The Quiet Divide

The brief

Asterion Dynamics finished an overnight maintenance window with an uncomfortable problem: its systems no longer agreed on what had actually happened. A single packet capture was preserved before the environment was taken offline. Find out what the traffic can prove, and recover the artifact left behind.

• the-quiet-divide.zip, 139 MB

In short

A packet capture of a maintenance window hides a sealed case file. The lab rebuilt firmware, attestation, telemetry, a QUIC observation and the frozen custody chain from the traffic, derived the vault key and opened the seal.

One capture of a maintenance window

The capture holds about 110,000 packets from 98.8 seconds of an overnight window. One device, ARCH-14, talks to a fleet of services, among them attestation, telemetry, key escrow, a case authority, a replica and an archive.

The seal names what it needs

The case authority's audit holds a final seal, AES-256-GCM. Beside the ciphertext it lists the SHA-256 of every input, from the firmware to the frozen custody state. Each digest says which copy is the real one.

Rebuilt from the traffic

The firmware came back from four HTTP range responses, 14,528 bytes, and its hash matched. One attestation matched too and carried the device nonce. A single UDP frame decoded to sequence 10,450,910.

Two shares make a key log

Two escrow uploads each carried a 760 byte share. XOR of the two gave a TLS key log. With it the QUIC session decrypted and showed the device's signed observation, whose digest matched the seal.

Where the systems disagree

The case authority logs five custody events, frozen at 734. The replica logs seven, two written after the freeze. Hashed into the vault key, only the frozen five pass the GCM tag. That gap is the divide.

One transfer, then the seal

Three vaults decrypt to SQLite. Only transfer 6dd9ec58 matches both the device nonce and counter 10,450,910. Its four fragments unmask to 32 bytes whose commit matches the receipt, and the seal opens.

The insight

The systems disagreed, the seal did not. Its digests and the GCM tag pick the one true chain and the one true transfer out of every lookalike.

The flag

hiCTF{c8c46fdbd6e5e4eacabfba53a156ff9ab10567f2}