{"@attributes":{"version":"2.0"},"channel":{"title":"ROT256.","link":"https:\/\/rot256.dev\/","description":"Recent posts on ROT256.","language":"en-us","lastBuildDate":"Sun, 14 Jun 2026 00:00:01 +0000","item":[{"title":"Powers-of-Funbenius","link":"https:\/\/rot256.dev\/post\/frobenius\/","pubDate":"Tue, 12 May 2026 00:00:00 +0000","guid":"https:\/\/rot256.dev\/post\/frobenius\/","description":"\"Lyon\n

Introduction<\/h1>\n

In this post we just want to cover a fun bug we found: fun because the math itself is interesting, and fun because it breaks just<\/em> the right way. The bug is issue #44<\/a> in\nInferno<\/a>,\nwhich is a Rust implementation of the Limbo<\/a> MPC-in-the-head zero-knowledge argument,\nwhich is an improvement upon the KKW scheme<\/a>.\nThe bug in the implementation is one character long, surprisingly common, usually not game ending,\nbut over binary extension fields everything breaks<\/em> in just<\/em> the right way…<\/p>"},{"title":"Multilinear Proofs, Part I: Cubes & Roots","link":"https:\/\/rot256.dev\/post\/mle-1-basics\/","pubDate":"Thu, 03 Jul 2025 00:00:00 +0000","guid":"https:\/\/rot256.dev\/post\/mle-1-basics\/","description":"

\"Milano\"<\/p>\n

Introduction<\/h1>\n

This series of posts aims to be a comprehensive<\/em> collection of facts, protocols,\nand theorems related to the information-theoretic foundations of multilinear proof systems.\nBy “multilinear proof system” we refer to a system with multilinear polynomials as the underlying “arithmetization” of the proof system: where satisfiability of the computation, a (RAM) machine or circuit, is expressed as randomized relations between multilinear polynomials\nand the witness is the evaluation of multilinear polynomials over some tensor product.<\/p>"},{"title":"Spikey Elf @ HXP 38C3 CTF","link":"https:\/\/rot256.dev\/post\/spiky-elf\/","pubDate":"Thu, 02 Jan 2025 00:00:00 +0000","guid":"https:\/\/rot256.dev\/post\/spiky-elf\/","description":"

\"top\"<\/p>\n

Happy new year!<\/p>\n

Here is a writeup for the challenge Spikey Elf<\/code> from the 38C3 CTF by HXP.<\/p>\n

