Pages:
Author

Topic: Solve a riddle, guess a 4 char password and add 10 BTC to your xmas... SOLVED!! - page 14. (Read 13586 times)

legendary
Activity: 2324
Merit: 1125
Could you please comment your code (script)?
legendary
Activity: 1890
Merit: 1078
Ian Knowles - CIYAM Lead Developer
Solution Results

December 28, 2012, 08:44:16 UTC

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

the privkey got cracked

K1773R
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBAgAGBQJQ3VurAAoJEG9KjkBCBMba/uUH/28vQfVQV/Y+3Cb5q0Bfd1Od
FIUpVbGebxq2OH+lrNI1QJitKRWxCe7iUrk4ORJybqb7XDkclDYBrDyvZ3n+A74p
m2v2ExsupVNFnIsv3HPvHezab4cXhmYDV2PTyM0/yUiGsliqqFAqDqi7tdVA3eDB
dmjpsGOe8GAOH2Eoh4p2cwu7geXmgOs3gRgCN9MOp2S+waZfeghX7Y3+pN2JRcPX
/nIO3gZuLC/oeIiahmxW9Efq8La8Ffw19m5I9zDdRf7vQ8TgMgjZ6jIFJ0GLuewR
eGmZ/M5UOfrphkS67uljBAHI9bGMCfucxeeLH8ovYTF8YYeKhRzUTNgCgQ3hezg=
=qkYa
-----END PGP SIGNATURE-----

GPG Password: 41087438dbac5b77c3922cbe1f4d2f529ae3a4eb96a7534e4803361f1437f7e7

Private Key: 5Hq96RktdCU3BL1U4b7Wxse2wWCiSRXierJdS68RE1Mf8BXphjg

Stretched Hashed Password: "3a5Y+3a5Y=2x3a5Y(at least)\n"

Starting Four Character Password: 3a5Y

Modifications and Hints

Relevant code changed in the script used to generate the password
Code:
password="${password}+${password}=${password}${password}@L3AsT" # NOTE: this line was changed...

Hints given (and when)

December 26, 2012, 04:28:24 UTC (10 Confirmations)
Code:
at least

December 26, 2012, 05:58:56 UTC (51 confirmations)
Code:
I changed the equation.

December 27, 2012, 03:52:09 UTC (202 confirmations)
Code:
1p+1p!=pp

December 28, 2012, 07:21:30 UTC (300 confirmations)
Code:
1p+1p=2.p

December 28, 2012, 07:57:16 UTC (300+? confirmations - last hint wasn't enough so I finally put out this)
Code:
1p+1p=2.p
       ^
(my wife thinks I meant something else here *and* the equation is how you might/would "write" it down on paper)

What did we discover?

An unpredictable "salt" is of far more power to preventing "brute forcing" than the password itself (to the point that I think I successfully proved that even a 4 character password was going to be "unbreakable" without my hints - and without the hint released at 300 confirmations I very much doubt this would have ever been cracked).

This is along the same lines as Mike Caldwell's use of scrypt but with a more "creative" twist - amazingly enough even just the use of the letter 'x' to indicate "multiply" was simply not even understood by nearly all that were trying to break this (hint - get someone "older" to help you create the "salt" as most people trying to brute force your password are likely to be young and will quite likely not even be capable of thinking the same way).

For those that have said this is just a "brain wallet" I would like to just say that the "salt" and the "password" are two separate things (and with as little as four characters proven to being effective I think most people can probably remember a reasonably "random" password). If you turn the "salt" into something like an "equation" (or even let's say a "knitting pattern" if we are considering how to help out Gavin's grandma) where the "password" is transformed into each of the "variables" within in it then you can easily create an extremely hard to crack hashed password (my use of p+p=2p "vs" p+p=p.p with the seed password as "3a5Y" I think should be a convincing enough example).
legendary
Activity: 1890
Merit: 1078
Ian Knowles - CIYAM Lead Developer
Okay - I have sent 10 BTC to the following Bitcoin address (generated using vanitygen):

1CpueVNsEWgEhGD44ymVNoksyFp9Eekec7

and the next piece of information is the private key for that address that has been GPG encrypted:

