How I cracked the NSA Crypto Challenge in Record Time

The NSA recently released an Android App called the "NSA Crypto Challenge".

Being in the security field, I was very interested in this app.  So of course I decided to give it a try, and see how quickly I could break the codes.  Being ambitious, I decided to jump straight into Advanced mode.  My score? 2 minutes, 43 seconds.

Now for those of you who have played this game on advanced mode, you're probably amazed by the speed which I was able to decode this.  For those who haven't played it yet, let me show you an example puzzle on "Advanced" mode.

I would have decoded this puzzle a lot quicker, but unfortunately I'm not a very fast typist with an on-screen keyboard.

Now you're probably wondering how I can decrypt this text so fast?  The secret is to attack the puzzle with "known plaintext", something the NSA probably wasn't expecting you to do.

It's a little known fact that Android .apk installers are actually compressed archive "zip" files.  To peek under the hood, all you need to do is download the .apk, and rename it to .zip.

Inside, you'll see a folder structure similar to this:

Once you've entered the archive, it's just a matter of traversing folders until you find something interesting...like this:

There are all sorts of interesting files underneath the Resources folder.  The first that stands out is "Cipher.txt".  I wonder what that is...

It just happens to be the encryption and decryption algorithms!

Unfortunately, the algorithms use a completely random key.  So this won't help us solve the puzzle.  But wait, remember that folder "PuzzlePacks"?  I wonder what's in there?

These files look promising.  Could it be that these files contain the original plaintext puzzles?

In fact yes they do, in XML format.

Now that we have the original plaintext, we can perform a "known plaintext" attack against the puzzle.

Count the number of characters in each word for the example puzzle. You don't have to do every word, just the first two or three should do.

Now we know we're looking for plaintext with "1 letter" followed by "8 letters" followed by "4 letters".

A quick scan of the plaintext files finds the following:

A wireless room set up in the Bletchley Park mansion’s water tower was codenamed Station X.

So, we simply start substituting letters, and we've solved our puzzle!

Is this cheating? Well, not really. Known plaintext attacks are very commonly used, and in fact helped the Allies crack German "Enigma Machine" codes in World War II.  No doubt this is not an attack method that the developers of this software intended...but when you're cracking encryption codes, sometimes you need to think outside the box.

Time trials and tribulations (aka: the riding of the pink sperm).

Well, with a descision to finally find some form, but without the available time to do 'form finders', I decided that without any specific training or equipment, that I would go race a time trial on the road.

I have always wanted to race a TT, toying with the idea of entering state champs a few years back, then not wanting to commit to the road efforts amidst all the MTB racing. I think it's because I do so much riding by myself, I figured if I can get motivated to hurt myself solo than maybe I would go orright at these TT things.

This race was part of a Brisbane-based women's series, and as such I thought it would be worth a crack despite my lack of fitness (it's getting there. Slowly) and lack of fancy apparel. Plus, if I sucked, I can still use the 'i'm not fit' thing, which is a great excuse and gets bandied around as much as the 'I have small children and I didn't get any sleep last night'. To be fair i'll probably be using this one until Elva's six. At least.

Rule of parenting #1: The night you need the most sleep is the one you'll get the least.

Anyway, back to TT's, who would want to look like a sperm anyway? I understand if you're planning on racing TT at a high level, but it cracks me up the amount of overweight old-mates and creepers that don skinsuits, tri-bars and sperm hats for a club meet, but hey, whatever floats your boat I suppose! It's probably the equivalent of the old mates at MTB races turning up on $10,000 bikes and creeping around. To be honest, I did try on my MTB skinsuit to see if it would work...but it just wasn't right when paired with breastfeeding boobs. Lo-fi is the new hi-fi anyway.

To me, 'getting aero' for the TT consists of getting into one of these on the start line:

Mmm, delicious!

So anyway, up early to take the scenic hilly route to the event, because the TT itself was only 20km so if i'm giving up a long ride to race i'm going to make it count, goddamnit! This doubled as a warmup (despite being freezing upon arrival at Closeburn).

I arrive to the 'zzzzzzing' of serious looking people on rollers. I ditch my (awesome) alloy roadie with the cheapest tyres money can buy (not a 'fast' rolling tyre, but flat they don't...) to enter.

I await Aido and 'lil pea as they were coming out for a morning adventure.

The sun was shining but it was freezing waiting in line to be the 29th rider set off, in 30sec intervals.

Without a Garmin etc, I decided that the best option would be to divide the race up into quarters and start below threshold and work up, expecting the third quarter to be the worst (it was). This worked pretty well except my timing was a fair bit off, working off a much more conservative estimate of what my average speed would be. I also noticed that I probably backed off too much on the descents for recovery. So while I finished super strong, there was maybe too much left in the tank at the end, but hey, it's a steep learning curve for a humble MTB'er. Being this far back was probably a good and bad thing, it meant I had someone to chase, but after I caught the rider in front it seemed that I just kept catching riders rather than having a carrot at a good similar speed to try and reel in.

Post race with 'lil pea.

I started consevatively, once I found a gear and settled into a rhythm. Aiden has a funny video of my start, which was me sticking my foot in my pedal going 'ooh, this gear's a bit big', and riding off into the sun. It took me a fair while to catch anyone, probably due to the conservatism (something i'm not generally renowned for on or off the bike), but a few km before the turnaround I caught a couple, then a few more at the turnaround—I was in a good groove. I kept my cadence up and sailed over most of the hills, despite still being a fatty boomsticks (haha).

She looked most similar to the one on the top right.

The next rider I caught was a pink sperm, and we are talking fully pink; pink tt helmet, pink MB kit, and her tt-bike was probably pink too, I wasn't paying attention to that. Then, I was alone until the final climb which was claiming a few victims as I pedalled past four of them who were looking a little worse for wear!

I finished feeling great, probably a little bit too awesome for having just raced, but the day was heating up, there was a coffee cart in attendance and all was well.

I ended up sixth overall, not too bad for a first timer. Not a great time but alright considering where I am at. It's a race of truth and sometimes the truth hurts, literally!