Power Leak

Challenge

• Name: power leak
• Category: Forensics
• Points: 50
• Author: tanishfr
• Description: "Power reveals the secret. EHAX{SHA256(secret)}"

Analysis

The challenge provides a CSV file (power_traces.csv) containing simulated power consumption traces, structured with columns: position, guess, trace_num, sample, power_mW.

Data Structure

• 6 positions (0-5): representing 6 digits of a secret
• 10 guesses (0-9): candidate values for each digit
• 20 traces per (position, guess) pair
• 50 samples per trace: power measurements over time

This is a classic Differential Power Analysis (DPA) / side-channel attack scenario. The idea is that when the device processes the correct key guess, it leaks more power than for incorrect guesses.

Methodology

Multiple analysis methods were applied:

1. Peak Power Method (most reliable): For each (position, guess), compute the average peak power across all 20 traces. The correct guess consistently shows the highest average peak.
2. Standard Deviation Method: The correct guess produces traces with higher variance (larger standard deviation) due to the data-dependent power spike.
3. Overall Average Power: Simple average of all power samples per (position, guess) also pointed to the correct answer, though with smaller margins.

Results per Position

Position	Winning Guess	Avg Peak Power (mW)	Runner-up	Margin (mW)
0	7	82.23	4 (79.40)	2.83
1	9	82.06	7 (79.20)	2.86
2	2	80.74	6 (78.95)	1.79
3	9	80.81	2 (79.50)	1.32
4	6	81.07	4 (78.82)	2.25
5	3	81.44	5 (79.35)	2.08

All positions show clear separation between the correct guess and the runner-up.

Secret Recovery

The recovered secret is: 792963

Flag Computation

SHA256("792963") = 5bec84ad039e23fcd51d331e662e27be15542ca83fd8ef4d6c5e5a8ad614a54d

Key Takeaways

• Power analysis attacks exploit the fact that a device's power consumption correlates with the data being processed
• Even with noise, statistical methods (averaging across multiple traces) can reliably extract the secret
• The peak power per trace was the most discriminating feature in this dataset