Generic encryption key

Description

General

The Generic Encryption Key detector catches high entropy strings assigned to a variable identifying an encryption key, such as encryption_key or ENCRYPT_KEY. These keys are used to encrypt data at the application level (for example database column encryption, file encryption, or cookie signing), so a leak lets an attacker decrypt any data protected with them.

This detector is dedicated to encryption keys: other sensitive assignments such as secret, token, or api_key are handled by the Generic high entropy secret detector.

Specifications

An assignment is any statement of the form {assigned_variable} {assignment_token} {value}, like for instance: my_variable = "HelloWorld".

For this detector, the {assigned_variable} must contain a word matching (encryption|encrypt)[_.-]?key, not directly preceded by a letter or digit.

Examples: encryption_key, ENCRYPT_KEY, data_encryption-key, and encryptionKey are valid assigned_variables.

Then the {value} must be a high entropy string, that is to say it must:

• Follow this regular expression: [a-zA-Z0-9_.+/~$-]([a-zA-Z0-9_.+/=~$!%-]|\\\\(?![ntr\"])){14,1022}[a-zA-Z0-9_.+/=~$!%-]
• Contain at least one digit
• Have a Shannon entropy of at least 3
• Look random rather than like natural language (perplexity check)
• Pass the post validation steps (see hereunder)

Example: Overall, encryption_key := hj65_klhz/trlupok76 is a valid assignment for this detector and will be caught.

Revoke the secret

This detector catches generic encryption keys, hence GitGuardian cannot infer the concerned service. To properly rotate the key:

1. Understand what application or service uses the key.
2. Generate a new key and re-encrypt the data protected with the leaked one, following the documentation of the concerned service.

Examples

Examples that WILL be caught

- text: |
    encryption_key = hj65_klhz/trlupok76
  apikey: hj65_klhz/trlupok76

- text: |
    ENCRYPT_KEY := buaroeuboesanubo234reacubrch
  apikey: buaroeuboesanubo234reacubrch

- text: |
    data_encryption_key: v8Ur2gWshja+Ejh7ba9j
  apikey: v8Ur2gWshja+Ejh7ba9j

Examples that WILL NOT be caught

• The assigned variable does not identify an encryption key (the Generic high entropy secret detector may catch it instead):

- text: |
    api_key = hj65_klhz/trlupok76

• The high entropy string is too short:

- text: |
    encryption_key = hj65_klhz

• The string does not contain a digit or its entropy is not high enough:

- text: |
    encryption_key = xobxobxobxobxobxobxob

• The value matches an excluded pattern, like an environment variable reference or a placeholder:

- text: |
    encryption_key = process.env.ENCRYPTION_KEY

Details for Generic Encryption Key

• High Recall: False

• Validity Check: False

• Occurrences found for one million commits: 335.35

• Prefixed: False

• PreValidators:
  Here is a list of the validation steps the document must pass before being analyzed.

- type: FilenameBanlistPreValidator
  include_default_banlist_extensions: true
  ban_markup: true
  banlist_extensions:
    - "^(cs|x|p|s|r|m)?html5?~?$"
    - "^(mdx?|markdown|mdown|mkdn)~?$"
  banlist_filenames:
    - hash
    - list/k\.txt$
    - list/plex\.txt$
    - \.csproj$
    - tg/mtproto\.json
    - \/distinfo$
- type: ContentWhitelistPreValidator
  patterns:
    - (encryption|encrypt)[_.-]?key

• PostValidators:
  After being caught, the matched string must contain at least one digit, have a Shannon entropy of at least 3, and pass a perplexity check ensuring it looks random. It is then filtered through an extensive set of banlists (common example values, placeholders, identifiers, file paths, dates, version numbers) largely shared with the Generic high entropy secret detector.