Hide

Problem E
Key "Hash"

A cryptographic hash function is an algorithm that maps data of arbitrary size to data of a fixed size. Hashes are one-way functions which are computationally infeasible to invert or reverse. In a strong hash, the only way to find the original message that produced a given hash would be a brute-force attack. Sometimes attackers keep a hash of the encryption key along with the data as a method of associating keys stored elsewhere to the correct files.

Key Hash

A “key_hash” value can be found within the TLV data structure. This hash is somehow associated to the rest of the data in that structure. Pseudocode for this hash is listed in the malware report. It is safe to assume that this is how the developers look up one of the keys for decrypting the files. The algorithm is described as follows:

\includegraphics[width=0.9\textwidth ]{keyhash_alg}

This is obviously something of the malware developers’ own creation, and definitely not a cryptographically secure hash. It also appears to only work on data that is $16$-bytes long, which according to the report is because the keys that it hashes are always $16$ bytes long.

In the malware report a large list of random $16$-byte objects is found. These actually appear to be randomly generated this time, which makes you wonder just how many developers worked on this ransomware. You also notice a list of "key_hash" outputs that have been found. You connect the dots and realize some of those random objects might be used as keys in the final decryption layer.

$16$-byte Random Objects

0x3c3102c78e3a3ed31656d8e3c9ac1f3b

0xc3540552a86a0db0128a3f378f05e83a

0x22858a33d4b403687f28254d3785e09d

0x107aabf691f48debc53e88ca5a4c884d

0x813c893aa5e3c52dc64e3dc5493abb16

0x7fdd4c7a8fc01a09e0e7c1bdd43b1328

0x30d8b441f9af30c0734833af36cb74ae

0x05b115935984da0430baf5b9c3ae2b6a

0x3ad8d3e573276aefd1b837946ee694d2

0xa58126faef3ba174987694c3b6184b20

0x5d7c57a158e737e587c4c20a8b154e0c

0x0ae45a528a51d725bc7a11b22378a48a

0xe028fc7de6accc28adb69301d827960d

0x82ea7a8ec082d18a489313a5033620b6

0x222a1c92c80082e22f5ec31c671eaa43

0xce0ba6bff6263f28ed0c34dd364fe206

0x689b4d4700ccee9d5d4b706d4ca561ec

0x70763051505a3ec3a1b03ba52a5034e0

0x5f1e1e731bc174dcc5c22580b5915b4c

0x8d0fdb518e924d1c028430b82c5a0063

0x7f66ab1948c42b4676d4a1d958b0a5b3

0x560f62c0d48765f14e43d5fb9d096232

0xb0f84325c00718c472996358dd0f3b4f

0x557fdc037cbfda3b2b3d0adb916e1db2

0x999c184e59fe8d1f66f260da14ff6bf0

0xd3d89edb212c332fdb1d6ce85ec9263f

0x34bec5e9bdc3872e96c9cff3c1a5d59a

0xde999e3b47a3bb6ccd4852bef6a647e0

0xf9d7e90352956071d4453f6b7d5ca38c

0x91acdb8b283d12cc86f06994db7f2797

0x8a1358de28b3c8525de63bc488af5214

0xd9c00ba45e567fadeae00017506667e2

0xc89632547d5cb8bf7d3dea561b001ad0

0xc7dccf991e019a69aa6e6f019b00e9c5

0x547e72961be9908c2b466d21ceb968b2

Key_Hash outputs

540541445:2428518688:33628526:2356318865:4070121552:1352772538

1275659304:2181210775:2416013469:202113024:4149014589:2464322186

886310936:1258898530:67593217:4200071938:4029137660:598092508

270864:3365015620:874776608:5242890:505212503:1761639401

441995429:545293120:2303721669:67592:1570535065:1977017073

2050:2196402828:1078399330:2459976341:1217616773:937216646

Implement the algorithm above to take random $16$-byte inputs and produce a key_hash.

Once you have a working algorithm, test all the random keys from the list above to see which ones match the list of key_hash outputs you have. Make sure you keep the key - key_hash relationships stored somewhere as it will make future work much easier!

Input

Multiple random $16$-byte objects encoded in HEX separated by newlines.

Output

The RAW output of the key_hash algorithm for each input separated by newlines.

Sample Input 1 Sample Output 1
8ea859d168c64f1f754e7c7032f1f85d
c88d4022dcdc435635f5fa4a0d33414a
cdc41d2126ed8f737d987a390a8d75bd
1a169ae91a343fb891995d37a9f9046e
46ea9d8afe42595e2bed2a9102eb20d8
8799479a631ecf7375080608bc7b5f28
67110992:2326286721:2566916433:34471970:4032197778:3991754888
1216692258:2148007936:54525970:948605472:3858231874:3475190104
2172919073:1279262720:17318272:637570065:1028156149:2643705843
402784488:34904577:604258884:2550152216:2426395798:2145289581
1189124362:656512:1210580995:2453803032:2720344763:1473927746
93848466:2181121032:319308164:34890:1902743136:1926498450

Please log in to submit a solution to this problem

Log in