# Vulnerability in DES3 when key can be chosen

In the question there are two functions encrypt basically does IV ⨁ DES3(P⨁IV) and encrypt_flag just encrypts the flag after being padded into a multiple of 8. IV is a random 8 byte number which is always constant.

I have been looking at this question for a long time and I can't work it out. The question is to find the value of the flag by submitting encrypt(key, plaintext) and encrypt_flag() requests. I have thought that if plaintext='0000000000000000' then ciphertext=cipher.encrypt(IV)^IV but I have researched and haven't managed to find a vulnerability there. I also thought of saying key='000000000000000000000000000000000000000000000000' but that doesn't work since it isn't DES3 anymore as it degenerates to DES. The flag starts with crypto{ and we don't know it's length and it also finishes with }. The requests are made through an oracle, you send the requests as hex numbers. for encrypt_flag you just send the key as hex and it will return the flag encrypted as described above. With encrypt request you send a key and plaintext as hex number and it encrypts them as described above and then returns the ciphertext. So:

encrypt(plaintext, key)->IV ⨁ DES3(P⨁IV) where ⨁ denotes bitwise xor

and

• "python gives error" means you should probably use key = binascii.unhexlify('000000000000000000000000000000000000000000000000') – JamesTheAwesomeDude May 27 at 16:38