DC34 vault Application

[!WARNING] Loading your own firmware onto your badge will wipe the light encryption key and cause your badge to enter developer mode.

NOTICE: this repo is now orphaned and will be archived soon, as it is now merged into xous-core. It only existed in the bunnie github repository because it had to be private before the conference, now that it is public, it will be maintained as part of xous-core. Please direct all future PR's to xous-core. The Tetris PR will eventually be migrated as a separate app, so the repo will remain active until that to-do is done.

This is the vault application as customized for Defcon34.

It provides the in-conference badge interactivity, namely, customizing lights by scanning encrypted QR codes between badges.

There's a couple easter eggs buried in the code here, if you care to look for them, and maybe even a flag to capture if you look hard enough.

Building

Assumes the following directory structure:

 .
 ├── dc34-api
 ├── dc34-console
 ├── dc34-vault
 └── xous-core

And that these commands are run from inside the xous-core directory. Prerequisites:

• Latest Rust
• Run cargo xtask install-toolkit inside the xous-core repo

echo "===== Building Console ====="
(
    cd ../dc34-console &&
    cargo build --release --target riscv32imac-unknown-xous-elf --features board-baosec --features oem-baosec-lite --features bao1x --features utralib/bao1x &&
) || {
    echo "dc34-console build failed!"
    exit 1
}

echo "===== Building Vault ====="
(
    cd ../dc34-vault &&
    cargo build --release --target riscv32imac-unknown-xous-elf --features board-baosec &&
) || {
    echo "dc34-vault build failed!"
    exit 1
}

cargo xtask baosec-lite ../dc34-console/target/riscv32imac-unknown-xous-elf/release/dc34-console~flash ../dc34-vault/target/riscv32imac-unknown-xous-elf/release/dc34-vault \
    --no-timestamp --feature usb --kernel-feature debug-proc --no-verify

Conference Mode

When the core module is mated to the badge carrier, the module defaults to "conference" mode, which shows the Defcon logo, alternating with an image of your choice if you upload it using https://github.com/bunnie/dc34-image.

You can "mix" light patterns with other badges by scanning QR codes. The light patterns are encrypted using a common, shared key across the entire population - if you can extract that key, then you can effectively be a "seeder" for arbitrary light patterns. However, initially every badge has a limited color range, and the only way to make your badge more colorful is to interact with someone who has the colors that you desire.

The interaction proceeds as follows:

1. Press either the left or right button. This shows a QR code that reveals a nonce.
2. Ask the light color "donor" to scan your QR code by pressing the middle button on their badge.
3. Scan the resulting QR code on the donor's badge.
4. Accept or reject your new light pattern.

For more details on the cryptographic exchange, see defcon_scheme.md.

The current plan is to leak a portion of the shared key, so that anyone who wants to show off their burly ASIC cracker can take a go at brute-forcing the key. If nobody has brute-forced or extracted the key by the end of the show, enough bits will be leaked such that a brute force should be do-able with a high-end desktop GPU and a day of effort.

Token Mode

Once you've left the conference, you can detach the clear plastic core module by removing the two screws on the back side of the module. A pair of replacement screws and a silicone cap is included in your badge kit to seal up the holes left by detaching from the badge carrier.

Thus detached, you can plug your badge into a computer via USB and use it as a 2FA (FIDO2) token. It also supports storting TOTPs and plaintext passwords by scanning QR codes. The QR codes are generated by installing this browser extension. The QR codes encode the current time. Because the device doesn't have an internal battery, you'll need to scan one of these QR codes when you plug in the device to set the current time if you plan to use the TOTP function.

Updates

Get firmware updates at https://ci.betrusted.io/releases/latest/baochip/dc34-badge/latest.zip. The zip file must be extracted into the three constituent files (xous.uf2, swap.uf2, loader.uf2) prior to copying to the device!

To perform an update:

1. Press and hold any button while plugging the module into a computer. This will cause the device to enumerate as a USB mass storage device.
2. Copy the files loader.uf2, xous.uf2, and swap.uf2 to the device.
3. If you're under Linux, be sure to unmount the drive to ensure that the cached files are actually written to the device.
4. Press any button to boot the device.

This final boot step is required to flush any partially written sectors to disk; shutting off the device without booting can lead to a portion of the last sector going missing, depending upon the OS.