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.9 (MingW32)

hQEMA8M4in1e/mjNAQf9HZKDFHUx+bn1/UqxSnEL161h1Yjplp5ijqeW36CrO6HR
PQgxfgT8Jddxkly+7bqZHwOHW68J8X0J/yfuO0mQ4MSVg3+x8Y1Ty/cujVv55bD0
/S3bHmPepKm57dHLsZ1CY3DT3/9mACnhqsQ84pPQKLQl7UNbhXhc9Il8hkcLS/Co
zpXh7GUuAMrA6TZZM+FLcD/oy5RU/50l5HIomG/fmRimtYu/N7i7y4mJYLh506DW
3HEaRUH4uEgPlpUIiSEQPPsiTt/9nRWdZB6t0mRLMivs/uvqmXygEa+BDV9ZWe7W
wB71vA+IHfPWmu5nXnYuqIvVBlGR8aCi6toXgaD5eNLADAG6kctTwLVA3l8dP/BE
bJNdi5HrYiPuz4hiE4xgTcwL8zppWoWfZCvmSpo1UE7Pmvdw2o60jtCOcK/qM/Bo
jpmvGRRvZVUuGV2flbf0DiTHTOGZ03AR81B+zoJKcN+VqeX/aLSG/QgKZAmkonSt
mGynLSYJgXlKttMNy6bzdSH1ImXH4ZYHjK4HLmVdoZ2DX5tEPMwRa7v9EzGmwNxT
Ii+TXhbaSd5PIRHobqticGcMGaLOgaAOloml18Pz65pYvzOMRTUBhyFu07BnOQ==
=nmS0
-----END PGP MESSAGE-----

Now the GPG public key and private key (encrypted of course) are as follows:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.9 (MingW32)

mQENBFDZhQIBCAD7GbsEa7PGP69KBSc/iOiXcqPr1BfYg6jBTZOz1G/qpJcSjG/Y
asGmnTh4zYlNy2qXvmcvoz0HAg3JatMUJKRTLIhs784QrzC3iRsvvf1RkWA2L34d
2B3/N3hI+ws/Q+3Q2lv5KkpcfYCZeVFkzPhGx3kanwZdGycTxmtlSBvLBYXKYpTF
aw/NE93of584/C/zzr0dqGj4T4izGBhW6SioPFgKwCE6meQJhHtstprDM0PYE7Uq
huZ5pgUL270KBctDqau6jXUMXRaRURFElcZmFzHhMagcDovcScmk1LHyQ5IwrAxs
6ZdIOLnZin1GQqwcpt4IPdb+CXLFFDIoFWr1ABEBAAG0H0NoYWxsZW5nZSA8Y2hh
bGxlbmdlQGNpeWFtLm9yZz6JATgEEwECACIFAlDZhQICGwMGCwkIBwMCBhUIAgkK
CwQWAgMBAh4BAheAAAoJEG9KjkBCBMbav1sIAOpol6INIBZ96QX8EGKJ38ptcW+C
7iFfZcCR8ObaTqpwvlgOw+n+H6sbw3i9xbfnplHo59dfhCCSQaObRIIH7Nb7Xxn7
Ep490lBcAXeeWd7jcnEKEFvuOUhSlQVGiunMUroHlZ1j38cNeXwUm9+hyZTZ+oHv
Izs0DeXZZDIvc51aBreTTJd6d9NSk+Zr99xw5oBdWfyPqFv+wnB60w4IEtdS5r6K
26O6JelDCzek0C9umOIRv3S6RlR0s9vkaunviV8zqfYnxZR6cch9utEcc3cdApus
uSjZS4nAQxBdUmyzY3hDKXHkLweS9MWBRAD6y+qJ9xyntac2/+QD3KKYVO65AQ0E
UNmFAgEIAOfP4v8I1Dy86eJUdqvVEAJlPPa0XGrPT2ew1AkNsxvBrEBSV4iQvnQW
x8VbEVxPa9jK/DB08wCNsC2gOhLVOf3GMSEeqhJVr+eZoHAF6f/Ozuw6kL04tb0I
GjHMtRh1MtJJBs3q3rBhGnB67weyY9VZmtcanCHTGygfzmGlfQuHwC1e/exl6AtW
HRZTEhx3FK+f/6kU8Zci6WA1QjDfxoCFXey8Va9XPdr8VPwPzyPDhEtlZD8/cIVZ
l55l77NhubYl1qs2SH6sWCDEYyA23O0pxrN2EGVv4jz6GkH5Ufr8IkfS5oEKEeHb
XLUOIK++ABQPLvvbJ9M1rFdxD11NGfsAEQEAAYkBHwQYAQIACQUCUNmFAgIbDAAK
CRBvSo5AQgTG2j7CB/9yQMbYz3tC8X7uoUrHAWYT/9JajH1Qr/2lzssvBYO8CEZY
6zedXBanMWNsTKHcDQkhZ2GFSsC74nA7Nn8vTv2WkY1Nfp/qZT95cg8B0FNQPLOu
/zHU5lZD/oJkgc28uv0z7C+saMXpNnoddhztEn7IOyXrSIu1+TucWnyDapzeOS4x
sUMk8nYzrdCjg1dbpqm+EEW0iFaZlITRkeUA94F627DWa3Fp7g+u/z3pUtkpFmRB
YYzRUiI7HEoNUmTGN1sSfgUD1bT0kd5Azy2+bE53B0LEUjMsBKcKQ5SHciLnkhU+
ehVrzP1BZQI6RuF14c7Bzkba7wt8OafmEAqoYO8Z
=nIuP
-----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP PRIVATE KEY BLOCK-----
Version: GnuPG v1.4.9 (MingW32)

