What you will learn
- Distinguish encoding, hashing, and encryption
- Recognize properties of common ciphers
- Follow a repeatable cryptanalysis workflow
Cryptography CTF Challenges
Work from classical ciphers to modern cryptographic concepts while learning the difference between encoding, hashing, and encryption.
Cryptography challenges
20 challenges available.
CryptographyLevel 1★☆☆☆☆02. Hidden Secret - Base64 Decode
Base64 is an encoding method used to transmit binary data as text. It's not encryption, but it's often used for…
CryptographyLevel 1★☆☆☆☆11. Decode the Caesar Cipher
The Caesar cipher is one of the oldest classical ciphers used by Julius Caesar. It encrypts by shifting alphabet…
CryptographyLevel 1★☆☆☆☆14. ROT13 Magic
ROT13 (Rotate 13) is a type of Caesar cipher that shifts the alphabet by 13 letters. Interesting feature of ROT13:…
CryptographyLevel 2★★☆☆☆AES-ECB Mode Weakness
ECB leaks repeated block patterns. This introductory task first checks the difference between encryption and encoding.…
CryptographyLevel 2★★☆☆☆RC4 Stream Cipher Weakness
RC4 was once widely used but is now deprecated. This introductory task focuses on recognizing the provided data…
CryptographyLevel 2★★☆☆☆Vigenere Cipher Decryption
Decrypt a Vigenere cipher when the key length is known and retrieve the flag. Ciphertext:…
CryptographyLevel 2★★☆☆☆Finding Hash Collisions
MD5 collisions are practical. Hashes with broken collision resistance must not be used for security-sensitive…
CryptographyLevel 2★★☆☆☆Hash Length Extension Attack
Simple signatures such as hash(secret || message) can be vulnerable to length extension attacks with Merkle-Damgard…
CryptographyLevel 2★★☆☆☆Padding Oracle Basics
Padding oracle attacks use error differences as a plaintext recovery signal. This introductory task decodes leaked…
CryptographyLevel 2★★☆☆☆Rainbow Table Attack
Unsalted fast password hashes can often be reversed with precomputed lookup databases. Reverse the given MD5 hash. MD5…
CryptographyLevel 2★★☆☆☆One-Time Pad Key Reuse Attack
A one-time pad is safe only when the key is used once. Reusing the key lets known plaintext recover other plaintexts.…
CryptographyLevel 2★★☆☆☆Predictable Randomness
Pseudo-random output with a fixed seed is reproducible and must not be used for cryptographic secrets. Flag generation…
CryptographyLevel 2★★☆☆☆Breaking Small RSA Keys
Factor a tiny RSA modulus, recover the private exponent, and decrypt a list of ciphertext values. Public key and…
CryptographyLevel 2★★☆☆☆Cryptanalysis - Breaking the Affine Cipher
ciphertext.txt is an English report encrypted with the affine cipher E(x) = (a*x + b) mod 26. Letter case is preserved…
CryptographyLevel 3★★★☆☆Cryptanalysis - RSA Common Modulus Attack
Two systems reused the same RSA modulus n and only changed the public exponent. The ciphertexts c1 and c2 of the same…
CryptographyLevel 3★★★☆☆Cryptanalysis - Diffie-Hellman with a Small Prime
An old IoT device performed Diffie-Hellman key exchange with a prime p of only 36 bits. handshake.txt contains p, g, A…
CryptographyLevel 4★★★★☆Cryptanalysis - DSA Nonce Reuse Key Recovery
/challenge/signatures.json, created with fresh keys at every start, holds the DSA public parameters (p of 1024 bits, q…
CryptographyLevel 4★★★★☆Cryptanalysis - Wiener's Attack on RSA
An embedded-device team made the RSA private exponent d very small to speed up decryption. The public exponent e in…
CryptographyLevel 4★★★★☆Cryptanalysis - Recovering an LCG's Hidden Parameters
A service generated both session tokens and an encryption keystream from a linear congruential generator x_{k+1} =…
CryptographyLevel 5★★★★★Cryptanalysis - RSA e=3 Broadcast Attack
broadcast.json contains the same plaintext encrypted with unpadded RSA e=3 under three pairwise-coprime moduli.…