HMAC Timing Oracle

crypto · hard · 350 pts

Acme's HMAC verifier returns ok/fail. The timing leaks the prefix match length. Recover the admin's HMAC byte-by-byte; submit at /admin. --- ### Files The challenge generator (`generate.py`) lives in `AYSEC-CTF/deployable/crypto/hmac-timing/`. Run `python3 generate.py /tmp/out` to produce the artifact.