Overview
This challenge implements double encryption using two 3-byte keys on a custom SPN (Substitution-Permutation Network) block cipher.
Reconnaissance
Missing parameters (SBOX, PERM, ROUNDS) are extracted from a PNG image using the steganography tool zsteg:
zsteg -E "b1,rgb,msb,xy" diagram.png | head -c 1500 > params.jsonExploitation Strategy
Since the cipher uses a double-encryption scheme C = E(k2, E(k1, P)), we can execute a Meet-in-the-Middle (MITM) attack. Rather than bruteforcing 48 bits, we perform 24-bit forward encryptions and store them, then match backward decryptions to discover the key.
Solution Code
# SPN Meet-in-the-Middle search
# M1 = E(k1, P) for k1 in keyspace
# M2 = D(k2, C) for k2 in keyspace
# Find match: k1 = b'\x07\x15\x92', k2 = b'\x94o\xb0'
# Decrypt flag_cipher.txt -> Kaal{2fun_br0k3n}Flag
Kaal{2fun_br0k3n}