Cryptography

These three words get mixed up all the time, but the difference decides how you attack a challenge. So learn this first:

A handy way to remember it: encoding is like translating to another language, encryption is like locking a box, and hashing is like taking a fingerprint. You can't rebuild a person from a fingerprint, but you can check whether it matches someone.

Computers store everything as numbers from 0 to 255, called bytes. Encodings write those bytes as ordinary characters, so they can travel safely through email, web pages and JSON.

Hex writes each byte as two characters from 0-9 and a-f. Base64 uses 64 characters (A-Z, a-z, 0-9, + and /) and pads the end with = when needed. It is everywhere in CTFs, so learn to spot it.

A useful trick: since flags start with zda{, a Base64-encoded flag always begins with the same letters, emRh. Spot those and you know exactly what you have.

emRhe2I0c2U2NF8xc19uMHRfM25jcnlwdDEwbn0=

Your result appears here.

A Caesar cipher shifts every letter along the alphabet by a fixed amount. With a shift of 3, A becomes D, B becomes E, and so on, wrapping back around after Z. A shift of 13 is so common it has its own name, ROT13: HELLO becomes URYYB.

There are only 25 possible shifts, so you can simply try them all. But there is a smarter way, and it is one of the most important ideas in cryptography: use what you already know. Experts call this a known-plaintext attack.

Look at this message. Digits and symbols don't change in a Caesar cipher, and the pattern of three letters and a brace looks a lot like a flag:

gkh{y0a4a3_ao3_s3aa3yz}

You know every flag begins zda{, so g must have started out as z. Count how far forward you must move from g to reach z, and you have the shift for the whole message.

Your result appears here.

XOR is a simple operation on bits, written ^. It turns up all over modern cryptography because of one magical property: doing it twice with the same key gets you back to where you started.

'H' is 72
72 ^ 42 = 98     encrypted: 98 is the letter 'b'
98 ^ 42 = 72     decrypted: back to 'H'

So if you know the key, decrypting is the same action as encrypting. If you don't know the key, known plaintext helps again: XOR the start of the message with zda{ and the key falls out. You will crack a real XOR puzzle in the reversing lesson.

Real challenges often stack several steps. The method is the same as the postcards from earlier: decode one layer, look at the output, decide what it is, and repeat. This one has three layers. The last is a little different, because the text won't be fully readable until you rotate its letters.

NmQ3MTZlN2I2MzMzMzM3OTVmNjc3NTMzNWYzMDYxMzEzMDYxN2Q=

Your result appears here.

Modern encryption like AES and RSA can't be broken by brute force. So challenges attack the mistakes people make when using it:

• Reused keys or randomness. Encrypting two messages with the same XOR key leaks both.
• Small numbers. RSA is safe only with huge primes. Challenges often use small ones that can be factored.
• Weak hashes. You can't reverse a hash, but you can hash millions of likely passwords from a wordlist until one matches, using tools like hashcat.