ROT256 : Cryptography & Other Random Bits.

Multilinear Proofs, Part I: Cubes & Roots

Thu, 03 Jul 2025 00:00:00 +0000

Introduction

This series of posts aims to be a comprehensive collection of facts, protocols, and theorems related to the information-theoretic foundations of multilinear proof systems. By “multilinear proof system” we refer to a system with multilinear polynomials as the underlying “arithmetization” of the proof system: where satisfiability of the computation, a (RAM) machine or circuit, is expressed as randomized relations between multilinear polynomials and the witness is the evaluation of multilinear polynomials over some tensor product.

Spikey Elf @ HXP 38C3 CTF

Thu, 02 Jan 2025 00:00:00 +0000

Happy new year!

Here is a writeup for the challenge Spikey Elf from the 38C3 CTF by HXP.

The Challenge

We are given the following code:

#!/usr/bin/env sage
proof.all(False)

bits = 1024
errs = 16

p = random_prime(2^(bits//2))
q = random_prime(2^(bits//2))
n = p * q
e = 0x10001
print(f'{n = :#x}')
print(f'{e = :#x}')

flag = pow(int.from_bytes(open('flag.txt','rb').read().strip()), e, n)
print(f'{flag = :#x}')

d = inverse_mod(e, lcm(p-1, q-1))
locs = sorted(Subsets(range(bits), errs).random_element())
for loc in locs:
 d ^^= 1 << loc
print(f'{d = :#x}')

And the output:

n = 0x639d87bf6a02786607d67741ebde10aa39746dc8ed22b191ff2
 fefe9c210b3ee2ce68b185dc7f8069e78441bdec1d33e2b342c22
 6b5cde8a49f567ac11a3bcb7ff88eeededdd0d50eb981635920d2
 380a6b878d327b261821355d65b2ef9f807035a70c77252d09787
 c2b3dfafdfa4f5c6b39a1c66c5b39fe9d1ee4b36d86d5
e = 0x10001
flag = 0x40208a7900b1575431a49690030e4eb8be6269edcd3c7b2d
 97ae94a6eb744e9c622d81b95ea45b23ee6e0d773e3dd48adc6bb
 2c7c6423d8fd52eddcc6c0710f607590d5fc57a45883a36ad0d85
 1f84d4bee86ffaf65bc1773f97430080926550dce3666051befa8
 7bacc01d44dd09baa6ae93a85cedde5933f7cbbe2cb56cdd
d = 0x1a54893799cd9805600cfaee1c8a408813525db268fbc29e7f2
 a81eb47b64d2dd20dc8be52b6332e375f92a120957042a92a4bd4
 f5e13ef14e9b398bec330602dc9dbbb63cf3dfe6d33bf95d08306
 a894b052e005a57cc41673fe866f4f8b2ffb0aa26fc4c51a8f513
 5e40df2107e0259ddf4c1d9c1eb41b1f702b135c941

In other words:

Proof-Carrying Border Gateway Protocol

Wed, 25 Dec 2024 00:00:00 +0000

Introduction

The Border Gateway Protocol (BGP) is the central protocol of the internet, responsible for configuring routing tables of autonomous systems (ASes) across the globe. Unfortunately, it is incredibly vulnerable, and attempts to bolt cryptography onto BGP have been largely unsuccessful. This is partly because of a mismatch between how BGP works and how cryptographic signatures work. In this post we will explore an alternate way of securing BGP using Proof-Carrying Data. This is particularly relevant because:

Multivariate Sum-Check

Sun, 14 Apr 2024 00:00:00 +0000

This a short post explaining the multivariate sum-check: a fundamental subprotocol used throughout multivariate succinct arguments (e.g. Spartan, HyperPlonK, etc). Roughly speaking, it often serves the same role as the divisibility check in the univariate contexts.

This post assumes familiarity with finite fields, polynomials and lagrange interpolation/basis.

Fast Reed-Solomon IOP (FRI) Proximity Test

Sun, 19 Nov 2023 00:00:00 +0000

Introduction

In this post we will take a look at the Fast Reed-Solomon IOP (FRI) proximity test, which enables an untrusted prover to convince a verifier that a committed vector is close to a Reed-Solomon codeword with communication only poly-logarithmic in the dimension of the code. This is readily used to construct practically efficient zkSNARKs from just cryptographic hash functions (rather random oracles), without the need for a trusted setup.

Code Signing for Web Applications Using SXG

Sun, 20 Aug 2023 00:00:00 +0000

Or, how to use Signed HTTP Exchanges (SXG) for good by building a trustworthy software distribution method for the web.