The Challenge<\/h1>\n

We are given the following code:<\/p>\n

#!\/usr\/bin\/env sage<\/span>\n<\/span><\/span>proof<\/span>.<\/span>all<\/span>(<\/span>False<\/span>)<\/span>\n<\/span><\/span>\n<\/span><\/span>bits<\/span> =<\/span> 1024<\/span>\n<\/span><\/span>errs<\/span> =<\/span> 16<\/span>\n<\/span><\/span>\n<\/span><\/span>p<\/span> =<\/span> random_prime<\/span>(<\/span>2<\/span>^<\/span>(<\/span>bits<\/span>\/\/<\/span>2<\/span>))<\/span>\n<\/span><\/span>q<\/span> =<\/span> random_prime<\/span>(<\/span>2<\/span>^<\/span>(<\/span>bits<\/span>\/\/<\/span>2<\/span>))<\/span>\n<\/span><\/span>n<\/span> =<\/span> p<\/span> *<\/span> q<\/span>\n<\/span><\/span>e<\/span> =<\/span> 0x10001<\/span>\n<\/span><\/span>print<\/span>(<\/span>f<\/span>'<\/span>{<\/span>n<\/span> = :<\/span>#x<\/span>}<\/span>'<\/span>)<\/span>\n<\/span><\/span>print<\/span>(<\/span>f<\/span>'<\/span>{<\/span>e<\/span> = :<\/span>#x<\/span>}<\/span>'<\/span>)<\/span>\n<\/span><\/span>\n<\/span><\/span>flag<\/span> =<\/span> pow<\/span>(<\/span>int<\/span>.<\/span>from_bytes<\/span>(<\/span>open<\/span>(<\/span>'flag.txt'<\/span>,<\/span>'rb'<\/span>)<\/span>.<\/span>read<\/span>()<\/span>.<\/span>strip<\/span>()),<\/span> e<\/span>,<\/span> n<\/span>)<\/span>\n<\/span><\/span>print<\/span>(<\/span>f<\/span>'<\/span>{<\/span>flag<\/span> = :<\/span>#x<\/span>}<\/span>'<\/span>)<\/span>\n<\/span><\/span>\n<\/span><\/span>d<\/span> =<\/span> inverse_mod<\/span>(<\/span>e<\/span>,<\/span> lcm<\/span>(<\/span>p<\/span>-<\/span>1<\/span>,<\/span> q<\/span>-<\/span>1<\/span>))<\/span>\n<\/span><\/span>locs<\/span> =<\/span> sorted<\/span>(<\/span>Subsets<\/span>(<\/span>range<\/span>(<\/span>bits<\/span>),<\/span> errs<\/span>)<\/span>.<\/span>random_element<\/span>())<\/span>\n<\/span><\/span>for<\/span> loc<\/span> in<\/span> locs<\/span>:<\/span>\n<\/span><\/span> d<\/span> ^^=<\/span> 1<\/span> <<<\/span> loc<\/span>\n<\/span><\/span>print<\/span>(<\/span>f<\/span>'<\/span>{<\/span>d<\/span> = :<\/span>#x<\/span>}<\/span>'<\/span>)<\/span>\n<\/span><\/span><\/code><\/pre><\/div>
And the output:<\/p>\n
n = 0x639d87bf6a02786607d67741ebde10aa39746dc8ed22b191ff2\n<\/span><\/span> fefe9c210b3ee2ce68b185dc7f8069e78441bdec1d33e2b342c22\n<\/span><\/span> 6b5cde8a49f567ac11a3bcb7ff88eeededdd0d50eb981635920d2\n<\/span><\/span> 380a6b878d327b261821355d65b2ef9f807035a70c77252d09787\n<\/span><\/span> c2b3dfafdfa4f5c6b39a1c66c5b39fe9d1ee4b36d86d5\n<\/span><\/span>e = 0x10001\n<\/span><\/span>flag = 0x40208a7900b1575431a49690030e4eb8be6269edcd3c7b2d\n<\/span><\/span> 97ae94a6eb744e9c622d81b95ea45b23ee6e0d773e3dd48adc6bb\n<\/span><\/span> 2c7c6423d8fd52eddcc6c0710f607590d5fc57a45883a36ad0d85\n<\/span><\/span> 1f84d4bee86ffaf65bc1773f97430080926550dce3666051befa8\n<\/span><\/span> 7bacc01d44dd09baa6ae93a85cedde5933f7cbbe2cb56cdd\n<\/span><\/span>d = 0x1a54893799cd9805600cfaee1c8a408813525db268fbc29e7f2\n<\/span><\/span> a81eb47b64d2dd20dc8be52b6332e375f92a120957042a92a4bd4\n<\/span><\/span> f5e13ef14e9b398bec330602dc9dbbb63cf3dfe6d33bf95d08306\n<\/span><\/span> a894b052e005a57cc41673fe866f4f8b2ffb0aa26fc4c51a8f513\n<\/span><\/span> 5e40df2107e0259ddf4c1d9c1eb41b1f702b135c941\n<\/span><\/span><\/code><\/pre><\/div>
In other words:<\/p>"},{"title":"Proof-Carrying Border Gateway Protocol","link":"https:\/\/rot256.dev\/post\/bgp-pcd\/","pubDate":"Wed, 25 Dec 2024 00:00:00 +0000","guid":"https:\/\/rot256.dev\/post\/bgp-pcd\/","description":"
\"\"<\/p>\n
Introduction<\/h1>\n
The Border Gateway Protocol (BGP) is the central protocol<\/em> of the internet, responsible for configuring routing tables of\nautonomous systems (ASes) across the globe.\nUnfortunately, it is incredibly vulnerable, and attempts to bolt cryptography onto BGP have been largely unsuccessful.\nThis is partly because of a mismatch between how BGP works and how cryptographic signatures work.\nIn this post we will explore an alternate way of securing BGP using Proof-Carrying Data.\nThis is particularly relevant because:<\/p>"},{"title":"Multivariate Sum-Check","link":"https:\/\/rot256.dev\/post\/multivariate-sum\/","pubDate":"Sun, 14 Apr 2024 00:00:00 +0000","guid":"https:\/\/rot256.dev\/post\/multivariate-sum\/","description":"
\"\"<\/p>\n
This a short post explaining the multivariate sum-check<\/em>: a fundamental subprotocol used throughout multivariate succinct arguments (e.g. Spartan, HyperPlonK, etc).\nRoughly speaking, it often serves the same role as the divisibility check in the univariate contexts.<\/p>\n\n
This post assumes familiarity with finite fields, polynomials and lagrange interpolation\/basis.<\/p>"},{"title":"Fast Reed-Solomon IOP (FRI) Proximity Test","link":"https:\/\/rot256.dev\/post\/fri\/","pubDate":"Sun, 19 Nov 2023 00:00:00 +0000","guid":"https:\/\/rot256.dev\/post\/fri\/","description":"\n