\relax
\providecommand \oddpage@label [2]{}
\@writefile{toc}{\contentsline {section}{\numberline {1}Research}{1}}
\@writefile{toc}{\contentsline {subsection}{\numberline {1.1}Dual\_EC\_DRBG}{1}}
\@writefile{lof}{\contentsline {figure}{\numberline {1}{\ignorespaces Dual\_EC\_DRBG [xx]\relax }}{1}}
\@writefile{toc}{\contentsline {subsection}{\numberline {1.2}Dual\_EC\_DRBG algorithms and backdoor}{2}}
\@writefile{lof}{\contentsline {figure}{\numberline {2}{\ignorespaces General schematic of a state-based PRNG with functions f and g [xx].\relax }}{2}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {1.2.1}State-based PRNG}{2}}
\@writefile{lof}{\contentsline {figure}{\numberline {3}{\ignorespaces Basic Dual\_EC\_DRBG algorithm without additional input [xx]\relax }}{3}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {1.2.2}Basic Dual\_EC\_DRBG}{3}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {1.2.3}Basic Dual\_EC\_DRBG backdoor}{3}}
\@writefile{lof}{\contentsline {figure}{\numberline {4}{\ignorespaces Dual\_EC\_DRBG algorithm version 2006 with additional input [xx]\relax }}{4}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {1.2.4}Dual\_EC\_DRBG version 2006}{4}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {1.2.5}Dual\_EC\_DRBG version 2006 backdoor}{4}}
\@writefile{lof}{\contentsline {figure}{\numberline {5}{\ignorespaces Dual\_EC\_DRBG algorithm version 2007 with additional input [xx]\relax }}{5}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {1.2.6}Dual\_EC\_DRBG version 2007}{5}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {1.2.7}Dual\_EC\_DRBG version 2007 backdoor}{5}}
\@writefile{toc}{\contentsline {subsection}{\numberline {1.3}Use of Dual\_EC\_DRBG}{5}}
\@writefile{lof}{\contentsline {figure}{\numberline {6}{\ignorespaces Live Chat with RSA\relax }}{6}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {1.3.1}RSA BSAFE}{6}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {1.3.2}Windows Schannel}{7}}
\@writefile{lof}{\contentsline {figure}{\numberline {7}{\ignorespaces BCryptGenRandom function\relax }}{7}}
\@writefile{lof}{\contentsline {figure}{\numberline {8}{\ignorespaces Windows random number generator registry\relax }}{7}}
\@writefile{lof}{\contentsline {figure}{\numberline {9}{\ignorespaces Reverse engineering of DualEcRng\_Generate function in bcryptprimitives.dll\relax }}{8}}
\@writefile{lof}{\contentsline {figure}{\numberline {10}{\ignorespaces point Q in bcryptprimitives.dll\relax }}{8}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {1.3.3}OpenSSL FIPS Object Module}{9}}
\@writefile{lof}{\contentsline {figure}{\numberline {11}{\ignorespaces RAND\_set\_fips\_drbg\_type function in rand\_lib.c\relax }}{9}}
\@writefile{lof}{\contentsline {figure}{\numberline {12}{\ignorespaces Dual\_EC\_DRBG\relax }}{10}}
\@writefile{toc}{\contentsline {section}{\numberline {2}Implementation}{10}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.1}SageMath programs}{11}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {2.1.1}Dual\_EC\_DRBG\_basic.sagews}{11}}
\@writefile{lof}{\contentsline {figure}{\numberline {13}{\ignorespaces Curve P-256 initialisation\relax }}{11}}
\@writefile{lof}{\contentsline {figure}{\numberline {14}{\ignorespaces Dual\_EC\_DRBG random bit generator\relax }}{12}}
\@writefile{lof}{\contentsline {figure}{\numberline {15}{\ignorespaces Basic Dual\_EC\_DRBG algorithm result\relax }}{12}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {2.1.2}Dual\_EC\_DRBG\_basic\_with\_backdoor.sagews}{12}}
\@writefile{lof}{\contentsline {figure}{\numberline {16}{\ignorespaces Custom Dual\_EC\_DRBG backdoor\relax }}{13}}
\@writefile{lof}{\contentsline {figure}{\numberline {17}{\ignorespaces Get\_Internal\_State function\relax }}{13}}
\@writefile{lof}{\contentsline {figure}{\numberline {18}{\ignorespaces Basic Dual\_EC\_DRBG backdoor result\relax }}{14}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {2.1.3}Dual\_EC\_DRBG\_2006.sagews}{14}}
\@writefile{lof}{\contentsline {figure}{\numberline {19}{\ignorespaces Get\_H\_Adin function\relax }}{14}}
\@writefile{lof}{\contentsline {figure}{\numberline {20}{\ignorespaces Dual\_EC\_DRBG version 2006 with additional input result\relax }}{15}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {2.1.4}Dual\_EC\_DRBG\_2006\_with\_backdoor.sagews}{15}}
\@writefile{lof}{\contentsline {figure}{\numberline {21}{\ignorespaces Predict\_Next function version 2006 with additional input\relax }}{16}}
\@writefile{lof}{\contentsline {figure}{\numberline {22}{\ignorespaces Dual\_EC\_DRBG version 2006 backdoor with predicted additional input result\relax }}{16}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {2.1.5}Dual\_EC\_DRBG\_2007.sagews}{17}}
\@writefile{lof}{\contentsline {figure}{\numberline {23}{\ignorespaces Random\_Generator function with additional update step\relax }}{17}}
\@writefile{lof}{\contentsline {figure}{\numberline {24}{\ignorespaces Dual\_EC\_DRBG version 2007 with additional input and update step result\relax }}{17}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {2.1.6}Dual\_EC\_DRBG\_2007\_with\_backdoor.sagews}{17}}
\@writefile{lof}{\contentsline {figure}{\numberline {25}{\ignorespaces Predict\_Next function version 2007 with additional input\relax }}{18}}
\@writefile{lof}{\contentsline {figure}{\numberline {26}{\ignorespaces Dual\_EC\_DRBG version 2007 backdoor with predicted additional input result\relax }}{18}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.2}Attack TLS on OpenSSL}{19}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {2.2.1}Analysis}{19}}
\@writefile{lof}{\contentsline {figure}{\numberline {27}{\ignorespaces System overview\relax }}{19}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {2.2.2}Design}{20}}
\@writefile{lof}{\contentsline {figure}{\numberline {28}{\ignorespaces Software architecture\relax }}{20}}
\@writefile{lof}{\contentsline {figure}{\numberline {29}{\ignorespaces Program flow\relax }}{21}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {2.2.3}Coding}{22}}
\@writefile{lof}{\contentsline {figure}{\numberline {30}{\ignorespaces Custom Dual\_EC\_DRBG backdoor\relax }}{22}}
\@writefile{lof}{\contentsline {figure}{\numberline {31}{\ignorespaces get\_random function, dual\_ec.c\relax }}{24}}
\@writefile{lof}{\contentsline {figure}{\numberline {32}{\ignorespaces get\_adin function, dual\_ec.c\relax }}{25}}
\@writefile{lof}{\contentsline {figure}{\numberline {33}{\ignorespaces Packet analyser, cap.py\relax }}{25}}
\@writefile{lof}{\contentsline {figure}{\numberline {34}{\ignorespaces C library utilisation, main.py\relax }}{26}}
\@writefile{lof}{\contentsline {figure}{\numberline {35}{\ignorespaces Addition input list generation, adin.py\relax }}{27}}
\@writefile{lof}{\contentsline {figure}{\numberline {36}{\ignorespaces Guess addition input, main.py\relax }}{27}}
\@writefile{lof}{\contentsline {figure}{\numberline {37}{\ignorespaces ECDHE server private key, main.py\relax }}{28}}
\@writefile{lof}{\contentsline {figure}{\numberline {38}{\ignorespaces TLS premaster secret, main.py\relax }}{28}}
\@writefile{lof}{\contentsline {figure}{\numberline {39}{\ignorespaces TLS premaster secret, main.py\relax }}{29}}
\@writefile{toc}{\contentsline {subsubsection}{\numberline {2.2.4}Testing}{29}}
