In the question there are two functions encrypt basically does IV ⨁ DES3(P⨁IV) and encrypt_flag just encrypts the flag after being padded into a multiple of 8. IV is a random 8 byte number which is always constant.

I have been looking at this question for a long time and I can't work it out. The question is to find the value of the flag by submitting encrypt(key, plaintext) and encrypt_flag() requests. I have thought that if plaintext='0000000000000000' then ciphertext=cipher.encrypt(IV)^IV but I have researched and haven't managed to find a vulnerability there. I also thought of saying key='000000000000000000000000000000000000000000000000' but that doesn't work since it isn't DES3 anymore as it degenerates to DES. The flag starts with crypto{ and we don't know it's length and it also finishes with }. The requests are made through an oracle, you send the requests as hex numbers. for encrypt_flag you just send the key as hex and it will return the flag encrypted as described above. With encrypt request you send a key and plaintext as hex number and it encrypts them as described above and then returns the ciphertext. So:

encrypt(plaintext, key)->IV ⨁ DES3(P⨁IV) where ⨁ denotes bitwise xor


encrypt_flag(key)->encrypt(padded(flag), key)

My intuition tells me that the vulnerability is in the fact we can select the key, but I can't think how that can make it vulnerable

  • $\begingroup$ "python gives error" means you should probably use key = binascii.unhexlify('000000000000000000000000000000000000000000000000') $\endgroup$ – JamesTheAwesomeDude May 27 at 16:38
  • $\begingroup$ @JamesTheAwesomeDude when I said it gives error, I didn't mean about the fact it's in hex, I meant it gives error in the DES3. It gives the following error: {"error":"Triple DES key degenerates to single DES"} $\endgroup$ – Michael Blane May 28 at 7:13
  • $\begingroup$ @JamesTheAwesomeDude I've edited it, so that it is clearer $\endgroup$ – Michael Blane May 28 at 7:14
  • $\begingroup$ Python code does not belong here, use pseudocodes or mathematical notations instead. But for your question, are you first padding your FLAG to 8 bytes (64 bits), then making hex string (16 bytes or two blocks of 3DES) and then encrypting it? If your IV is first generated and constant all over (thus known), then it is not secure under chosen plain text attacks. Again, I don't know what you are trying to do here. $\endgroup$ – Manish Adhikari May 28 at 8:47
  • $\begingroup$ @ManishAdhikari IV is first generated and constant all over, but it is not known to use $\endgroup$ – Michael Blane May 28 at 8:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.