Challenge Context#

The service implements a Sigma-style proof of knowledge on secp256k1. The prover is supposed to prove knowledge of witness w where P = wG.

Reconnaissance#

The fatal function was the challenge generator:

1
def generate_challenge(self, R):
2
    response = requests.get("https://example.com/" + os.urandom(35).hex())
3
    data = response.text.encode()
4
    return bytes_to_long(hashlib.sha256(data).digest())

Vulnerability / Core Idea#

There are two bugs:

1. The challenge c does not depend on the commitment R.
2. example.com returns stable HTML for arbitrary paths, so c is predictable before committing.

That breaks soundness. We can choose a commitment that cancels the public key term.

Exploitation#

The verifier checks:

1
zG == R + cP

Because c is known ahead of time, choose:

1
R = -cP
2
z = 0

Then:

1
zG     = 0G       = O
2
R + cP = -cP + cP = O

The proof verifies without knowing w.

1
# After receiving public key P from the server:
2
c = sha256(example_com_html).digest_as_int()
3
R = negate(point_mul(c, P))
4
z = 0
5
# send R, then z

Flag#

1
leet{v3rY_9o0d_Bu7_juSt_so_u_kN0w_mod3rn_ZK_is_s0ME7hin9_3l53}

Lesson Learned#

Fiat-Shamir style challenges must be bound to the commitment and transcript. If the prover can know c before choosing R, they can program the equation instead of proving knowledge.

Cover: Wallhaven gwp2w3.