lQO+BFDZhQIBCAD7GbsEa7PGP69KBSc/iOiXcqPr1BfYg6jBTZOz1G/qpJcSjG/Y
asGmnTh4zYlNy2qXvmcvoz0HAg3JatMUJKRTLIhs784QrzC3iRsvvf1RkWA2L34d
2B3/N3hI+ws/Q+3Q2lv5KkpcfYCZeVFkzPhGx3kanwZdGycTxmtlSBvLBYXKYpTF
aw/NE93of584/C/zzr0dqGj4T4izGBhW6SioPFgKwCE6meQJhHtstprDM0PYE7Uq
huZ5pgUL270KBctDqau6jXUMXRaRURFElcZmFzHhMagcDovcScmk1LHyQ5IwrAxs
6ZdIOLnZin1GQqwcpt4IPdb+CXLFFDIoFWr1ABEBAAH+AwMCFjQ1G6zKAqxgwLG1
VWj/tRSQhSb6e7JvNVLhok7sRtgF4FmcbU3vYRHSLEMfx4jO0BzBPqplYpMtAyUb
d+bwYLx42etKy77Ky8xATUjQ/Wg3rL6q1H3NUCqvFxNVXTgL9auV/5vTgYjCftOZ
fK3f36uRnaDYcxAdL6xU8znALQnG3ytJkNKOkrOIg1N+gfCZIVM1gzLLJYMecjnF
y+CmGFLtyCd65B65YayetNHLqyhHQcWWiqJfEkMt7VqWczOhHVx6NWN868zTImMy
+Xo05/YXxNJ49qZdogSfFqk/mib5/nQD7tvRVuF9cKIBL1eoiQ0FgDYD7BtEnzeV
1qwab9xrQpupv45qqRbnUqhFQp96Xx4LysXAdkjt8TLOeHEt+t4J9yN/fBbgn0qo
W5FNyXhaI4FqgN/mnBw26GWKisdWD3oOptA/n/fA3ATn+QOFBg1++pIjbCuqWsnD
76ZxX2t1e1t7jAOsG964PxM6WfIdsAdYaUyfiNw+P9URky97dphYDGXslpcsgNfq
POTDZPEdOK27Ugyo1NNzgX31l3/Q1XqjjWj+u9/zf/+6illj1xjDA5T6trYVDAPL
49uTs/NKiI5cJsvcYrc9x+RsZaTcz1nOq3rI6mKUhaajOv8VVc55odzDG89fYnQB
pFGBhKZsxSUAmddUjzxNAlxL9/zPC4dLJBetyt+84TvFc88BOnD8aOG08tdsBoiQ
7uja99fHMsEtf9Tjtgta9DMVQT/LljiG28AEvLgrhPdWF6llf3phwDow9LO49GO9
42pKmFa2QL/KfVnb6wYRE3cWv2Rv1vKM3RbD+A/+DMjUSQDM+KuEAHAVhmaHHVO2
n94k0U6kobMAQiprAOQo79wRza7xexWTtmpZgX8JFlSnByhUnDZUQhoFvG2PsXb8
q7QfQ2hhbGxlbmdlIDxjaGFsbGVuZ2VAY2l5YW0ub3JnPokBOAQTAQIAIgUCUNmF
AgIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQb0qOQEIExtq/WwgA6miX
og0gFn3pBfwQYonfym1xb4LuIV9lwJHw5tpOqnC+WA7D6f4fqxvDeL3Ft+emUejn
11+EIJJBo5tEggfs1vtfGfsSnj3SUFwBd55Z3uNycQoQW+45SFKVBUaK6cxSugeV
nWPfxw15fBSb36HJlNn6ge8jOzQN5dlkMi9znVoGt5NMl3p301KT5mv33HDmgF1Z
/I+oW/7CcHrTDggS11Lmvorbo7ol6UMLN6TQL26Y4hG/dLpGVHSz2+Rq6e+JXzOp
9ifFlHpxyH260Rxzdx0Cm6y5KNlLicBDEF1SbLNjeEMpceQvB5L0xYFEAPrL6on3
HKe1pzb/5APcophU7p0DvgRQ2YUCAQgA58/i/wjUPLzp4lR2q9UQAmU89rRcas9P
Z7DUCQ2zG8GsQFJXiJC+dBbHxVsRXE9r2Mr8MHTzAI2wLaA6EtU5/cYxIR6qElWv
55mgcAXp/87O7DqQvTi1vQgaMcy1GHUy0kkGzeresGEacHrvB7Jj1Vma1xqcIdMb
KB/OYaV9C4fALV797GXoC1YdFlMSHHcUr5//qRTxlyLpYDVCMN/GgIVd7LxVr1c9
2vxU/A/PI8OES2VkPz9whVmXnmXvs2G5tiXWqzZIfqxYIMRjIDbc7SnGs3YQZW/i
PPoaQflR+vwiR9LmgQoR4dtctQ4gr74AFA8u+9sn0zWsV3EPXU0Z+wARAQAB/gMD
AhY0NRusygKsYO5Pw1DjgpQRR40Ap2/VtpklqmVVphBk8Vr6SdnULIAU14S+7VS6
8jJInTtntgG/KqXGALCAbHZjehcq1pt5KLaQxjAAgDgo4YOEqqsU2/6vVdOyuLBp
