Static Detection of Post-Quantum Cryptographic Algorithms in Stripped Binaries for Digital Forensic Examination and Migration Assurance

• URL: http://arxiv.org/abs/2608.25122v2
• Date: Sun, 30 Aug 2026 02:22:02 GMT
• Title: Static Detection of Post-Quantum Cryptographic Algorithms in Stripped Binaries for Digital Forensic Examination and Migration Assurance
• Abstract summary: This paper presents Kestrel, a static analysis method that identifies an algorithm from the number-theoretic transform constant tables its arithmetic depends on.<n>It applies it to the standardised lattice schemes ML-KEM and ML-DSA, for which no prior method could confirm, from a shipped binary alone.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Identifying which post-quantum algorithm a compiled binary implements is a core problem in binary analysis, and it becomes acute once the binary has been stripped, statically linked, and optimised, since the symbols, library dependencies, and runtime behaviour that conventional discovery tools rely on are then gone. This paper presents Kestrel, a static analysis method that identifies an algorithm from the number-theoretic transform constant tables its arithmetic depends on, and applies it to the standardised lattice schemes ML-KEM and ML-DSA, for which no prior method could confirm, from a shipped binary alone, that a quantum-vulnerable algorithm had been replaced by its approved successor. The fingerprints Kestrel derives from public scheme parameters are localised by a normalisation-and-multiset-matching procedure; the false-positive probability is established analytically. Across four independent implementation lineages and all build transformations, including compiler-level obfuscation, Kestrel achieved recall of 128 of 128 with zero false positives. Applied to 6,224 binaries on a production Linux system, it disclosed twelve uncatalogued programs containing ML-KEM, among them the OpenSSH key-exchange program and the container-management stack, where post-quantum code had entered production through the language runtime without the awareness of the projects distributing them. Kestrel distinguishes genuine implementations from advertised claims not backed by the underlying code, attributes each detection to its originating codebase, and, in a forensic disk-image trial, recovered a detection from unallocated space after the deleted binary could no longer be reconstructed. It thus provides a practical basis for cryptographic migration assurance, compliance verification, software supply-chain inspection, and post-quantum forensic examination.

