/>
X
Innovation

GitHub secret key finder released to public

The open-source tool can be used to search for secret keys used to access networks.
Written by Charlie Osborne, Contributing Writer on
screen-shot-2017-01-09-at-07-50-32.jpg
GitHub

A researcher has published a tool for finding secret keys with varying cryptographic strength in git repositories.

The tool, dubbed TruffleHog, is able to search for and locate keys containing high-entropy strings by digging deep into commit history and branches, according to developer Dylan Ayrey.

TruffleHog's search capabilities make it "effective at finding secrets accidentally committed that contain high entropy," Ayrey says, and the tool needs nothing more than GitPython to work.

Ayrey commented:

"This module will go through the entire commit history of each branch, and check each diff from each commit, and evaluate the Shannon entropy for both the base64 character set and hexidecimal character set for every blob of text greater than 20 characters comprised of those character sets in each diff."

TruffleHog calculates entropy levels using a Shannon Entropy (.PDF) calculator. The entropy levels of keys are important, as the more or less information required to determine unknown key variables can alter how difficult it is to crack.

If a high-entropy string is detected, the string is printed to the screen.

Users of TruffleHog said in a Reddit discussion topic that Amazon already uses the tool to preemptively search GitHub for Amazon Web Services (AWS) keys accidentally connected to public repositories, which prevents attackers from snatching the keys, spinning up vast AWS instances and leaving the owners with the bill.

Top 10 tech products revealed at CES 2017 so far

Editorial standards

Related

How much RAM does your Windows 11 PC need?
adobestock-339222220

How much RAM does your Windows 11 PC need?

What is ChatGPT and why does it matter? Here's what you need to know
chat bot

What is ChatGPT and why does it matter? Here's what you need to know

How to nail the 'Do you have any questions for me?' part of the interview
job interview

How to nail the 'Do you have any questions for me?' part of the interview