# Hack Dat Kiwi 2017## PS4
## Information**Category:** | **Points:** | **Author:**--- | --- | ---Crypto | 120 | Ben Burnett
## DescriptionWe are presented with a php script responsible for encryption and decryption along with three parameters for configuring it:```BLOCK_SIZE = 16;SEED = 999999;ROUNDS = 4;```
We are presented with a large block of ciphertext, and asked to decrypt it.
This is the same encryption script that PS1 and PS2 use, but the parameters are different. Most interestingly the encryption goes through four rounds.
## SolutionI don't want to repeat too much from the PS1 or PS2 write-up, so I'll assume that you have read that one first.Again, the major difference here is that the encryption goes through four passes.This means that each piece of cipher text is encrypted by four, probably different, pieces of the key.
The plan of attack here is to use the solution for PS2 but scale it to run two more loops.Obviously we can't do 256^4 solutions for each character of ciphertext so we make some optimizations.* We look to start with a column that reuses part of the key. This reduces the space to 256^3.* Once we solve a character in a column we feed that reduced solution set in to the next character instead of doing 256^3 for each character.* Once we solve a column we reuse those solved key components to speed up the solves of the remaining columns.
You will find the complete script in `ps4.py`. It does take a bit to calculate the first column, but in the end you get the following output after solving only 8/16 columns:```0	= k[0]	k[3]	k[14]	k[12]1	= k[1]	k[11]	k[6]	k[5]2	= k[2]	k[15]	k[0]	k[2]3	= k[3]	k[10]	k[11]	k[15]4	= k[4]	k[2]	k[1]	k[9]5	= k[5]	k[6]	k[15]	k[10]6	= k[6]	k[14]	k[10]	k[3]7	= k[7]	k[9]	k[13]	k[4]8	= k[8]	k[7]	k[4]	k[8]9	= k[9]	k[0]	k[8]	k[11]10	= k[10]	k[12]	k[3]	k[7]11	= k[11]	k[5]	k[2]	k[13]12	= k[12]	k[4]	k[12]	k[14]13	= k[13]	k[8]	k[7]	k[1]14	= k[14]	k[13]	k[9]	k[0]15	= k[15]	k[1]	k[5]	k[6]Solving column 12 ...Solves 0: 6619136Solves 1: 2593480Solves 2: 1011669Solves 3: 390933Solves 4: 150284Solves 5: 57409Solves 6: 21847Solves 7: 8343Solves 8: 8343Solves 9: 8343Solves 10: 3166Solves 11: 1160Solves 12: 1160Solves 13: 409Solves 14: 409Solves 15: 409Solves 16: 157Solves 17: 157Solves 18: 157Solves 19: 50Solves 20: 13Solves 21: 4Solves 22: 4Solves 23: 2Solves 24: 1Solving column 0 ...Solves 0: 25856Solves 1: 10180Solves 2: 3967Solves 3: 1569Solves 4: 1569Solves 5: 1569Solves 6: 633Solves 7: 633Solves 8: 633Solves 9: 243Solves 10: 243Solves 11: 83Solves 12: 35Solves 13: 10Solves 14: 10Solves 15: 10Solves 16: 10Solves 17: 10Solves 18: 10Solves 19: 10Solves 20: 10Solves 21: 4Solves 22: 4Solves 23: 4Solves 24: 4Solves 25: 1Solving column 6 ...Solves 0: 25856Solves 1: 9900Solves 2: 3777Solves 3: 3777Solves 4: 1434Solves 5: 552Solves 6: 219Solves 7: 101Solves 8: 101Solves 9: 101Solves 10: 34Solves 11: 34Solves 12: 12Solves 13: 12Solves 14: 12Solves 15: 5Solves 16: 3Solves 17: 3Solves 18: 3Solves 19: 2Solves 20: 2Solves 21: 2Solves 22: 2Solves 23: 1Solving column 5 ...Solves 0: 25856Solves 1: 10136Solves 2: 4016Solves 3: 1572Solves 4: 609Solves 5: 255Solves 6: 92Solves 7: 30Solves 8: 30Solves 9: 15Solves 10: 15Solves 11: 15Solves 12: 15Solves 13: 15Solves 14: 4Solves 15: 3Solves 16: 3Solves 17: 3Solves 18: 3Solves 19: 3Solves 20: 1Solving column 1 ...Solves 0: 25856Solves 1: 10172Solves 2: 10172Solves 3: 4124Solves 4: 4124Solves 5: 4124Solves 6: 1645Solves 7: 1645Solves 8: 1645Solves 9: 662Solves 10: 662Solves 11: 264Solves 12: 100Solves 13: 100Solves 14: 100Solves 15: 100Solves 16: 100Solves 17: 40Solves 18: 40Solves 19: 40Solves 20: 15Solves 21: 5Solves 22: 5Solves 23: 2Solves 24: 2Solves 25: 2Solves 26: 1Solving column 2 ...Solves 0: 25856Solves 1: 10184Solves 2: 10184Solves 3: 3883Solves 4: 1418Solves 5: 519Solves 6: 519Solves 7: 519Solves 8: 519Solves 9: 225Solves 10: 225Solves 11: 225Solves 12: 84Solves 13: 26Solves 14: 12Solves 15: 6Solves 16: 3Solves 17: 3Solves 18: 3Solves 19: 3Solves 20: 2Solves 21: 2Solves 22: 2Solves 23: 1Solving column 9 ...Solves 0: 25856Solves 1: 10276Solves 2: 4086Solves 3: 1557Solves 4: 590Solves 5: 590Solves 6: 590Solves 7: 590Solves 8: 215Solves 9: 215Solves 10: 98Solves 11: 32Solves 12: 10Solves 13: 4Solves 14: 1Solving column 7 ...Solves 0: 25856Solves 1: 10268Solves 2: 4054Solves 3: 1606Solves 4: 636Solves 5: 237Solves 6: 237Solves 7: 237Solves 8: 237Solves 9: 88Solves 10: 88Solves 11: 33Solves 12: 13Solves 13: 7Solves 14: 7Solves 15: 7Solves 16: 7Solves 17: 7Solves 18: 7Solves 19: 2Solves 20: 2Solves 21: 2Solves 22: 2Solves 23: 2Solves 24: 2Solves 25: 2Solves 26: 2Solves 27: 2Solves 28: 2Solves 29: 1md5 = 83fd68205d7e294be2267fe68a2850d3```And we can use the md5 `83fd68205d7e294be2267fe68a2850d3` in the php script to decrypt the message.
