Approved_users, bureaucrat, administrator
1,956
edits
| As of August 2020 the site you are on (wiki.newae.com) is deprecated, and content is now at rtfm.newae.com. |
Changes
→Required AES-128 Format
[http://chesworkshop.org/ches2016/start.php CHES 2016] will have a brand new Capture The Flag (CTF) event, run by [http://www.oflynn.com Colin O'Flynn], with resources by [https://www.newae.com NewAE Technology Inc]. This event will challenge novice and advanced embedded security researchers alike, by providing a platform to exchange AES implementations with various countermeasures (including against power analysis, and against firmware analysis using white box crypto). See the credits below for details of who's behind this.
'''Access the website at https://ctf.newae.com .'''
You can see a video description at overview of the contest: [[File:youtube_ctf.png|400px|link=https://www.youtube.com/watch?v=hmfulmIY58A&hd=1]]
== Attack Website ==
There are two types of cryptographic implementations available for your browsing pleasure. They are either:
As a user, you can submit source-code to accomplish #1, which will run the code on an embedded hardware platform.
* 'Stage-Gate' flags (such as basic CPA) are worth 10 points for all user.
* User-submitted flags are worth 50 points for the first person to capture the flag, 30 for the next, and 10 for all others.
* Capturing the flag for your own implementation is worth 10 30 points (to encourage users to not submit impossible implementations)for the first 4 implementations you submit (i.e., you do not receive self-points for more than 4 implementations)* White-box crypto is worth 70 100 points, and does not decrease over time.
== Getting Help ==
In addition a file called firmware.hex is provided, which can be programmed into an Atmel XMEGA 128D4 (such as on the ChipWhisperer-Lite or ChipWhisperer Multi-Target board). It expects an external 7.37MHz clock and uses the ChipWhisperer 'SimpleSerial' protocol (described at this page). You can use this image if you require additional investigation or want to capture more than the provided 1000 traces.
You can convert traces to a variety of formats. The following are very basic examples of such conversions, you can find more details on the [[File Formats]] page. ===== Converting Traces to MATLAB ===== You can also convert files from .npy to matlab. The following shows a simple Python script which opens all the .npy file and saves it as a .mat file. If you don't have Python installed, you can install WinPython on Windows to quickly get this script running. <syntaxhighlight lang="python">
import scipy.io
import numpy as np
"key":key
})
</syntaxhighlight>
===== Converting Traces to Binary Format (used by Daredevil attack) =====
The following are specific instructions which you can use to make trace formats required by the [https://github.com/SideChannelMarvels/Daredevil/ Daredevil] open-source high-order CPA tool.
The resulting binary files should be placed in the same directory as the "daredevil" binary you build. You'll have make a config file (see the [https://github.com/SideChannelMarvels/Daredevil/blob/master/CONFIG example CONFIG file]) which includes the data printed. Replace sections of the example config file which overlap, and then adjust the type of attack you request Daredevil to perform.
<syntaxhighlight lang="python">
import numpy as np
import struct
traces = np.load('2016.05.30-14.11.56_traces.npy')
textin = np.load('2016.05.30-14.11.56_textin.npy')
f = open('tracefile', 'wb')
for t in traces.flatten():
f.write(struct.pack('f', t))
f.close()
f = open('plaintext', 'wb')
for t in textin.flatten():
f.write(struct.pack('B', t))
f.close()
print "Add following to CONFIG:\n"
print "[Traces]"
print "files=1"
print "trace_type=f"
print "transpose=true"
print "index=0"
print "nsamples=%d"%traces.shape[1]
print "trace=tracefile %d %d"%(traces.shape[0], traces.shape[1])
print ""
print "[Guesses]"
print "files=1"
print "guess_type=u"
print "transpose=true"
print "guess=plaintext %d %d"%(textin.shape[0], textin.shape[1])
</syntaxhighlight>
* Does not modify clock settings of XMEGA device.
* Doesn't try dumb stuff to reveal key (like saving secret key of job #1 to EEPROM and hoping you can run job #2 on the same hardware right after, and read job #1 key out).
* Includes actual source code (you can't dumb a binary blob in the middle of a C wrapper). You can make the source code complicated however you want though.
