Can you Crack It? Break this cypher, get an interview with GCHQ | Hacker News Reader

Can you Crack It? Break this cypher, get an interview with GCHQ

canyoucrackit.co.uk

37 pointsgacba27 comments

Ok, now these kinds of challenges are not really good. The reason is that without any extra property, they are trivial. Here is why:

Let's assume you have a cyphertext c, of length l (ie |c| = l). Now I take a plaintext p of length also l (|p| = l). Let the key k be c xor p. Now

   c xor k = c xor (c xor p) = (c xor c) xor p = 0^l xor p = p

Where 0^l is a string of l zeros. So yeah, given one cyphertext, I can craft a pair of key and plaintext such that there is a cypher (simple xor) that, given the cyphertext and the key, outputs the plaintext.

What is worse? I can craft |E|^l of such plaintexts (where |E| is the size of the alphabet).

So yeah: this test only checks if people know basic cryptography and boolean algebra. Which tends not to be a very good test[1,2]

[1] http://techcrunch.com/2011/05/07/why-the-new-guy-cant-code/

[2] http://devinterviews.pen.io/

also, it's even not a case of "crack this and get an interview" it's "crack this and get to apply for the same vacancy that gchq publish on their homepage": job id 35874.

But, it's a good publicity ruse.

edit: the pay's not even that great.

Nice work on getting to the true meaning.

Is that salary listed yearly? If so I can understand why they have to do something like this to get people to apply, I earned more than that while working in retail.

Why do you think this challenge has anything to do with xor'ing with a key? It's not that kind of code.

Actually, I'd say that mob is after assembly language programmers at the moment, not people who know "basic cryptography and boolean algebra".

Moreover, they don't really care if the solution gets plastered all over the net, because from their perspective the point is not the code, but the message (that they have jobs available to British citizens with those skills). And I know that because, according to the press, they said so.

Why do you think it doesn't? Xor ciphers are the basic blocks of S-boxes[1], which are part of several cryptosystems, like AES, DES and Blowfish.

And the word cipher is on the title.

[1] http://en.wikipedia.org/wiki/S_box

Oh! You thought they wanted to hire people who could crack actual real world cryptosystems.

I'm sorry if I misunderstood you but I get the impression that you feel like a One Time Pad is trivial to break?

Just because you can construct any plaintext of that size and a suitable key to generate that ciphertext doesn't mean you've broken it or know anything about its content (aside from the maximum length of the plaintext).

The answer is supposed to be a keyword, I seriously doubt it's an OTP they are asking for...

Just in case no one gets it in time:

Pr0t3ct!on#cyber_security@12*12.2011+

http://canyoucrackit.co.uk/soyoudidit.asp

Which leads to http://www.gchq-careers.co.uk/cyber-jobs/, then https://apply.gchq-careers.co.uk/fe/tpl_gchq01ssl.asp?newms=.... They don't even seem to track who solved it or not, unless they look at the referral URLs on Google Analytics.

-1 to GCHQ for not even tracking who solved their damn riddle and actually using that as a bozo filter. Duh.

The Australian equivalent (DSD) did a challenge like this last month. Same deal - x86 assembly to decrypt a message and reveal a secret URL. They too had no tracking.

Can anyone here point me in the direction of what I should be reading in order to attack a problem like this.

I literally have little to no idea how to start.

Give me a reading list, or outline the first few steps!

Here's a good start to find out about the employer:

http://www2.warwick.ac.uk/fac/soc/pais/people/aldrich/vigila...

If they sound interesting to you then read the plenteous clues in the HN thread from this morning.

It would be pretty hilarious if no actual British citizens figure it out for themselves.

According to http://www.bbc.co.uk/news/technology-15968878 it's for GCHQ rather than MI5.

My bad, corrected.

Working on it here: http://forum.xda-developers.com/showthread.php?p=19888836

don't know if this means anything at all but exif info on the photo has a comment: QkJCQjIAAACR2PFtcCA6q2eaC8SR+8dmD/zNzLQC+td3tFQ4qx8O447TDeuZw5P+0SsbEcYR78jKLw==

Previous discussion from earlier today: http://news.ycombinator.com/item?id=3299155

are we crowd sourcing intelligence tasks now?

So did anybody genuinely manage to figure this out for themselves without google?

Why oh why wouldn't they put this up there in a copy-able format? Why an image?

Spoiler: because the image displays some x86 code (its RC4 with a fixed key), the image file itself contains the ciphertext (in a PNG iTXt block).

Are Americans eligible to apply?

I don't think so. They don't even take non-British EU citizens.

/index.asp oh please, what's a challenge worth when I can find out the solution without solving it, by going to the application url. My naive proxy thought it's advertisment and didn't allow me apply hehe.

also we're lucky they exclude non-british folks, that way they interchange doubtable trust measures with infosec beginners.

Reply on news.ycombinator.com