Intro. In-Browser Crypto: It’s Everywhere.

In this post we will look at web applications deploying cryptography to protect users in the event of the service operator going rouge (or being hacked). Prominently among such applications are those offering end-to-end encryption (E2EE) for files storage, calls or messaging, wherein a malicious service provider cannot see the contents of the users communication because it is encrypted before being to the service. All such applications must use cryptography executed on the client-side, which in the case of web applications means Javascript or Web Assembly served by a webserver and executed in the users browser upon visiting the site hosting the application. Here is just a small selection of a diverse set of applications using this type of in-browser cryptography:

Mixed Trees: Trade-Off Between (In/Out-Of)-Circuit Costs

Wed, 19 Apr 2023 00:00:00 +0000

In applications where membership of the Merkle tree must be proved inside a SNARK, the concrete cost of expressing the compression function in the proof system (in terms of gates/R1CS constraints etc.) affects performance of the prover massively.

This has lead to the study/creation of so-called SNARK-friendly hash functions: hash functions with ‘’nice algebraic’’ descriptions over (large) finite fields, enabling an efficient description of the function as an arithmetic circuit over the field on which the SNARK operates. Unfortunately such compression functions are often inherently expensive to evaluate, due to their use of field operations in large finite fields – which is substantially slower than word/bit operations used in e.g. SHA256 or Blake2s.

Git-Ring: Easy & Flexible SSH Ring Signatures.

Mon, 10 Oct 2022 00:00:00 +0000

This is the companion post to a tool, git-ring, that I recently released on Github.

Github/Gitlab makes the public keys of its users publicly available (at github.com/USERNAME.keys and gitlab.com/USERNAME.keys), this means that these services bind the users identity to public keys via this endpoint. Git-ring “exploits” this to enable the creation of (cryptographic) proofs showing membership among a set of users (or organizations) without revealing the identity of the person generating the proof. The public keys of everyone (including the signer) is automatically downloaded from Github, while the tool finds the correct private key on the signers local computer. All this combined makes using the tool pretty easy, as shown below, where we sign a message and then verify the resulting signature.

H1 @ Google CTF 2021

Sat, 24 Jul 2021 00:00:00 +0000

The “H1” Challenge

We are given two files. A python3 script (chall.py):

Python Script (click to expand)

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167


#!/usr/bin/python3
import os
import hashlib
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import padding
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes

flag = open('flag.txt').read()
INF = (1, 1, 0)

mod = 8948962207650232551656602815159153422162609644098354511344597187200057010413552439917934304191956942765446530386427345937963894309923928536070534607816947
a = 6294860557973063227666421306476379324074715770622746227136910445450301914281276098027990968407983962691151853678563877834221834027439718238065725844264138
b = 3245789008328967059274849584342077916531909009637501918328323668736179176583263496463525128488282611559800773506973771797764811498834995234341530862286627
n = 8948962207650232551656602815159153422162609644098354511344597187200057010413418528378981730643524959857451398370029280583094215613882043973354392115544169
G = (5139617820728399941653175323358137352238277428061991823713659546881441331696699723004749024403291797641521696406798421624364096550661311227399430098134141,
 1798860115416690485862271986832828064808333512613833729548071279524320966991708554765227095605106785724406691559310536469721469398449016850588110200884962,
 5042518522433577951395875294780962682755843408950010956510838422057522452845550974098236475624683438351211176927595173916071040272153903968536756498306512)

def Double(p):
 x, y, z = p
 if z == 0 or y == 0:
 return INF
 ysqr = y * y % mod
 zsqr = z * z % mod
 s = 4 * x * ysqr % mod
 m = (3 * x * x + a * zsqr * zsqr) % mod
 x2 = (m * m - 2 * s) % mod
 y2 = (m * (s - x2) - 8 * ysqr * ysqr) % mod
 z2 = 2 * y * z % mod
 return x2, y2, z2

def Add(p, q):
 if p[2] == 0:
 return q
 if q[2] == 0:
 return p
 x1, y1, z1 = p
 x2, y2, z2 = q
 z1sqr = z1 * z1 % mod
 z2sqr = z2 * z2 % mod
 u1 = x1 * z2sqr % mod
 u2 = x2 * z1sqr % mod
 s1 = y1 * z2 * z2sqr % mod
 s2 = y2 * z1 * z1sqr % mod
 if u1 == u2:
 if s1 != s2:
 return INF
 else:
 return Double(p)
 h = u2 - u1 % mod
 hsqr = h * h % mod
 hcube = hsqr * h % mod
 r = s2 - s1 % mod
 t = u1 * hsqr % mod
 x3 = (r * r - hcube - 2 * t) % mod
 y3 = (r * (t - x3) - s1 * hcube) % mod
 z3 = h * z1 * z2 % mod
 return x3, y3, z3

