The Collector's Trail

The brief

A private collection has been separated from its catalogue. Two archives remain, but neither tells the whole story. Six works once belonged to the collection. Identify the works and their artists, trace the correct records in the museums' official collections, and recover what the collector left behind. The collector was careful. Be more careful.

• the-collectors-trail.zip, 36 MB

In short

Six images of famous paintings each hide a sealed 8 byte fragment in a different way. In the artists' birth order they derive a master key, the exact museum catalogue records unlock an encrypted cabinet, and a keyed pixel message points to the release file that decrypts to the flag.

Six paintings, six hiding places

The vault holds six famous paintings, from Vermeer to Schiele. Each hides one 8 byte fragment in its own place, a private PNG chunk, bytes after the image end, text under a clear border, steghide, blue pixel bits or row filter bytes.

Every fragment carries a seal

Each fragment comes with a 2 byte seal, the first two bytes of the SHA-256 of its 8 bytes. All six fragments matched their seals, so every byte of the key material was read exactly.

Ordered by the year each artist was born

The rules order the fragments by birth year, from Vermeer in 1632 to Schiele in 1890. Joined in that order, the 48 bytes go through HKDF-SHA256 with the salt collector-v2:ossuary and give the master key.

The catalogue opens the cabinet

The cabinet password is salted with the SHA-256 of six museum locators, written exactly as the official records show them, like museodelprado.es/P000749. One wrong digit changes it. With all six exact, the password is 77dad76b506abec33742bc43b14710e4.

A message spread across 6,220,800 bytes

Inside, stego.png hides a keyed message. An HMAC of a counter picks each next byte among its 6,220,800 color values, and their lowest bits spell a 451 byte payload with a valid CRC. It names a GitHub release and its tag.

Only the release copy is real

The repository holds four more 82 byte flag files, and every one fails authentication. The release file, decrypted with AES-256-GCM under a key derived from the tag's serial, verifies and gives the flag.

The insight

Each hiding place was simple on its own. The trap was exactness, since one wrong accession number or one lookalike file breaks the whole chain.

The flag

hiCTF{marble_sparrow_9eb44602eedb764aac082a3816b7d7cb}