CRACK Solution

REPEATER

CRACK Vigenere repeating-key XOR

FamilyCRACK Graph0.501 DifficultyMedium Ring03 IDm06_vigenere

Prerequisites

PARITY

Unlocks

CROSSFADE THREE COLOR BUS

Accepted input ACCESS

TechniqueVigenere repeating-key XOR Rulenonzero SampleACCESS

Walkthrough

One XOR key would be easy. This gate cycles a three-byte keyword across the message, so the key under each character keeps shifting. Line the keyword up and peel it back.

It is a Vigenere XOR: key byte (position mod 3) is XORed into each character. XOR each target with the matching repeating key byte to recover the original.

Hints

HINT 1: Length is fixed at 6. The key is three bytes long and repeats: positions 0 and 3 share a key, 1 and 4, 2 and 5.
HINT 2: The three key bytes are 0x4B, 0x1D, 0x36, applied in that order and wrapping.
HINT 3: XOR each stored target by its repeating key byte. The six results spell ACCESS.

Reject Samples

ACCES5
access
ACCES
ACCESSS
DENIED

Verifier Listing

; m06_vigenere: "Repeater". A Vigenere-style cipher: instead of one XOR key the
; check cycles a three-byte keyword (0x4B, 0x1D, 0x36) across the input, XOR key
; byte (i mod 3) into input byte i, and compares the result to a stored target at
; each of 6 positions. The cycling key is the whole idea: position 0 and 3 share a
; key byte, 1 and 4 share the next, 2 and 5 the last. To crack it, XOR each target
; with the matching repeating key byte to read the password. Technique: Vigenere
; repeating-key XOR. r0 = 1 on accept; rule: nonzero.
;
; key = { 0x4B, 0x1D, 0x36 } cycled; targets are key[i mod 3] ^ c of "ACCESS":
;   0x0A 0x5E 0x75 0x0E 0x4E 0x65

        len   r2
        cmp   r2, 6
        jnz   bad           ; fixed length 6

        ; lay the three key bytes into scratch[0..2]
        mov   r1, 0
        mov   r0, 0x4B
        stb   [r1], r0
        inc   r1
        mov   r0, 0x1D
        stb   [r1], r0
        inc   r1
        mov   r0, 0x36
        stb   [r1], r0

        mov   r7, 0         ; r7 = position index
loop:   cmp   r7, 6
        jge   ok

        ; --- r5 = r7 mod 3 (subtract loop), the key slot ---------------
        mov   r5, r7
m3:     cmp   r5, 3
        jl    havek
        sub   r5, 3
        jmp   m3
havek:  lds   r4, [r5]      ; r4 = key[i mod 3]

        ldb   r0, [r7]
        xor   r0, r4        ; apply the cycling key

        ; --- select this position's target byte ------------------------
        cmp   r7, 0
        jz    t0
        cmp   r7, 1
        jz    t1
        cmp   r7, 2
        jz    t2
        cmp   r7, 3
        jz    t3
        cmp   r7, 4
        jz    t4
        mov   r1, 0x65      ; position 5
        jmp   chk
t0:     mov   r1, 0x0A
        jmp   chk
t1:     mov   r1, 0x5E
        jmp   chk
t2:     mov   r1, 0x75
        jmp   chk
t3:     mov   r1, 0x0E
        jmp   chk
t4:     mov   r1, 0x4E
chk:    cmp   r0, r1
        jnz   bad
        inc   r7
        jmp   loop

ok:     mov   r0, 1
        ret
bad:    mov   r0, 0
        ret