def Multiply(p, x):
 if p == INF:
 return p
 res = INF
 while x:
 x, r = divmod(x, 2)
 if r:
 res = Add(res, p)
 p = Double(p)
 return res

def Transform(m, l):
 z = m
 shift = l - n.bit_length()
 if shift > 0:
 z >>= shift
 return z

def RNG(nbits, a, b):
 nbytes = nbits // 8
 B = os.urandom(nbytes)
 return a * sum([B[i] * b ** i for i in range(len(B))]) % 2**nbits

def Sign(msg, d):
 h = hashlib.sha512(msg)
 z = Transform(int.from_bytes(h.digest(), 'big'), h.digest_size*8)
 k = RNG(n.bit_length(), 16843009, 4294967296)
 x1, y1, z1 = Multiply(G, k)
 r = (x1 * pow(z1, -2, mod) % mod) % n
 s = pow(k, -1, n) * (z + r * d) % n
 assert int(s) == pow(k, -1, n) * (z + r * d) % n
 return r, s

def Verify(msg, Q, r, s):
 h = hashlib.sha512(msg)
 z = Transform(int.from_bytes(h.digest(), 'big'), h.digest_size*8)
 u1 = z*pow(s, -1, n) % n
 u2 = r*pow(s, -1, n) % n
 x1, y1, z1 = Add(Multiply(G, u1), Multiply(Q, u2))
 return r == (x1 * pow(z1, -2, mod) % mod) % n

def Encrypt(plaintext, x):
 key = hashlib.sha256(str(x).encode()).digest()
 aes = algorithms.AES(key)
 encryptor = Cipher(aes, modes.ECB(), default_backend()).encryptor()
 padder = padding.PKCS7(aes.block_size).padder()
 padded_data = padder.update(plaintext) + padder.finalize()
 ciphertext = encryptor.update(padded_data) + encryptor.finalize()
 return ciphertext

def Decrypt(ciphertext, x):
 key = hashlib.sha256(str(x).encode()).digest()
 aes = algorithms.AES(key)
 decryptor = Cipher(aes, modes.ECB(), default_backend()).decryptor()
 unpadder = padding.PKCS7(aes.block_size).unpadder()
 decrypted_data = decryptor.update(ciphertext) + decryptor.finalize()
 plaintext = unpadder.update(decrypted_data) + unpadder.finalize()
 return plaintext

# Alice and Bob have their keys:
da = RNG(n.bit_length(), 1, 256)
Qa = Multiply(G, da)
db = RNG(n.bit_length(), 1, 256)
Qb = Multiply(G, db)
x1a, y1a, z1a = Multiply(Qb, da)
ka = x1a * pow(z1a, -2, mod) % mod
x1b, y1b, z1b = Multiply(Qa, db)
kb = x1b * pow(z1b, -2, mod) % mod

# Alice sends message to Bob:
msga = b'Hello Bob.'
ra, sa = Sign(msga, da)
ca = Encrypt(msga, ka)
print('Alice -> Bob:', (ra, sa, int.from_bytes(ca, 'big')))

# Bob receives and verifies message:
recv_msg = Decrypt(ca, kb)
assert Verify(recv_msg, Qa, ra, sa)

# Bob sends message to Alice:
msgb = b'Hello Alice.'
rb, sb = Sign(msgb, db)
cb = Encrypt(msgb, kb)
print('Bob -> Alice:', (rb, sb, int.from_bytes(cb, 'big')))

# Alice receives and verifies message:
recv_msg = Decrypt(cb, ka)
assert Verify(recv_msg, Qb, rb, sb)

# Alice sends message to Bob:
msga = (f'Dinner tonight? What about Tapioca? Btw, here is the flag: {flag}').encode()
ra, sa = Sign(msga, da)
ca = Encrypt(msga, ka)
print('Alice -> Bob:', (ra, sa, int.from_bytes(ca, 'big')))

# Bob receives and verifies message:
recv_msg = Decrypt(ca, kb)
assert Verify(recv_msg, Qa, ra, sa)

# Bob sends message to Alice:
msgb = b'Dinner sounds good. Thanks for the flag.'
rb, sb = Sign(msgb, db)
cb = Encrypt(msgb, kb)
print('Bob -> Alice:', (rb, sb, int.from_bytes(cb, 'big')))

# Alice receives and verifies message:
recv_msg = Decrypt(cb, ka)
assert Verify(recv_msg, Qb, rb, sb)

And the following output (stdout from the python script):

(In)Security of the "Pass" password manager

Fri, 01 Jan 2021 00:00:00 +0000

What is Pass?

