CHES2016 CTF

Trace File Format

The trace-file is a 7Zip file with a number of subfolders. 7Zip has free implementations on all systems (on Linux/Mac OS you can install the 'p7zip' or 'p7zip-full' from your repo).

First, there are folders where you ARE told the encryption key. Use these to investigate the leakage of the implementation:

There is also a set of traces where you ARE NOT told the encryption key. This encryption key is the secret flag you must find. It will be submitted as a hex string.

Each folder also contains the exact script used to capture the traces on the ChipWhisperer-Lite, the text input/output, the trace data in NumPy format (can be converted to MATLAB easily), and the encryption key (except for the 'secret' capture options). The 'secret' key is not recorded anywhere, only a hash of the correct key is stored in the CTF database.

In addition a file called firmware.hex is provided, which can be programmed into an Atmel XMEGA 128D4 (such as on the ChipWhisperer-Lite or ChipWhisperer Multi-Target board). It expects an external 7.37MHz clock and uses the ChipWhisperer 'SimpleSerial' protocol (described at this page). You can use this image if you require additional investigation or want to capture more than the provided 1000 traces.

import scipy.io
import numpy as np

prefix = r'2016.02.24-19.07.03'
#Can point to full directory like:
#prefix = r'C:\Temp\demo\traces_capdir48\knownrand_fixed\knownrand_fixed_P48_data\traces\2016.02.24-19.07.03'

tracedata = np.load(prefix + '_traces.npy')
textin = np.load(prefix + '_textin.npy')
textout = np.load(prefix + '_textout.npy')
key = np.load(prefix + '_keylist.npy')

scipy.io.savemat('fileout.mat', {
 "traces":tracedata,
 "textin":textin,
 "textout":textout,
 "key":key
})

Example CPA Attack

The default challenge will fall to a straight-forward CPA attack. You must determine what secret key was used during the encryption operation. You can submit the "flag" as the hex key, for example as shown in the following photo. Be sure to select the flag you are attacking by the drop-down. Ones you've already discovered will not be populated.

Required AES-128 Format

Init Call

void aes_indep_init(void)
{
    ;
}

void aes_indep_key(uint8_t * key)
{
    for (uint8_t i = 0; i < 16; i++){
        _stored_key[i] = key[i];
    }
}

Encryption Function

void aes_indep_enc(uint8_t * pt)
{
	_stored_ct = aes(pt, _stored_key);
    
    for (uint8_t i = 0; i < 16; i++){
        pt[i] = _stored_ct[i];
    }
}

Zip-File Contents

For your convenience, you can download an example zip-file. This zip-file contains an AES-128 implementation in C, along with the required wrapper files.

To use this zip-file, delete the "aes.c" and "aes.h" files, and modify the "aes-challenge-c.c" file as required. If you are using assembly code it must be inserted into the "aes-challenge-asm.S" file.

The zip-file must contain the following files at minimum:

• aes-challenge.h
• aes-challenge-asm.c
• aes-challenge-c.S

ONLY those files will be compiled by the automated system. If you require additional files, you must use #include directives to include them directly into the C source code. Download the example source code for the "Basic AES-128 Implementation" to get an idea of how this will work.

You must include both the .c file and the .S file. Leave a file blank if not using (i.e., if only using C you can leave the .S file blank, as in the example).

As part of the compilation & validation the server will tell you of any errors. You must resubmit a new attempt if your compilation or validation fails (even if it's a problem on our end).

If you wish to compile the code on your own (HIGHLY recommended during debugging to avoid taxing the server systems), please download the full source code directory. This source code directly is the same as used on the server, where your code is automatically copied to the "firmware\simpleserial-aes\user_crypto" directory. To build run "make" in "simpleserial-aes", and have avr-gcc, avr-libc, and avr-binutils installed (or WinAVR on Windows).