Vladimir Garbuz
Security Engineer at HP LM Security Center of Excellence
Walkthrough 0xDEC0DE01 cryptoCTF

Intro
 What this talk is about
 What this talk is NOT about
 google “vladimir garbuz cryptography” for
dec0de01 talk and slides with more technical details
 Ok… The cryptoCTF!
 solve 5 challenges to win 10000$
 well, 100.00$...
 Still available at the link: http://goo.gl/tuKku7

Intro
 CTF consisted of 5 tasks:
1. Poor AES-CBC cryptolocker (bruteforce)
2. Simple stream cipher (pad reuse)
3. AES-ECB encryption (data leaking)
4. SHA256 MAC (length extension attack)
5. SHA256 proof of work (bruteforce)

AES-CBC cryptolocker
 2 files available:
 very_bad_encryptor is VERY bad:
 Very slow (~1MB/sec)
 Can encrypt and decrypt
 Uses SHA256 hash as AES encryption key
 Hash of a 8 digit numeric user entered code… 
 Uses CBC encryption mode

AES-CBC cryptolocker

AES-CBC cryptolocker
 But how to know when the password is right?..

AES-CBC cryptolocker

AES-ECB encryption

AES-ECB encryption

Simple stream cipher
 Stream cipher basics
 Sender computes Message ⊕ Keystream and sends the
Ciphertext
 Receiver computes Ciphertext ⊕ Keystream to get
Message
 In our case, the key stream was generated via Python
random, initialized with constant “0xdec0de01” 

Simple stream cipher
Basic vulnerabilities: key reuse
What’s so terrible about key reuse?
 So we have 2 plaintexts P1 and P2, and we encrypt
them separately under the same Key:
C1=P1⊕F(Key)
C2=P2⊕F(Key)
When attacker intercepts them, he can then compute:
C1⊕C2=P1⊕P2
 “Oh, please! How bad could that possibly be?..”

Simple stream cipher
Basic vulnerabilities: key reuse

Simple stream cipher
Basic vulnerabilities: key reuse
 Case 1: if one of the plaintexts, e.g. P1, is known,
restoring the other one is trivial
P1⊕P2⊕P1 = P1⊕P1⊕P2 = 0⊕P2 = P2
 Case 2: if a portion of Plaintext is known, the
Keystream in corresponding position is revealed
C = P⊕E(Key)  C⊕P = E(Key)
 Now, having the Keystream at some position, we can
decrypt data at that position from other ciphertexts

Simple stream cipher

SHA256 MAC – length extension
 The task was, quote:
d60d6d39c50b85f8a080ab510c2f3402c34ffc8cf09f9f3bfc7fc218d77bb5a3
This is a MAC (SHA256) of a secret key concatenated with the e-mail address
that you need to send your results to. The length of the key+e-mail is 53 bytes.
Your task is to add any message you want to this e-mail and compute a new
SHA256 hash of it - all in such a way that your hash is identical to the MAC that
I will compute from my key + your message.
As a solution for this task I expect 2 things: forged message AND it's SHA256
hash.
Yes, it's that simple, but can YOU actually do it?

SHA256 MAC – length extension
Breaking “key + message MAC”
 What’s vulnerable?
 Hash functions with Merkle–Damgård construction, e.g.
MD4, MD5, RIPEMD-160, WHIRLPOOL, SHA-0, SHA-1
and even SHA-2
 Doesn’t work on other constructions - SHA-3, poly1305,...
 In this construction, the resulting hash is the internal
state of the function at the end of computation
 Which can (and will ) be used as the starting state of
the hash function

SHA256 MAC – length extension
 Hash of k+m is actually a hash of k+m+p, where p
is some necessary, but easily predictable, padding
 To illustrate this:
 H0(k) = Hk - here, H0 is the initial state of hash function
 Hk(m) = Hkm - Hk is its state after processing k
 Hkm (p) = Hkmp
 Hkmp = H(k+m+p)

SHA256 MAC – length extension
 Since p is predictable and end state Hkmp is known
 We chose any arbitrary m´
 Set the hash function’s initial state to Hkmp
 And make it process the bytes of message m´
Hkmp(m´) = Hkmpm´
 Curiously, this is EXACTLY what happens when you
hash m+p+m´ under a known key!
 Now, our hash is forged but will check out as valid!

SHA256 MAC – length extension
 Example solution:
Using https://github.com/iagox86/hash_extender we can append string
'0wn3d',
$ hash_extender -d '' -s
d60d6d39c50b85f8a080ab510c2f3402c34ffc8cf09f9f3bfc7fc218d7
7bb5a3 -a '0wn3d' -f sha256 -l 53
Type: sha256
Secret length: 53
New signature:
787f169dcb032ada7dbdfc7906eeccc6701f7c0cdf4ee1e09da441e93
51d6f53
New string: 80000000000000000001a830776e3364

SHA256 proof of work
 The task was to find a string such that it’s SHA256 in
hex encoding would start with dec0de01
 How to?..
 Just bruteforce it!
 Example string is “3928979165”
 It’s sha256 in hex encoding is:
 dec0de01646730a1e0f2d6d34a0833be52df6e055
2fe16f04ab66610b70321f1

Questions and Discussion