Hall of Mirrors

The brief

A field recording from the atrium, twenty-six minutes of rain on glass, wind, and a drone that never quite resolves. The ensemble swears nothing was added in post. The archivist disagrees: she says the room is answering itself, and that if you look at the recording instead of listening to it, you can see where. Every reflection in here points at another one. Only one of them points out.

• hall-of-mirrors.zip, 300 MB

In short

A 26 minute recording drew a key into its own spectrogram. The key drove a walk over the samples that rebuilt a self decrypting bytecode program, and the program printed 48 signatures whose short nonces gave up the private key.

26 minutes of rain on glass

The file is a stereo field recording at 48 kHz and 16 bit, 149,760,000 samples in all. Its plain low bits spell a fake flag from sample 4,096 on. The lab set that aside and looked at the recording instead of listening to it.

A banner drawn in tones

From 19:40 to 20:50, a comb of 28 fixed tones, 194 Hz apart from 6.8 kHz, paints two lines of pixels into the spectrogram. They read MIRRORS1 SM64/GAP/PAR and K=9C4F1E7A3B50D682, a scheme and a 64 bit key.

One bit from each visited sample

SM64 is SplitMix64, seeded with K. Each bit takes two draws, a gap of 1 to 4,096 samples and an 8 bit mask, and the bit is the parity of the masked low byte. The walk rebuilt 6,266 bytes and their CRC32 matched.

A program that decrypts itself

The bytes are a program for a small custom machine, MVM1. Every opcode fetch feeds a rolling hash, and one instruction decrypts the next block with it, so the code only reads in order. The lab's own interpreter ran all 20,395 instructions.

48 signatures with short nonces

The program printed 5,083 bytes, a secp256k1 public key and 48 ECDSA signatures. Every nonce has its top 12 bits at zero. That small leak in each signature turns the private key into a hidden number problem.

A lattice gives up the key

The lab built a lattice of 30 dimensions from 28 signatures and reduced it with LLL. Its short vector held the private key, which matched the public key. The key it derives unsealed a 33 byte blob into the flag.

The insight

Twelve known zero bits in each nonce look harmless. Across 28 signatures they are enough for a lattice to pin the private key exactly.

The flag

hiCTF{h1dd3n_numb3r_l4ttice_le4k}