Capture the Flag (CTF) competitions are increasingly important for the Brazilian cybersecurity community as education and professional tools. Unfortunately, CTF platforms may suffer from security issues, giving an unfair advantage to competitors. To mitigate this, we propose NIZKCTF, the first open-audit CTF platform based on non-interactive zero-knowledge proofs.
Educational technology, Cryptography, Distributed information systemsA critical element of a robust cybersecurity strategy is developing talent in modern technological security issues. Research shows that the United States is the most prepared country against cyber attacks, 1 however, there is also a problem of quantity and quality of professionals, especially when it comes to more sophisticated skills such as security by design, defensive programming, applied cryptography, threat intelligence and forensic analysis after a compromise. 2 This problem is aggravated in developing countries, where access to bleeding-edge resources for professional training based on real-world experience is limited.In order to reduce the shortage of cybersecurity professionals, companies, schools, universities and military institutions have been promoting Capture the Flag (CTF) competitions around the world to foster the engagement of professionals in cybersecurity topics. CTF competitions are usually designed to serve an educational purpose to give participants experience with computer security problems from a wide spectrum of technical areas, as well as conducting and reacting to the sort of attacks found in the real world. CTF competitions can also serve as a convenient recruiting tool to fill specific positions with highly-skilled talent. Reverse-engineering, exploitation, forensics, web programming and cryptanalysis are among the typical required skills in CTF competitions. Because CTF competitions are inexpensive to organize and run, they are strategic to countries such as Brazil, allowing the local community to interact and compete with international players.There are two styles of CTF competitions: attack/defense and jeopardy. In an attack/defense competition, each team is given a machine to defend on an isolated network. Teams are scored based on both their success in defending their assigned machine and on their success in attacking the other teams' machines. Jeopardy competitions are more common and usually involve multiple categories of problems, each of which contains a variety of questions of different values and levels of difficulty. A correct solution to a problem reveals a flag, which is submitted to the scoring platform for points. Teams attempt to earn the most points in the competition's time frame (e.g., 24 hours), but usually do not directly attack each other. Rather than a race, this style of gameplay encourages taking time to approach challenges and prioritizes quantity of correct submissions over the timing.An important concern is to protect the CTF software platform against attacks. The platform is usually responsible for storing the flags and updat...
