258 words
1 minute
🔐 PicoGym - Vigenere

📂 Download challenge file.

Description: Can you decrypt this message? Decrypt this message using this key “CYLAB”..
Difficulty: Medium
Author: Mubarak Mikail

Summary#

This challenge is about Vigenère cipher, a classic polyalphabetic substitution cipher.

It can be solved either manually (tabula recta) or automatically using an online tool like Vignere cipher

The approach is quite similar to the one used in Easy1.

Analysis#

We are given a file cipher.txt:

Terminal window
$ file cipher.txt
cipher.txt: ASCII text

Its contents are:

rgnoDVD{O0NU_WQ3_G1G3O3T3_A1AH3S_2951c89f}

At first glance, the text inside the braces looks like a flag, but the prefix rgnoDVD doesn’t match the standard picoCTF{} format. This suggests that the flag string has been encrypted using the Vigenère cipher with the provided key “CYLAB”.

It’s important to note that only alphabetic characters are affected by the cipher, symbols, digits, and underscores remain unchanged.

Decryption Steps#

Since the key and ciphertext lengths differ, the key must be repeated to align with the entire text.

Key: CYLABCYLABCYLABCYLABCYLABCYLABCYLABCYLABCY
Cipher: rgnoDVD{O0NU_WQ3_G1G3O3T3_A1AH3S_2951c89f}

We then decrypt only the alphabetic characters using the Vigenère decryption formula, leaving all non-letter characters as they are:

plaintext_letter = (ciphertext_index - key_index) mod 26

Steps to Solve#

  1. Align ciphertext and key.
  2. Convert each letter to its alphabet index (A=0 to Z=25).
  3. Subtract the key index from the ciphertext index (mod 26).
  4. Convert the result back to letters.
  5. Combine all results to get the plaintext message.

Alternatively, we can simplify the process by using an online Vigenère Cipher Decoder, which follows the same tabula recta decryption method.

The decrypted flag is picoCTF{D0NT_US3_V1G3N3R3_C1PH3R_2951a89h}.

⚡ Raikiri

🎉 Flag pwned!

alt text

💡 TL;DR / Lesson Learned

The Vigenère cipher encrypts letters by shifting them according to a repeating keyword.

Non-alphabetic characters (like {}, _, and digits) remain untouched.