Uncovering Cicada Wiki
Advertisement

I think i know what "triangle puzzle" is.

It appeared once on 4chan and i think i have a copy of it on my hdd:

http://imgur.com/d9Ag2cx

I don't have original name of the file that would help us to look for 4chan archives, but i think file was downloaded on my hdd on 28 Feb 2012.





Image contains some outguesed stego:

-----BEGIN COMPRESSED RSA ENCRYPTED MESSAGE-----
Version: 1.99
Scheme: Crypt::RSA::ES::OAEP
 
eJwBRgC5/zEwADU0AEN5cGhlcnRleHTCFSi7dhQG4Pgmh50LyX1mGRFKbuZmdMkJW/iL5YJZHnww
ECaj7l2udOqtc9L8qlsvZh24DSzKYh3A
=+3dVm5h8VAg/3eTrYvDjNw==
-----END COMPRESSED RSA ENCRYPTED MESSAGE-----



We were trying to prove that this image is not connected to Cicada but no real proof was found. But We didn't try all posibilities.

There are few things strange:

  • font: We actually dont know what exact font 3301 is using is, but it looks like FUTURA II NORMA THIN but letterspacing is slightly off
  • Exiff, some say that some 3301 images show that they have been edited on MAC using Photoshop (still needs to be analyzed)
  • triangle puzzle picture has one pixel wide gray border on top right and bottom edge
  • {| class="msg-table" role="log"
  • "'complete the test' is simply copypasted from the final msg http://prntscr.com/1ud05w
  • RSA mesage in outguessed text might be decodable with primes from "Final puzzle" from 2012 (but there are two different  factorizations of it... not sure which is right)
    • that was solved using script below, result was quite intriguing and defiifnately proves that triangle puzzle was not done by 3301 but somebody who used long semiprime 3301 posted in final.jpg and made little sidepuzzle, question where number from final.jpg should be used remains unsolved


P0sj
NmERvAC
0bwc

one pixel wide gray border, zoomed in bottom right edge of triangle puzzle







Triangle












Correct factorization of 130 digit (431 436 bit long) number from Final.jpg is:

10412790658919985359827898739594318956404425106955675643739226952372682423852959081739834390370374475764863415203423499357108713631
=
99554414790940424414351515490472769096534141749790794321708050837
*
104593961812606247801193807142122161186583731774511103180935025763


To solve triangle RSA using semiprimes from final.jpg as p and q components of RSA key run this perl script:

    #!/usr/bin/perl
     
    use Crypt::RSA;
     
    use Crypt::RSA::ES::OAEP;
     
    use Crypt::RSA::Key::Private;
     
    use Crypt::RSA::Key;
     
    use Math::Pari ':int';
     
    use Crypt::RSA;
     
    my $rsa = new Crypt::RSA;
     
    my $keychain = new Crypt::RSA::Key;
    my ($public, $private) = $keychain->generate (
                                    'p' => '99554414790940424414351515490472769096534141749790794321708050837',
                                    'q' => '104593961812606247801193807142122161186583731774511103180935025763',
                                    'e' => '65537',
                                 ) or die $keychain->errstr();
     
    my $plaintext = $rsa->decrypt (
             Cyphertext => 
"-----BEGIN COMPRESSED RSA ENCRYPTED MESSAGE-----
Version: 1.99
Scheme: Crypt::RSA::ES::OAEP

eJwBRgC5/zEwADU0AEN5cGhlcnRleHTCFSi7dhQG4Pgmh50LyX1mGRFKbuZmdMkJW/iL5YJZHnww
ECaj7l2udOqtc9L8qlsvZh24DSzKYh3A
=+3dVm5h8VAg/3eTrYvDjNw==
-----END COMPRESSED RSA ENCRYPTED MESSAGE-----",
             Key => $private,
             Armour => 1,
                    ) or die $rsa->errstr();
     
    print $plaintext;


If you don't want to bother with perl, here is the spoiler: http://prntscr.com/1ud1kf  Test.pl was test to check if script works correctly, triangle.pl is the result of the script posted above.

Advertisement