Related papers

• Behavior Specification-Guided Program Synthesis for Binary Deobfuscation [16.829765747882494]
  Deobfuscation is critical to reverse engineering and security analysis because it restores the readability and analyzability of obfuscated code.<n>Existing binary deobfuscation methods typically decompile binaries into pseudocode and then apply structural transformations.<n>BinMirror is an approach that reformulates binary deobfuscation as a behavior-specification-guided program synthesis task.
  arXiv  Detail & Related papers  (2026-08-21T00:02:56Z)
• BioZKFHE: Scalable Encrypted Biometric Identification via Verifiable Homomorphic Similarity Evaluation [20.524348401618735]
  BioZKFHE is a framework for scalable encrypted biometric identification via verifiable homomorphic similarity evaluation.<n>It combines BGV homomorphic computation with committee-mediated proof opening/decryption and smart-contract verification of opened proof batches.<n>Experiments on FaceNet and MobileFaceNet show near-lossless biometric utility, up to 67 percent encrypted-storage reduction, and about 22 to 44 seconds end-to-end proof-verified runtime.
  arXiv  Detail & Related papers  (2026-07-24T08:08:54Z)
• Bayesian-Calibrated Detection of Hallucinated Package Imports in AI-Assisted Code [0.0]
  calibrated layer exploits PyPI metadata signals to surface registered-but-suspicious packages that a binary registry detector misses.<n>We evaluate the calibration on a merged corpus of 1,734 snippets Python.
  arXiv  Detail & Related papers  (2026-06-11T21:15:39Z)
• From Attack Simulation to SIEM Rule: Deterministic Detection-as-Code Synthesis with Probe-Level Traceability [51.56484100374058]
  Security teams simulate attacks against their own systems to check whether their monitoring would catch a real intruder.<n>A human bridges that gap by hand, reading each finding and writing the corresponding Sigma rule.<n>We show this translation can be partially automated when probes are drawn from a locked corpus.
  arXiv  Detail & Related papers  (2026-06-03T14:26:25Z)
• From I/O to Code with Discovery Agent [103.88427301265669]
  We propose DIO-Agent, a discovery agent for IO2Code.<n>Our method frames IO2Code as an evolutionary search over discrete program space.<n>Extensive experiments show that DIO-Agent consistently outperforms both traditional program-by-example method and SOTA evolution-agent baselines.
  arXiv  Detail & Related papers  (2026-05-14T18:57:32Z)
• VectorSmuggle: Steganographic Exfiltration in Embedding Stores and a Cryptographic Provenance Defense [0.0]
  Modern retrieval-augmented generation (RAG) systems convert sensitive content into high-dimensional embeddings and store them in vector databases that treat the resulting numerical artifacts as opaque.<n>We show this opens a class of steganographic exfiltration attacks.<n>An attacker with write access to the ingestion pipeline can hide payload data inside embeddings.
  arXiv  Detail & Related papers  (2026-05-13T16:44:20Z)
• Quantum-Safe Code Auditing: LLM-Assisted Static Analysis and Quantum-Aware Risk Scoring for Post-Quantum Cryptography Migration [0.0]
  Quantum-Safe Code is a quantum-aware static analysis framework.<n>It uses 15 classes of quantum-vulnerable primitives and a Variational Bouncysolver (VQE) model.<n>On a sample of 602 labelled instances, we achieve 71.98% precision, 100% recall, and an F1 score of 83.71%.
  arXiv  Detail & Related papers  (2026-04-01T07:10:17Z)
• Empirical Study of Code Large Language Models for Binary Security Patch Detection [12.110226735365643]
  Security patch detection (SPD) is crucial for maintaining software security, as unpatched vulnerabilities can lead to severe security risks.<n>In recent years, numerous learning-based SPD approaches have demonstrated promising results on source code.<n>However, these approaches cannot be applied to closed-source applications and proprietary systems that constitute a significant portion of real-world software.
  arXiv  Detail & Related papers  (2025-09-07T13:31:43Z)
• Post-Quantum Cryptography: An Analysis of Code-Based and Lattice-Based Cryptosystems [55.49917140500002]
  Quantum computers will be able to break modern cryptographic systems using Shor's Algorithm.<n>We first examine the McEliece cryptosystem, a code-based scheme believed to be secure against quantum attacks.<n>We then explore NTRU, a lattice-based system grounded in the difficulty of solving the Shortest Vector Problem.
  arXiv  Detail & Related papers  (2025-05-06T03:42:38Z)
• Cryptanalysis via Machine Learning Based Information Theoretic Metrics [58.96805474751668]
  We propose two novel applications of machine learning (ML) algorithms to perform cryptanalysis on any cryptosystem.<n>These algorithms can be readily applied in an audit setting to evaluate the robustness of a cryptosystem.<n>We show that our classification model correctly identifies the encryption schemes that are not IND-CPA secure, such as DES, RSA, and AES ECB, with high accuracy.
  arXiv  Detail & Related papers  (2025-01-25T04:53:36Z)
• Cloning Games, Black Holes and Cryptography [50.022147589030304]
  We introduce a new toolkit for analyzing cloning games.<n>This framework allows us to analyze a new cloning game based on binary phase states.<n>We show that the binary phase variantally optimal bound offers quantitative insights into information scrambling in idealized models of black holes.
  arXiv  Detail & Related papers  (2024-11-07T14:09:32Z)
• FoC: Figure out the Cryptographic Functions in Stripped Binaries with LLMs [51.898805184427545]
  We propose a novel framework called FoC to Figure out the Cryptographic functions in stripped binaries.<n>We first build a binary large language model (FoC-BinLLM) to summarize the semantics of cryptographic functions in natural language.<n>We then build a binary code similarity model (FoC-Sim) upon the FoC-BinLLM to create change-sensitive representations and use it to retrieve similar implementations of unknown cryptographic functions in a database.
  arXiv  Detail & Related papers  (2024-03-27T09:45:33Z)
• Quantum Algorithms for State Preparation and Data Classification based on Stabilizer Codes [0.0]
  We propose a prototype quantum circuit model for classification of classical data. A quantum neural network (QNN) layer is realized by a stabilizer code which consists of many stabilizers. We also consider the first challenge to most applications of quantum computers, including data classification.
  arXiv  Detail & Related papers  (2023-09-18T19:02:54Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.