on core properties of cryptographic operations, avoiding reliance on template-based approaches or static analysis. We compare K-Hunt with several existing methods including Kerckhoffs, Aligot, Crypto-DFG, Cryptohunt, Dispatcher, MovieStealer, and CipherXRay. Our evaluation reveals that K-Hunt outperforms many of these methods in identifying insecure keys, such as deterministically generated, insecurely negotiated, and recoverable keys, while remaining resilient to code obfuscation techniques. The implementation of K-Hunt has been tested across 10 cryptographic libraries and 15 applications, successfully pinpointing keys used in symmetric, asymmetric, and stream ciphers, as well as digital signatures. K-Hunt’s findings include discovering insecure keys in 22 out of 25 evaluated programs, including well-established libraries like LibSodium, Nettle, TomCrypt, and WolfSSL. The paper concludes with a discussion on the responsible disclosure of vulnerabilities to affected vendors and ongoing efforts to address these security concerns through patches.