The requirement for performing sensitive operations (such as S-Box of input) within 10000 clock cycles is because we currently have limited the system to record a total of 10000 samples at a frequency that is 1x the clock rate.
Please keep a copy of the secret key you submit if it's successful. We may need to verify them to ensure no database tampering happened. Note the secret keys are NOT stored on the database - only a hash of the correct key is, so getting a dump of the database will not be useful.
Note once you submit an implementation, you do receive points for breaking it. Breaking your own implementation means you do NOT receive the time-bonus (since you have access to the traces before anyone else), but instead always receive the some fixed points that a latecomer would (currently 10 30 points).
==== Required AES-128 Format ====
}
</syntaxhighlight>
'''NOTE:''' If the key setup takes longer than 100mS, there is a chance the AES core will miss some of the plaintext sent. Commonly this results in incorrect encryption outputs even though your implementation seems to be correct. Please contact us if this happens, but it's preferable to keep your key setup call < 737000 cycles to avoid this issue. You can do a lot in 737000 cycles so it shouldn't be an issue in most systems.
<u>Encryption Function</u>
==== Zip-File Contents ====
For your convenience, you can [http://ctf.pythonanywherenewae.com/media/src/realaes_wJvwine.zip download an example zip-file]. This zip-file contains an AES-128 implementation in C, along with the required wrapper files.
To use this zip-file, delete the "aes.c" and "aes.h" files, and modify the "aes-challenge-c.c" file as required. If you are using assembly code it must be inserted into the "aes-challenge-asm.S" file.
As part of the compilation & validation the server will tell you of any errors. You must resubmit a new attempt if your compilation or validation fails (even if it's a problem on our end).
If you wish to compile the code on your own (HIGHLY recommended during debugging to avoid taxing the server systems), please [http://ctf.newae.com/media/cc_aesbuild.zip download the full source code directory], described below. This source code directly is the same ==== Compiling Firmware as Server Does ==== To compile as used on the serverdoes, where your code is automatically copied to simply [http://ctf.newae.com/media/cc_aesbuild.zip download the build directory]. To use this directory: # Unzip that directory somewhere (for example in the "firmware" directory).# Copy your source-codeto the <code>firmware\simpleserial-aes\user_crypto" </code> directory. # To build run "<code>make" </code> in "<code>simpleserial-aes", and have </code>. Running make will require avr-gcc, avr-libc, and & avr-binutils installed (or WinAVR . You can do this on Linux platforms with something like: sudo apt-get install avr-gcc avr-binutils On Windowsplatforms, install [http://winavr.sourceforge.net/ WinAVR]. ==== Timing your AES Implementation ==== One of the requirements is that leakage occurs before 10 000 cycles. How can you test this? Luckily it's possible with the Atmel Studio simulator (you can also try other simulators, but it's unknown their support for the XMEGA device). Details of running the simulator are on the page [[Simulating the XMEGA Target Code]]. Note what it means that "leakage" is occurring is somewhat vague. For example Stage-gate #3B does NOT cover all the first-round S-Boxs in 10 000 cycles, but people were still able to break it. Generally your AES should have somehow touched all the secret material inside that window is the objective.
== White Box Cryptography ==
The CTF also includes a chance to apply techniques against white-box crypto. For this you are given a Linux binary, where the secret key is somehow encoded inside this binary! Extract the AES-128 key for victory.
Looking for some white-box crypto background? As a starter you might check out the paper [https://eprint.iacr.org/2015/753.pdf Differential Computation Analysis: Hiding your White-Box Designs is Not Enough] by Joppe W. Bos, Charles Hubain, Wil Michiels, and Philippe Teuwen.
This paper has an associated series of tools & examples you can access at https://github.com/SideChannelMarvels - hopefully this gets you started in white-box analysis.
== Credits ==
The CHES Challenge 2016 is run by [http://www.oflynn.com Colin O'Flynn] with much external help:
* Joppe Bos, Jan Hoogerbrugge, Van Huynh Le, and Wils Michiels: Providing the whitebox crypto Implementation
* Emmanuel Prouff and Adrian Thillard: Help with setup of rules, prizes, and overall assistance
* Resources (server, ChipWhisperer framework, hosting, etc.) by [https://www.newae.com NewAE Technology Inc].
