CHES2016 CTF - Revision history

Coflynn: /* Required AES-128 Format */

2016-06-23T17:41:25Z

‎Required AES-128 Format

Coflynn: /* Timing your AES Implementation */

2016-06-03T12:23:24Z

‎Timing your AES Implementation

Coflynn at 14:59, 1 June 2016

2016-06-01T14:59:28Z

Coflynn: /* Compiling Firmware as Server Does */

2016-06-01T14:43:41Z

‎Compiling Firmware as Server Does

Coflynn: /* Submitting a Challenge */ Add build details

2016-06-01T14:43:12Z

‎Submitting a Challenge: Add build details

Coflynn: /* Submitting a Challenge */

2016-06-01T14:23:28Z

‎Submitting a Challenge

Coflynn: /* Submitting a Challenge */

2016-06-01T14:22:40Z

‎Submitting a Challenge

Coflynn: Add ref to Daredevil

2016-06-01T14:17:05Z

Add ref to Daredevil

Coflynn: /* Point System */

2016-06-01T12:23:29Z

‎Point System

Coflynn: /* Zip-File Contents */

2016-05-25T03:31:05Z

‎Zip-File Contents

@@ Line 199: / Line 199: @@
+}
 </syntaxhighlight>
 <u>Encryption Function</u>

@@ Line 247: / Line 247: @@
 ==== Timing your AES Implementation ====
-TODO - Check if Atmel Studio allows cycle-by-cycle timing?
+One of the requirements is that leakage occurs before 10 000 cycles. How can you test this? Luckily it's possible with the Atmel Studio simulator (you can also try other simulators, but it's unknown their support for the XMEGA device).
 == White Box Cryptography ==

@@ Line 11: / Line 11: @@
 There are two types of cryptographic implementations available for your browsing pleasure. They are either:
-. AES-128 running on Atmel XMEGA, with power analysis. Key not stored in firmware (attack via DPA).
+# AES-128 running on Atmel XMEGA, with power analysis. Key not stored in firmware (attack via DPA).
+# AES-128 running on Linux computer, without power analysis. Key stored in firmware (White box).
-. AES-128 running on Linux computer, without power analysis. Key stored in firmware (White box).
 As a user, you can submit source-code to accomplish #1, which will run the code on an embedded hardware platform.
@@ Line 236: / Line 235: @@
 To compile as the server does, simply [http://ctf.newae.com/media/cc_aesbuild.zip download the build directory]. To use this directory:
-. Unzip that directory somewhere (for example in the "firmware" directory).
+# Unzip that directory somewhere (for example in the "firmware" directory).
+# Copy your source-codeto the <code>firmware\simpleserial-aes\user_crypto</code> directory.
-. Copy your source-codeto the "firmware\simpleserial-aes\user_crypto" directory.
+# To build run <code>make</code> in <code>simpleserial-aes</code>.
-−
-. To build run "make" in "simpleserial-aes".
 Running make will require avr-gcc & avr-binutils installed. You can do this on Linux platforms with something like:
-sudo apt-get install avr-gcc avr-binutils
+ sudo apt-get install avr-gcc avr-binutils
 On Windows platforms, install [http://winavr.sourceforge.net/ WinAVR].
 ==== Timing your AES Implementation ====
 == White Box Cryptography ==

@@ Line 237: / Line 237: @@
 . Unzip that directory somewhere (for example in the "firmware" directory).
 . Copy your source-codeto the "firmware\simpleserial-aes\user_crypto" directory.
 . To build run "make" in "simpleserial-aes".

@@ Line 230: / Line 230: @@
 As part of the compilation & validation the server will tell you of any errors. You must resubmit a new attempt if your compilation or validation fails (even if it's a problem on our end).
-If you wish to compile the code on your own (HIGHLY recommended during debugging to avoid taxing the server systems), please download the full source code directory. This source code directly is the same as used on the server, where your code is automatically copied to the "firmware\simpleserial-aes\user_crypto" directory. To build run "make" in "simpleserial-aes", and have avr-gcc, avr-libc, and avr-binutils installed (or WinAVR on Windows).
+If you wish to compile the code on your own (HIGHLY recommended during debugging to avoid taxing the server systems), please [http://ctf.newae.com/media/cc_aesbuild.zip download the full source code directory], described below.
 == White Box Cryptography ==

@@ Line 178: / Line 178: @@
 Please keep a copy of the secret key you submit if it's successful. We may need to verify them to ensure no database tampering happened. Note the secret keys are NOT stored on the database - only a hash of the correct key is, so getting a dump of the database will not be useful.
-Note once you submit an implementation, you do receive points for breaking it. Breaking your own implementation means you do NOT receive the time-bonus (since you have access to the traces before anyone else), but instead always receive the fixed points that a latecomer would (currently 10 points).
+Note once you submit an implementation, you do receive points for breaking it. Breaking your own implementation means you do NOT receive the time-bonus (since you have access to the traces before anyone else), but instead always receive some fixed points (currently 30 points).
 ==== Required AES-128 Format ====

@@ Line 168: / Line 168: @@
 * Does not modify clock settings of XMEGA device.
 * Doesn't try dumb stuff to reveal key (like saving secret key of job #1 to EEPROM and hoping you can run job #2 on the same hardware right after, and read job #1 key out).
 The requirement for performing sensitive operations (such as S-Box of input) within 10000 clock cycles is because we currently have limited the system to record a total of 10000 samples at a frequency that is 1x the clock rate.

@@ Line 87: / Line 87: @@
 In addition a file called firmware.hex is provided, which can be programmed into an Atmel XMEGA 128D4 (such as on the ChipWhisperer-Lite or ChipWhisperer Multi-Target board). It expects an external 7.37MHz clock and uses the ChipWhisperer 'SimpleSerial' protocol (described at this page). You can use this image if you require additional investigation or want to capture more than the provided 1000 traces.
-You can also convert files from .npy to matlab. The following shows a simple Python script which opens all the .npy file and saves it as a .mat file. If you don't have Python installed, you can install WinPython on Windows to quickly get this script running.<syntaxhighlight lang="python">
+You can convert traces to a variety of formats. The following are very basic examples of such conversions, you can find more details on the [[File Formats]] page.
 import scipy.io
 import numpy as np
@@ Line 106: / Line 112: @@
   "key":key
 })
 </syntaxhighlight>

@@ Line 21: / Line 21: @@
 * User-submitted flags are worth 50 points for the first person to capture the flag, 30 for the next, and 10 for all others.
 * Capturing the flag for your own implementation is worth 30 points (to encourage users to not submit impossible implementations) for the first 4 implementations you submit (i.e., you do not receive self-points for more than 4 implementations)
-* White-box crypto is worth 70 points, and does not decrease over time.
+* White-box crypto is worth 100 points, and does not decrease over time.
 == Getting Help ==

@@ Line 168: / Line 168: @@
 ==== Zip-File Contents ====
-For your convenience, you can [http://ctf.pythonanywhere.com/media/src/realaes_wJvwine.zip download an example zip-file]. This zip-file contains an AES-128 implementation in C, along with the required wrapper files.
+For your convenience, you can [http://ctf.newae.com/media/src/realaes_wJvwine.zip download an example zip-file]. This zip-file contains an AES-128 implementation in C, along with the required wrapper files.
 To use this zip-file, delete the "aes.c" and "aes.h" files, and modify the "aes-challenge-c.c" file as required. If you are using assembly code it must be inserted into the "aes-challenge-asm.S" file.