What is “Pass; the standard unix password manager”?

Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard command line file management utilities.

Differential Fault Injection Against AES on Atmega328

Mon, 09 Mar 2020 00:00:00 +0000

A walk-through of real-world AES fault injection for dummies on a shoestring budget.

Introduction

In the post we will setup a microcontroller which encrypts using AES with an unknown key, then explore how to recover the full AES key from simply (randomly) glitching the power-supply which will introduce faults in the arithmetic during the computation of AES encryption.

This post is designed to serve as a tutorial and enable the reader to follow along. If you get stuck anywhere (or lack the hardware), just skip the current step and pick up the provided files which will enable you to continue from the next step onwards. To this end there is an associated Github repository which contains the victim code, the attack and visualization scripts as well as the raw samples I collected – which can be used in lieu of setting up the hardware yourself.

HalfFeed @ Codegate 2020

Thu, 13 Feb 2020 00:00:00 +0000

HalfFeed

The HalfFeed service allows us to encrypt almost any message. The only restriction is that it cannot contain the string “cat flag”:

def encrypt(halffeed):
 global nonce
 P = recv_data('plaintext')

 if b'cat flag' in P:
 print('[EXCEPTION] Invalid Command "cat flag"')
 exit()

 C, T = halffeed.encrypt(nonce.to_bytes(16, byteorder='big'), P)

 send_data('ciphertext', C)
 send_data('tag', T)
 nonce += 1

We can also provide a ciphertext, that is split on “;”. If any of the segments is “cat flag” we win:

def execute(halffeed):
 N = recv_data('nonce')
 C = recv_data('ciphertext')
 T = recv_data('tag')

 P = halffeed.decrypt(N, C, T)

 if P is not None:
 cmds = P.split(b';')
 for cmd in cmds:
 if cmd.strip() == b'cat flag':
 with open('./flag') as f:
 print(f.read())
 else:
 print('[EXCEPTION] Unknown Command')
 else:
 print('[EXCEPTION] Authentication Failed')
 exit()

We have our job cut out for us.

3DES-HMAC @ AU-CTF

Thu, 16 May 2019 00:00:00 +0000

The “3DES-HMAC” challenge

This challenge is written in Rust. So it is automatically secure, right?

– Challenge Text

Original challenge files can be found here.

Setting the stage

We are given a simple web-application written in Rust using the Actix framework.

Looking at the server code we find a handler which allows us to retrieve the flag if we are logged in as “almighty_administrator” with the “is_admin” key set to “of_course”:

Zero-Correlation Linear Cryptanalysis

Sun, 01 Apr 2018 00:00:00 +0000

Introduction

Update: Slides from the related presentation at DTU, can now be found here.

Those who have read Howard M. Heys excellent introduction to Linear and Differential cryptanalysis or even worked with linear hulls (e.g. read the Rijndael book) might be tempted to believe that the absence of linear approximations with a non-zero correlation implies that the cipher is immune to linear cryptanalysis. However the existence of linear hulls with correlation zero also allows an attacker to distinguish the cipher from a random permutation with high probability. In this entry we will explore the work by Andrey Bogdanov and Vincent Rijmen on so-called “Zero-Correlation Linear Cryptanalysis” and apply the technique to a toy cipher.

Software Update @ 34C3

Sat, 30 Dec 2017 15:00:00 +0000

The 34C3 CTF

34C3 has just ended and the year is quickly coming to an end. As usual I had the pleasure of playing the CTF at CCC. What I particularly like about the C3 CTF is the ingenuity and variety of challenges (not just binary reversing + exploitation and web).

The “Software Update” challenge

We are given 3 files:

installer.py
public_key.der
sw_update.zip

The challenge is a firmware updating service (provided in installer.py) and an example of a signed update (provided in sw_update.zip). The challenge is similar to flash from 32C3.

GSoC: WireGuard

Thu, 07 Sep 2017 00:00:00 +0000

Introduction

Google Summer of Code

Every year Google arranges their Summer of Code program, giving students the opportunity of contributing to open source projects during the summer and receive a stipend. Over this summer I have completed the program with the WireGuard team (under the Linux foundation umbrella), with the goal to create a user space implementation of WireGuard.

