ctf-crypto-classic

Files (1)

• SKILL.md

SKILL.md (first lines)

# CTF Crypto — Classic Ciphers

Vigenere, XOR variants, OTP reuse, substitution ciphers.

---

## Phase 1: Identify Cipher Type

```python
# Check ciphertext properties:
# - All printable ASCII → likely XOR or substitution
# - Base64 encoded → likely AES/DES in some mode
# - Only letters (no digits/symbols) → likely classical (Vigenere, Caesar)
# - 1-to-1 frequency distribution → monoalphabetic substitution
# - Flat frequency distribution → polyalphabetic or XOR with key

import collections

def analyze(ct):
    freq = collections.Counter(ct)
    print("Unique chars:", len(freq))
    print("Top 10:", freq.most_common(10))
    print("Index of Coincidence (IoC):", 
          sum(v*(v-1) for v in freq.values()) / (len(ct)*(len(ct)-1)))
    # IoC ~0.065 = English text (monoalphabetic)
    # IoC ~0.038 = random (polyalphabetic / XOR with long key)

analyze("CIPHERTEXT")
```

---

## Phase 2: Vigenere — Known Plaintext Attack

```python
def vigenere_decrypt(ciphertext, key):
    result = []
    key_idx = 0
    for c in ciphertext:
        if c.isalpha():
            shift = ord(key[key_idx % len(key)].upper()) - ord('A')
            base = ord('A') if c.isupper() else ord('a')
            result.append(chr((ord(c) - base - shift) % 26 + base))
            key_idx += 1
        else:
            result.append(c)
    return ''.join(result)

def derive_key(ciphertext, known_plaintext):
    """Recover key from known plaintext (e.g., flag prefix 'CTF{')."""
    key = []
    for c, p in zip(ciphertext, known_plaintext):
        if c.isalpha() and p.isalpha():
            c_val = ord(c.upper()) - ord('A')
            p_val = ord(p.upper()) - ord('A')
            key.append(chr((c_val - p_val) % 26 + ord('A')))
    return ''.join(key)

# If flag format known:
cipher = "VJLQCQICXWQAJFIJASXM"
key = derive_key(cipher, "CTF{")
print("Key starts with:", key)
full = vigenere_decrypt(cipher, key)
print("Decrypted:", full)
```

---

## Phase 3: Kasiski + Frequency Attack

```python
from math import gcd
from functools import reduce
from collections import Counter

def kasiski(ciphertext, min_seq=3):
    """Find repeated sequences → GCD of distances = key length."""
    ct = ''.join(c.upper() for c in ciphertext if c.isalpha())
    distances = []
    for seq_len in range(min_seq, 6):
        seen = {}
        for i in range(len(ct) - seq_len):
            seq = ct[i:i+seq_len]
            if seq in seen:
                for prev_pos in seen[seq]:
                    distances.append(i - prev_pos)
                seen[seq].append(i)
            else:
                seen[seq] = [i]
    if distances:
        kl = reduce(gcd, distances)
        print(f"Key length: {kl}, Distances: {sorted(set(distances))}")
        return kl
    return None

def frequency_break_vigenere(ciphertext, key_length):
    """Break Vigenere by frequency analysis on each column."""
    ct = [c.upper() for c in ciphertext if c.isalpha()]
    english_freq = [0.082,0.015,0.028,0.043,0.127,0.022,0.020,0.061,0.070,
                   0.002,0.008,0.040,0.024,0.067,0.075,0.019,0.001,0.060,
                   0.063,0.091,0.028,0.010,0.023,0.002,0.020,0.001]
    key = []
    for i in range(key_length):
        group = [ct[j] for j in range(i, len(ct), key_length)]
        best_shift, best_score = 0, -1
        for shift in range(26):
            dec = [chr((ord(c) - ord('A') - shift) % 26 + ord('A')) for c in group]
            freq = Counter(dec)
            score = sum(freq.get(chr(j+65), 0) / len(group) * english_freq[j]
                       for j in range(26))
            if score > best_score:
                best_score, best_shift = score, shift
        key.append(chr(best_shift + ord('A')))
    return ''.join(key)

ct = "CIPHERTEXT_HERE"
kl = kasiski(ct)
if kl:
    key = frequency_break_vigenere(ct, kl)

From Yoraexe/ceobe, MIT.

More from Yoraexe/ceobe