DUG0HbIEKFicUcsw7LUIpHukAk7kajomRIYCKjwsGU5/igVeIu9N3vOT1DOWz5Fd
FvilzXmazIIms1RUZhWdS1kojXK1Rw5osW5TxuLMTmtS6Cw1v5U8PTJoi+/OmxtH
RnCcGS3liZIBTrv6YvgcD+MZ2xgY87LzZKeEGq9eG34cLme64pNgjSoPqRcbgWDU
wgE6x8eTRLqQaZ1bwIBciRE08X+PyiHcxPZAOEopahuNguMpn+5THfOhwOLESxP1
yvXpQtSZdtKoLdMzMRQ3f2JK+IBjuVOCOek1tky2IeScFDyFRRuyAn8PEqMTkzOs
DGP0QgVaVx7BYzfVyYEkVSPmzPIxt+trRiaVaOCOwTY/8zCXIP5JAGTYEBT1S6/b
2OkbuNn5d3QBY+3OD0bSGt6pcQqhPVj8O7YNz+TatQ60oyKdQN7RXfodAT0gcgVn
QGjXCF7eytByIY6TPmE3Ch63vPLYqjmsJk5xbBa9kfVm027C7CMdJYU86BVp9OGm
4nH8LWnnUtlQEzqPSzes0cJiKF7xCQR094xzwvWIuYanQ/qSORovlI3VzcNnmZlf
7DFjk0HVJxzdudhdOYxSMEAs6c8u+yQeyNFdBsFQtO40auvg2La4dPJMRqwQuowa
qS9G3Dy+NqfUp1KW1lwzJopB4dKcRo28MIrteUQjKDCh+WKq6rQsXWz+AZ2b5mmX
wlFEBmxy52s8qSrPIjBUmeSRsPK8WFTJQ8cSZGjlyQ4Zko6BNZB9AbosQk2ujU32
ojz03DmV/Q/LdAMd4nWJAR8EGAECAAkFAlDZhQICGwwACgkQb0qOQEIExto+wgf/
ckDG2M97QvF+7qFKxwFmE//SWox9UK/9pc7LLwWDvAhGWOs3nVwWpzFjbEyh3A0J
IWdhhUrAu+JwOzZ/L079lpGNTX6f6mU/eXIPAdBTUDyzrv8x1OZWQ/6CZIHNvLr9
M+wvrGjF6TZ6HXYc7RJ+yDsl60iLtfk7nFp8g2qc3jkuMbFDJPJ2M63Qo4NXW6ap
vhBFtIhWmZSE0ZHlAPeBetuw1mtxae4Prv896VLZKRZkQWGM0VIiOxxKDVJkxjdb
En4FA9W09JHeQM8tvmxOdwdCxFIzLASnCkOUh3Ii55IVPnoVa8z9QWUCOkbhdeHO
wc5G2u8LfDmn5hAKqGDvGQ==
=llev
-----END PGP PRIVATE KEY BLOCK-----

Now - let me just explain that I created this GPG public/private key pair on an older laptop (that is not able to connect to the internet) running a Live OS in which I used the following script with some not so very creative changes and a 4 character password (a random [EDIT: actually not random at all but was not hinted at as it was going to be a last resort if it wasn't cracked without it], non-dictionary with numbers and letters both upper and lower case) with the final hash of this password being used as the password for GPG...

Code:
#!/bin/bash

read -s -p "Password: " password

password="${password}+${password}=${password}${password}@L3AsT" # NOTE: this line was changed...

password=`echo $password | sha256sum`
password=`echo $password | awk -F ' ' '{ print $1 }'`

echo $password | xclip
echo Password hash is now on the clipboard...

Santa has loaded up that address with 10 BTC (and the funds won't be being moved by myself until at least until January 3rd 2013).

Happy holidays!
Pages:
Jump to: