Changes

CHES2016 CTF

1,085 bytes added, 17:41, 23 June 2016

→‎Required AES-128 Format

There are two types of cryptographic implementations available for your browsing pleasure. They are either:

1. # AES-128 running on Atmel XMEGA, with power analysis. Key not stored in firmware (attack via DPA). 2. # AES-128 running on Linux computer, without power analysis. Key stored in firmware (White box).

As a user, you can submit source-code to accomplish #1, which will run the code on an embedded hardware platform.

}

</syntaxhighlight>

'''NOTE:''' If the key setup takes longer than 100mS, there is a chance the AES core will miss some of the plaintext sent. Commonly this results in incorrect encryption outputs even though your implementation seems to be correct. Please contact us if this happens, but it's preferable to keep your key setup call < 737000 cycles to avoid this issue. You can do a lot in 737000 cycles so it shouldn't be an issue in most systems.

<u>Encryption Function</u>

To compile as the server does, simply [http://ctf.newae.com/media/cc_aesbuild.zip download the build directory]. To use this directory:

1. # Unzip that directory somewhere (for example in the "firmware" directory).2. # Copy your source-codeto the "<code>firmware\simpleserial-aes\user_crypto" </code> directory.3. # To build run "<code>make" </code> in "<code>simpleserial-aes"</code>.

Running make will require avr-gcc & avr-binutils installed. You can do this on Linux platforms with something like:

sudo apt-get install avr-gcc avr-binutils

On Windows platforms, install [http://winavr.sourceforge.net/ WinAVR].

==== Timing your AES Implementation ====

One of the requirements is that leakage occurs before 10 000 cycles. How can you test this? Luckily it's possible with the Atmel Studio simulator (you can also try other simulators, but it's unknown their support for the XMEGA device).

Details of running the simulator are on the page [[Simulating the XMEGA Target Code]].

Note what it means that "leakage" is occurring is somewhat vague. For example Stage-gate #3B does NOT cover all the first-round S-Boxs in 10 000 cycles, but people were still able to break it. Generally your AES should have somehow touched all the secret material inside that window is the objective.

== White Box Cryptography ==