Cipher

The brief

A locked Android vault guards dozens of encrypted records behind a single passphrase. The interface reveals almost nothing, so inspect what lies beneath, understand how access is derived, and recover the secret hidden inside.

• cipher.apk, 38 KB

In short

The vault looked solid. Its passphrase was long, every record had its own key and the key derivation was slow on purpose. The weak spot was where the passphrase came from.

A vault that shows nothing

The app holds 64 encrypted records behind one passphrase. There is no server and nothing on screen, so everything had to come out of the app file itself.

Its own reader for the app

The lab wrote its own reader for the app's bytecode and went through it class by class. Seven classes mattered, among them a legacy passphrase generator called SeedWindow.

A long passphrase from a short number

The passphrase looks like six random words and a number. It comes from one seed, and SeedWindow allows only 262,144 of them instead of 4.3 billion.

The app checks every guess for you

The vault ships a check value for offline unlock. Each guess runs through 32,768 rounds of PBKDF2 and the check says yes or no, with no rate limit and no lockout.

262,144 guesses, in minutes

The lab rewrote the search in C on the processor's own SHA instructions and ran it in the background. Seed 764,408,707 matched.

Record 47

With the root key all 64 records decrypt. Record 47, an archived security memo, holds the flag.

The insight

A vault is only as strong as the place its passphrase comes from. Here that place had 18 bits.

The flag

hiCTF{cryptography_should_be_implemnetd_properly}