WireGuard

WireGuard is a simple (layer 3) VPN protocol based around a Noise pattern (in particular Noise_IKpsk2). Among the primary features offered by WireGuard are:

Bornhack CTF (2017)

Wed, 30 Aug 2017 00:00:00 +0000

Introduction

Pwnies at Copenhagen University arranged this years CTF at Bornhack.

This is a short post detailing 2 of the crypto challenges I designed for this years CTF.

Birthday-PRESENT

The challenge (and solution) can be found on github

The Sweet16 / birthday-PRESENT challenge is based on a variant of the Sweet32 vulnability, with a block cipher (small scale variant of PRESENT) having a block size of 32-bit, which makes the attack more practical.

Participants were given the C source code of a server which writes the flag into a large buffer (repeated), then allows the user to overwrite the start of the buffer with any plaintext of their choosing. The buffer is then encrypted under a random key using Small-PRESENT in CBC mode and the ciphertext is returned to the user.

Bluesound POWERNODE

Fri, 23 Dec 2016 00:00:00 +0000

The Bluesound POWERNODE is a “Wireless Stereo Component”, which allows the user to stream to an older analogue sound system. It also includes an amp. I (sadly) happen to have such a device at home and decided to take a look at the firmware. The results were as expected.

Most of the product line appears to be vulnerable, since they run mostly the same software. I would also be surprised if this is the only vulnerability in the device.

PAKE @ Hitcon 2016

Tue, 15 Nov 2016 15:00:00 +0000

Writeup of a challenge completed some time ago. Modified challenge code here

The challenge

The protocol is essentially SPEKE, but rather than use one large password, a number of smaller passwords are used and combined to avoid online bruteforce.

Talking to yourself

The first observation is that two sessions with the same server can convince each other that they know the passwords.

This may not appear very useful. But this allows us to bruteforce one small password (with 4-bits of entropy) at a time. We guess the next unknown password and let the two connections convince each other they know the remaining passwords. There are some minor details to take care of before we can do this, observe the core loop of the server:

NeoDNS

Sat, 20 Aug 2016 00:00:00 +0200

NeoDNS : A new DNS like the one we know

The goal

We wish to design a new DNS solution which offers the following:

Ease of migration: the solution must be able to coexists with the existing DNS and PKI. Adopting NeoDNS should not break backwards compatibility.
Authentication of domains: users must be able to verify that they are talking to the legitimate service, without a globally trusted central authorit(y|ies). We relax this requirement and simple demand that an attempt at impersonation should become publicly known.
Performant: minimal overhead when compared with the existing systems.

Assumptions

It is assumed that the reader:

Proxy Server @ Pwnable

Fri, 29 Apr 2016 20:04:43 +0100

The challenge

The challenge text on pwntable:

I made a multi-thread based HTTP proxy server written in C. It works fine for simple case, but it crashes occasionally. Can you find me the bug? (it has watchdog, proxy server will be respawned after crashing)

* uname -a of server : FreeBSD bsd32 9.1-RELEASE FreeBSD 9.1-RELEASE #0 r243826: Tue Dec 4 06:55:39 UTC 2012 root@obrian.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386

Download : http://pwnable.kr/bin/myproxy

Running at : nc pwnable.kr 9903

AEG @ Pwnable

Fri, 01 Apr 2016 15:54:08 +0200

The challenge

The challenge text on pwntable:

How fast can you pwn me?

Running at : nc pwnable.kr 9005

Connecting, we are given a base64 block.

$ nc pwnable.kr 9005
---------------------------------------------------
- Welcome to AEG (Automatic Exploit Generation) -
---------------------------------------------------

I will send you a newly compiled binary (probably exploitable) in base64 format
after you get the binary, I will be waiting for your input as a plain text
when your input is given, I will execute the binary with your input as argv[1]
you have 10 seconds to build exploit payload
wait...
H52Qf4owMSIgQAAACBMmFADAB4CDCSHIgIgQiMKEiGJIuKjQIg4ACgBY5ABgAwA
... (many lines ommited) ...
ACGanhDCeu6EcUFELMSGUKXHojPmzOeQEivBIJYQmWKYXwR0YSgoB
here, get this binary and give me some crafted argv[1] for explotation
remember you only have 10 seconds... hurry up!

Which turns out to be a gzip file containing a 64-bit elf binary:

Mon, 01 Jan 0001 00:00:00 +0000

ExpressLRS: Hello World

Introduction

SSFH (Spread Spectrum Frequency Hopping)

Sync Packets

Mon, 01 Jan 0001 00:00:00 +0000

ProbSet