Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

The DEF CON 34 Badge

Andrew 'bunnie' Huang

Where

Main Stage
DEF CON 34

Duration

23 min

Explains how the DEF CON 34 badge was designed and built, how attendees can attack it, and how its partly open-source Baochip-1x chip can be inspected.

Summary

The talk opens with the badge's conference mode, where attendees swap light patterns through a lightly encrypted exchange. Traits follow simple genetic rules, with some dominant and some recessive. After the event, the core module can be removed and used as a FIDO2 security token that shows the relying party on screen. It also works as a TOTP generator and an offline password store.

The speaker's motivation is that supply chains scale well, so hardware trust needs more than black-box chips. He describes infrared imaging, which can reveal a chip's transistors when the silicon is exposed. The badge's Baochip-1x is a custom chip he designed, and its CPUs, cryptographic accelerators, and the Rust-based boot and operating system are published as open source. He also covers the manufacturing effort: custom two-tone laminate, stainless steel finishes for the advanced badges, and automated test rigs that reached about 7,000 units a week with a yield above 98 percent.

For hackers, the badge includes flags to capture, and early solvers were already named. The BIO coprocessor, an open version of the Raspberry Pi PIO block, can be debugged at the waveform level through open RTL simulation. The speaker expects open hardware to show bugs after release and recommends firmware updates, with bare chips planned for wider distribution later.

Materials

Related talks

Main Stage·49 min

  • DEF CON
  • Hardware
  • Date: Aug 2026
  • Location: Las Vegas

Mickey Shkatov · Jesse Michael

Shows how a roughly $45 FPGA can impersonate a discrete SPI TPM on Windows 11 and sit between a real TPM and the motherboard, challenging hardware trust assumptions.

hardwaretrustdevice+2