Neoquest 2018: “Airship? Aha! ”

Recently ended CTF NeoQuest 2018 . Under the cut, the analysis of the second part of the task about the airship, ZeroNet , shift register with feedback and a system of linear equations.

In the task, the address of the site on the ZeroNet network was given , on which the chat was deployed. Because in ZeroNet, the contents of the site are downloaded to the local computer, then, scrubbing the folder with the site, I found the first key, as well as encrypted_storage.json:

{
	"encrypted_storage": [
		{
			"secret_name": "SiteName",
			"secret_value": "84a303b9f188b0",
			"date_added": 1519915207692
		},
		{
			"secret_name": "SiteAddress",
			"secret_value": "e68cd4a46ee074121a040a6188d3f6d495f24480fc0e08b0d45d8fba875d9fd38e88",
			"date_added": 1519915235730
		},
		{
			"secret_name": "AdminUsername",
			"secret_value": "0d9ef480aa",
			"date_added": 1519915256867
		},
		{
			"secret_name": "AdminCert",
			"secret_value": "4b95e6dfd893b37293fe041188cd6d8da5af08d4fb80b0",
			"date_added": 1519915282130
		},
		{
			"secret_name": "SecondKey",
			"secret_value": "c73ab54b91c6099b0f0081ea9124e2f50e846f6fc674046b3b41a86048ae3e27b04d354c9b9786a158f9722821005362bcfae8d6c0a261addb0b2ef8e16fbdfc851b82e0829d",
			"date_added": 1519915320471
		}
	]
}

Apparently, we need to decrypt “secret_value”. You may notice that the ciphertext length for AdminUsername is 5 bytes. Perhaps the plaintext is “admin”? If this is a gamma cipher, then we can get 5 bytes of gamma and check if they fit other "secrets". We check on the first 5 bytes of SiteName , we get b "\ xe8Y \ x9aP5". The result is not very ...

Also on the site there is such a page:



Having stumbled, you can see that the length of the ciphertext is equal to the length of the plaintext, and encryption and decryption are one and the same operation. It is very similar to gamming, maybe the same algorithm is used to encrypt the second secret?

The algorithm itself is located in the js / lfsr.js file . The gamma in it is generated by the function

  function genKeyStream(key, iv, length)
  {
    var res = []
    var state_len = bitLength(key)
    var state = iv.mod(bigInt(1).shiftLeft(state_len))
    for (var i = 0; i < length; i++)
    {
      var next_byte = 0
      for (var j = 0; j < 8; j++)
      {
        var next_bit = bitCount(state.and(key)) % 2
        next_byte = (next_byte >>> 1) | (next_bit << 7)
        state = state.shiftRight(1).or(bigInt(next_bit).shiftLeft(state_len - 1))
      }
      res.push(next_byte)
    }
    return res.reverse()
  }

This is a feedback shift register. The length of the register is equal to the length of the key, the location of the taps is set by the key. IV is cut to the length of the key and is used as the initial fill. Only in contrast to the usual feedback shift register, here the gamma is taken not from the output of the register, but from its input.

It can also be seen that the first bytes of the gamma will encrypt the last bytes FROM ... We return to encrypted_storage.json , take the gamma from “admin” and decrypt the last 5 bytes of SiteName : “oChat” is a completely different result! We decipher the end of the line SiteAddress- we see that in the line “1NeoChatZK4DxZJdg5WwocwxcUppA1eJgL” is written - the address of the site. The length of this string is 34 bytes, i.e. we have the first 34 bytes (272 bits) of the gamut.
In principle, encryption using shift registers has not been considered strong for a long time, but still having only a small piece of the gamma can’t just break it ... But this cipher has a slight difference from the “classic” - the gamma is taken from the register input. Thinking about this, we can understand that after L = len (key) iterations IV will be completely “squeezed out” from the shift register, and the entire internal state (register filling) will be equal to the last L bits of the gamma. Then for everyone$$ you can write this equation:

$$

Where:
$$ - i-th gamma bit
$$ - i-th key bit
$$ - key length
$$ - logical AND
$$- exceptional OR (XOR)
Having solved a system of L such equations, you can find the key. And knowing the key and the internal state (the last L bits of the gamma), you can generate as much gamma as you need! For a system to have at most one solution, it must have at least L linearly independent equations. Those. on the right side will stand$$ for $$. So we can solve the problem if the key length is not more than$$bit.

To solve it, I had to write a function that solves the system according to the Gauss method, because all found ready-made functions solved everything in the field of real or complex numbers, and not on the set (0, 1) with AND and XOR operations. Then I went over different values ​​of L, if the system turned out to be joint, I checked whether the next gamma bits generated by such a key would match the ones I knew. There was a match for$$. After a couple of minutes, the key was counted!

In fact, it was possible not to sort through different Ls, but to immediately write down a system of 134 equations with 134 unknowns, just for the key the first 6 bits would be zero.