cryptomedium

Хмак! Будь здоров!

duckerz

Task: HMAC verification service with custom insecure_compare function that compresses 32-byte digest to 4 bytes via block_xor. Solution: Use oracle to get block_xor of target message, craft fake MAC with same compressed value by placing target bytes with zeros.

$ ls tags/ techniques/
hmachash_collisionweak_comparisonblock_xor
hash_compression_attackcollision_crafting
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]