Trending Tags
Encrypt Twice For Thrice The Fun
Encrypt Twice For Thrice The Fun
Author: Utkarsh Raj
Challenge Description
Players are given a small cryptographic service with two available functions. The service does not reveal the algorithm or key directly.
Function 1 accepts a plaintext and a user-supplied key, then returns a ciphertext.
Function 2 accepts a user-supplied key and returns a ciphertext derived from a hidden flag.
The player has only two total function queries, so the outputs must be analyzed carefully.
There are no dedicated cryptographic clue files. The challenge is intentionally blind, and the solution depends on studying the behavior of the service and researching the relevant cryptographic properties.
1. Observe Function 2 First
The intended order is Function 2 → Function 1.
Function 2 accepts:
1
Key
and returns:
1
Ciphertext
The operation is:
1
2
3
4
5
6
7
8
9
10
FLAG
|
v
3DES
|
v
XOR with hidden IV
|
v
Ciphertext
Therefore:
1
C2 = E(FLAG, K) XOR IV
The same hidden IV is used by Function 1.
The challenge uses the fixed weak key:
1
E0E0E0E0F1F1F1F1
Use this key for Function 2 and record the resulting ciphertext.
2. Feed Function 2 Into Function 1
Now use the Function 2 ciphertext itself as the plaintext input to Function 1.
Function 1 accepts:
1
2
Plaintext
Key
and performs:
1
2
3
4
5
6
7
8
9
Plaintext
XOR
hidden IV
|
v
3DES
|
v
Ciphertext
Therefore:
1
C1 = E(P XOR IV, K)
Set:
1
P = C2
where C2 is the ciphertext obtained from Function 2.
Then:
1
C1 = E(C2 XOR IV, K)
From Function 2:
1
C2 = E(FLAG, K) XOR IV
Therefore:
1
C2 XOR IV = E(FLAG, K)
So Function 1 produces:
1
C1 = E(E(FLAG, K), K)
This is the key relationship between the two functions.
3. Analyze the Repeated-Key Construction
The service uses EDE-style 3DES:
1
E_K(D_K(E_K(P)))
with:
1
K1 = K2 = K3 = K
The middle decryption cancels the first encryption:
1
D_K(E_K(P)) = P
so the construction reduces to:
1
E_K(P)
In other words, the repeated-key 3DES construction behaves as a single DES encryption with the supplied key.
4. Investigate the DES Weak Key
The challenge uses the fixed weak DES key:
1
E0E0E0E0F1F1F1F1
The relevant property is that encryption with this weak key is self-inverse:
1
E_K(E_K(P)) = P
Applying that property to the result of Function 1 gives:
1
C1 = E(E(FLAG, K), K)
and therefore:
1
C1 = FLAG
The Function 1 ciphertext is consequently the recovered flag.
5. Complete Recovery Process
The intended two-query sequence is:
Step 1 — Function 2
Use:
1
2
Key:
E0E0E0E0F1F1F1F1
Record:
1
C2 = Function 2 ciphertext
Step 2 — Function 1
Use the Function 2 ciphertext as the plaintext:
1
2
Plaintext:
<C2>
and use:
1
2
Key:
E0E0E0E0F1F1F1F1
The resulting Function 1 ciphertext is:
1
C1 = E(C2 XOR IV, K)
Since:
1
C2 XOR IV = E(FLAG, K)
we get:
1
C1 = E(E(FLAG, K), K)
Using the weak-key property:
1
C1 = FLAG
6. Offline Recovery
The important part is that the player does not need to recover the hidden IV separately.
The two functions are deliberately chained together:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
Function 2
|
v
E(FLAG, K) XOR IV
|
v
Function 1
|
v
E((E(FLAG, K) XOR IV) XOR IV, K)
|
v
E(E(FLAG, K), K)
|
v
FLAG
The hidden value cancels naturally when the Function 2 ciphertext is passed into Function 1.
7. Final Flag
The recovered Function 1 ciphertext is the final CTF flag:
1
CYS{th3_l@st_b@tCh_w@s_d1fF3r3nT_b@tch!}
Submit it through the challenge website.
8. Summary
| Stage | Action |
|---|---|
| Function 2 | Submit E0E0E0E0F1F1F1F1 and obtain C2 |
| Function 1 | Use C2 as the plaintext with the same key |
| Analyze construction | Recognize repeated-key 3DES as single DES |
| Identify property | Recognize the weak key’s self-inverse behavior |
| Recover flag | Function 1 ciphertext becomes the flag |
| Submit | Submit the recovered flag through the website |
Final Flag
1
CYS{dynamic_flag}
Flag
CYS{dynamic}