keybase.io & their cipher text challenges
So I was going through my gnupg keyring tonight and realized that I should probably revoke my 2048-bit pgp keys for some stronger 4096-bit variants. Â I thought to myself that it might be a bit of a pain, my public key is in a few different places that I would have to look up, one of them being keybase.io.
Then I realized, I havenât checked out their site in a long time.  I think I signed up sometime mid-2014, when they were first new and a buddy of mine sent me an invite.  I figured I would log in, see if theyâve done anything new to the site, and log off for the night.  Well, after clicking around a bit, I notice theyâre advertising the fact that they are now hiring.
This: https://keybase.io/jobs takes you to a page with a couple job descriptions, and randomly placed between webpage sections are two seemingly innocuous lines of text:
"XLI VMKLX SJ XLI TISTPI XS OIIT ERH FIEV GVCTXS, WLEPP RSX FI MRJVMRKIH."
"Sid uubd pl qgdbuyd prtu ca ubgqcukca itmo rgod ut ygob zoyk crrkoyoi iqsza 25519."
I thought to myself, hey, theyâre challenges. Â I should be able to crack this.
The first cipher text is what we call a âgimmieâ.  I knew it had to be a simple shift cipher (a âCaesars cipherâ).  Itâs all caps, and since itâs the first one on the page itâs probably the easiest (the further down you scroll, the more challenging things get, right?). Being lazy as I am, I copied it and pasted into emacs, M-r rot13-region and got:
âKYV IZXYK FW KYV GVFGCV KF BVVG REU SVRI TIPGKF, JYRCC EFK SV ZEWIZEXVU.â
Hmm, well thatâs not what I was expecting. Â ROT13 is probably the most common rotation. Â Ok fine, let me look at it again.
XLI VMKLX SJ XLI TISTPI XS OIIT ERH FIEV GVCTXS, WLEPP RSX FI MRJVMRKIH
Ah ha, âXLIâ is repeated twice.  If I had to take a wild guess, Iâd say thatâs the word âTHEâ.  Lets check letter distances (if you are following along, verify it visually: http://en.wikipedia.org/wiki/English_alphabet):
Well, then itâs ROT-22. Â Nice. Â Lets crack it:
THE RIGHT OF THE PEOPLE TO KEEP AND BEAR CRYPTO, SHALL NOT BE INFRINGED.
Awesome. Â Iâm loving keybase.io folks already. Â Crypto and the 2nd amendment, both near and dear to my heart.
Next up, the 2nd cipher text, this one is likely to be more tricky, as it was further down the page (implying more difficulty):
"Sid uubd pl qgdbuyd prtu ca ubgqcukca itmo rgod ut ygob zoyk crrkoyoi iqsza 25519."
The thing that jumps out is the â25519âł.  Thatâs a reference to Curve25519 - an elliptic curve used in ECDH (http://en.wikipedia.org/wiki/Curve25519).  âiqszaâ happens to be five letters, same with âcurveâ.  Also notice âcrrkoyoiâ is 8 long, same with âellipticâ.
Whatâs interesting here, is that this isnât a Caesar cipher. Â Iâm still going to guess itâs some classical cipher though. Â One wild guess is itâs a polyalphabetic substitution cipher, since the first challenge was a monoalphabetic substitution.
The next thing I notice, even though itâs a weak analysis, is that not all characters are represented in the ciphertext: v, x, f, and probably more, are missing. Â This is weak because the ciphertext is so short (not statistically relevant), but, itâs good to know because it leaves the door open to some ciphers.
Also, notice the ciphertext contains an even number of characters (62).
If we guess this to be a digraph based cipher, we see duplicate letter digraphs appear:
si du ub dp lq gd bu yd pr tu ca ub gq cu kc ai tm or go du ty go bz oy kc rr ko yo ii qs za
If this is a playfair cipher, then the key is a natural 25-letter alphabet square.
If I head to http://rumkin.com/tools/cipher/playfair.php and paste in the cipher, (basic key/no key), we get:
The tree of liberty must be refreshed from time to time with elliptic curve 25519.
It seems the folks at keybase.io have a great sense of humor and fun!
[edit] Since I started writing this a few nights ago, keybase has removed their challenges from the page. Â What gives!