Recent posts on ROT256.
Introduction In this post we just want to cover a fun bug we found: fun because the math itself is interesting, and fun because it breaks just the right way. The bug is issue #44 in Inferno , which is a Rust implementation of the Limbo MPC-in-the-head zero-knowledge argument, which is an improvement upon the KKW scheme . The bug in the implementation is one character long, surprisingly common,…
Introduction This series of posts aims to be a comprehensive collection of facts, protocols, and theorems related to the information-theoretic foundations of multilinear proof systems. By “multilinear proof system” we refer to a system with multilinear polynomials as the underlying “arithmetization” of the proof system: where satisfiability of the computation, a (RAM)…
Happy new year! Here is a writeup for the challenge Spikey Elf from the 38C3 CTF by HXP. The Challenge We are given the following code: #!/usr/bin/env sage proof . all ( False ) bits = 1024 errs = 16 p = random_prime ( 2 ^ ( bits // 2 )) q = random_prime ( 2 ^ ( bits // 2 )) n = p * q e = 0x10001 print ( f ' { n = : #x } ' ) print ( f ' { e = : #x } ' ) flag = pow ( int . from_bytes ( open (…
Introduction The Border Gateway Protocol (BGP) is the central protocol of the internet, responsible for configuring routing tables of autonomous systems (ASes) across the globe. Unfortunately, it is incredibly vulnerable, and attempts to bolt cryptography onto BGP have been largely unsuccessful. This is partly because of a mismatch between how BGP works and how cryptographic signatures work. In…
This a short post explaining the multivariate sum-check : a fundamental subprotocol used throughout multivariate succinct arguments (e.g. Spartan, HyperPlonK, etc). Roughly speaking, it often serves the same role as the divisibility check in the univariate contexts. This post assumes familiarity with finite fields, polynomials and lagrange interpolation/basis.
Introduction In this post we will take a look at the F ast R eed-Solomon I OP (FRI) proximity test, which enables an untrusted prover to convince a verifier that a committed vector is close to a Reed-Solomon codeword with communication only poly-logarithmic in the dimension of the code. This is readily used to construct practically efficient zkSNARKs from just cryptographic hash functions (rather…
Or, how to use Signed HTTP Exchanges (SXG) for good by building a trustworthy software distribution method for the web. Intro. In-Browser Crypto: It’s Everywhere. In this post we will look at web applications deploying cryptography to protect users in the event of the service operator going rouge (or being hacked). Prominently among such applications are those offering end-to-end encryption…
In applications where membership of the Merkle tree must be proved inside a SNARK, the concrete cost of expressing the compression function in the proof system (in terms of gates/R1CS constraints etc.) affects performance of the prover massively. This has lead to the study/creation of so-called SNARK-friendly hash functions: hash functions with ‘’nice algebraic’’…
This is the companion post to a tool, git-ring , that I recently released on Github. Github/Gitlab makes the public keys of its users publicly available (at github.com/USERNAME.keys and gitlab.com/USERNAME.keys), this means that these services bind the users identity to public keys via this endpoint. Git-ring “exploits” this to enable the creation of (cryptographic) proofs showing…
The “H1” Challenge We are given two files. A python3 script ( chall.py ): Python Script (click to expand) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97…
What is Pass? What is “Pass; the standard unix password manager”? Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer,…
A walk-through of real-world AES fault injection for dummies on a shoestring budget. Introduction In the post we will setup a microcontroller which encrypts using AES with an unknown key, then explore how to recover the full AES key from simply (randomly) glitching the power-supply which will introduce faults in the arithmetic during the computation of AES encryption. This post is designed to…
HalfFeed The HalfFeed service allows us to encrypt almost any message. The only restriction is that it cannot contain the string “cat flag”: def encrypt ( halffeed ): global nonce P = recv_data ( 'plaintext' ) if b 'cat flag' in P : print ( '[EXCEPTION] Invalid Command "cat flag"' ) exit () C , T = halffeed . encrypt ( nonce . to_bytes ( 16 , byteorder = 'big' ), P ) send_data (…
The “3DES-HMAC” challenge This challenge is written in Rust. So it is automatically secure, right? – Challenge Text Original challenge files can be found here . Setting the stage We are given a simple web-application written in Rust using the Actix framework. Looking at the server code we find a handler which allows us to retrieve the flag if we are logged in as “…
Introduction Update: Slides from the related presentation at DTU, can now be found here . Those who have read Howard M. Heys excellent introduction to Linear and Differential cryptanalysis or even worked with linear hulls (e.g. read the Rijndael book ) might be tempted to believe that the absence of linear approximations with a non-zero correlation implies that the cipher is immune to linear…
The 34C3 CTF 34C3 has just ended and the year is quickly coming to an end. As usual I had the pleasure of playing the CTF at CCC. What I particularly like about the C3 CTF is the ingenuity and variety of challenges (not just binary reversing + exploitation and web). The “Software Update” challenge We are given 3 files: installer.py public_key.der sw_update.zip The challenge is a…
Introduction Google Summer of Code Every year Google arranges their Summer of Code program , giving students the opportunity of contributing to open source projects during the summer and receive a stipend. Over this summer I have completed the program with the WireGuard team (under the Linux foundation umbrella), with the goal to create a user space implementation of WireGuard . WireGuard…
Introduction Pwnies at Copenhagen University arranged this years CTF at Bornhack . This is a short post detailing 2 of the crypto challenges I designed for this years CTF. Birthday-PRESENT The challenge (and solution) can be found on github The Sweet16 / birthday-PRESENT challenge is based on a variant of the Sweet32 vulnability, with a block cipher ( small scale variant of PRESENT ) having a…
The Bluesound POWERNODE is a “Wireless Stereo Component”, which allows the user to stream to an older analogue sound system. It also includes an amp. I (sadly) happen to have such a device at home and decided to take a look at the firmware. The results were as expected. Most of the product line appears to be vulnerable, since they run mostly the same software. I would also be surprised…
Writeup of a challenge completed some time ago. Modified challenge code here The challenge The protocol is essentially SPEKE , but rather than use one large password, a number of smaller passwords are used and combined to avoid online bruteforce. Talking to yourself The first observation is that two sessions with the same server can convince each other that they know the passwords. This may not…
NeoDNS : A new DNS like the one we know The goal We wish to design a new DNS solution which offers the following: Ease of migration: the solution must be able to coexists with the existing DNS and PKI. Adopting NeoDNS should not break backwards compatibility. Authentication of domains: users must be able to verify that they are talking to the legitimate service, without a globally trusted central…
The challenge The challenge text on pwntable: I made a multi-thread based HTTP proxy server written in C. It works fine for simple case, but it crashes occasionally. Can you find me the bug? (it has watchdog, proxy server will be respawned after crashing) * uname -a of server : FreeBSD bsd32 9.1-RELEASE FreeBSD 9.1-RELEASE #0 r243826: Tue Dec 4 06:55:39 UTC 2012 root@obrian.cse.buffalo.edu…
The challenge The challenge text on pwntable: How fast can you pwn me? Running at : nc pwnable.kr 9005 Connecting, we are given a base64 block. $ nc pwnable.kr 9005 --------------------------------------------------- - Welcome to AEG (Automatic Exploit Generation) - --------------------------------------------------- I will send you a newly compiled binary (probably exploitable) in base64 format…
ExpressLRS: Hello World Introduction SSFH (Spread Spectrum Frequency Hopping) Sync Packets
ProbSet