Rating:
# Bomb
>Keith found a weird message on his desk along with a drawing:
```
JGYJZ NOXZX QZRUQ KNTDN UJWIA ISVIN PFKIR VWKWC UXEBH RFHDI NMOGQ BPRHW CXGAC ARBUN IHOWH QDDGL BBZYH HEJMV RBLJH CLHYP FSAAA KNRPX IKSNX QASGI XBMNP FLAFA KFEGV YWYUN JGBHH QDLZP UJWMO CCEUL YFIHR GTCOZ GEQML VFUAV URXUU BBGCI YZJQQ ROQFU SJDVR JILAJ XYCBC IGATK LQMAP UDPCG ONWFV MHBEC CLBLP JHZJN HMDNY YATIL FQSND AOCAM MGVRZ FEVKL CEDMG AIWXG QPCBI VTVZU HQGFD ZJICI EIWLP IFKAB LNVZI XRZTR SLGCA SZPFF HGBUK JAXNN JHUSV UFPIM ZZLAW SYOHB TOLRF KWANX FNEFD XXLNR LLGYS VTGXP NJQMC WAKRP JKWDP WVTNP WRYEJ RSODI QDYOQ DJDBI SLAVB UPDDR ATHYG ANJQR XPGFM FAMJR ZSJHC SYWQQ VBIHX XCQFW XZBUH ZRXWV TPESM EGVVY PBJSS
```
```
Reflector: B
Rotors: 3,2,4
Crib: the secret to life is
```
## Problem
This is a straightforward Enigma problem. Enigma was the machine used by the Germans in WWII to communicated using encrypted messages. It is essentially a fancy polyalphabetic cipher with some extra twists but unfortunately susceptible to known plaintext attacks. The title of the challenge ```Bomb``` refers to one of the first decryption computers. Legend has it that the name either comes from a Polish ice cream dish or from the fact that everyone would get ice creeam once a message was successfully decrypted.
## Solving
The basic idea is that one of the weakness of the machine is that it won't encrypt any letter to itself. GCHQ has a great step-by-step guide [here](https://github.com/gchq/CyberChef/wiki/Enigma,-the-Bombe,-and-Typex). My suggestion is to use this to understand the process and get familiar with the process. But I'll describe it high level here.
### Step 1: Using our crib
We know the first letters of the plaintext. We can use the GCHQ bombe emulator to find an approximate initial state and switchboard config. See [here](https://gchq.github.io/CyberChef/#recipe=Bombe('3-rotor','LEYJVCNIXWPBQMDRTAKZGFUHOS','BDFHJLCPRTXVZNYEIWGAKMUSQO%3CW','AJDKSIRUXBLHWTMCQGZNPYFVOE%3CF','ESOVPZJAYQUIRHXLNFTGKDCMWB%3CK','AY%20BR%20CU%20DH%20EQ%20FS%20GL%20IP%20JX%20KN%20MO%20TZ%20VW','the%20secret%20to%20life%20is',0,true)&input=SkdZSlogTk9YWlggUVpSVVEgS05URE4gVUpXSUEgSVNWSU4gUEZLSVIgVldLV0MgVVhFQkggUkZIREkgTk1PR1EgQlBSSFcgQ1hHQUMgQVJCVU4gSUhPV0ggUURER0wgQkJaWUggSEVKTVYgUkJMSkggQ0xIWVAgRlNBQUEgS05SUFggSUtTTlggUUFTR0kgWEJNTlAgRkxBRkEgS0ZFR1YgWVdZVU4gSkdCSEggUURMWlAgVUpXTU8gQ0NFVUwgWUZJSFIgR1RDT1ogR0VRTUwgVkZVQVYgVVJYVVUgQkJHQ0kgWVpKUVEgUk9RRlUgU0pEVlIgSklMQUogWFlDQkMgSUdBVEsgTFFNQVAgVURQQ0cgT05XRlYgTUhCRUMgQ0xCTFAgSkhaSk4gSE1ETlkgWUFUSUwgRlFTTkQgQU9DQU0gTUdWUlogRkVWS0wgQ0VETUcgQUlXWEcgUVBDQkkgVlRWWlUgSFFHRkQgWkpJQ0kgRUlXTFAgSUZLQUIgTE5WWkkgWFJaVFIgU0xHQ0EgU1pQRkYgSEdCVUsgSkFYTk4gSkhVU1YgVUZQSU0gWlpMQVcgU1lPSEIgVE9MUkYgS1dBTlggRk5FRkQgWFhMTlIgTExHWVMgVlRHWFAgTkpRTUMgV0FLUlAgSktXRFAgV1ZUTlAgV1JZRUogUlNPREkgUURZT1EgREpEQkkgU0xBVkIgVVBERFIgQVRIWUcgQU5KUVIgWFBHRk0gRkFNSlIgWlNKSEMgU1lXUVEgVkJJSFggWENRRlcgWFpCVUggWlJYV1YgVFBFU00gRUdWVlkgUEJKU1M). This yields:
Rotor stops : ```ECG```
Partial switchboard: ```EK BC DQ II JJ LP MN OO RT SU XZ YY```
Decrypted text(trunc): ```TSESECRETTOLIVEISPTOMERSIL```
Ok so we're not quite there yet but this looks promising. Especially since Ptomerty was one of the organisers and this looks too similar to be a coincidence. This is enough to start out.
### Step 2: Finding the correct right-hand rotor setting
Because the emulator doesn't simulate the middle rotor stepping, when we try to decrypt using the enigma machine we get a different plaintext. See [here](https://gchq.github.io/CyberChef/#recipe=Enigma('3-rotor','LEYJVCNIXWPBQMDRTAKZGFUHOS','A','A','BDFHJLCPRTXVZNYEIWGAKMUSQO%3CW','A','E','AJDKSIRUXBLHWTMCQGZNPYFVOE%3CF','A','C','ESOVPZJAYQUIRHXLNFTGKDCMWB%3CK','A','G','AY%20BR%20CU%20DH%20EQ%20FS%20GL%20IP%20JX%20KN%20MO%20TZ%20VW','EK%20BC%20DQ%20II%20JJ%20LP%20MN%20OO%20RT%20SU%20XZ%20YY',true)&input=SkdZSlogTk9YWlggUVpSVVEgS05URE4gVUpXSUEgSVNWSU4gUEZLSVIgVldLV0MgVVhFQkggUkZIREkgTk1PR1EgQlBSSFcgQ1hHQUMgQVJCVU4gSUhPV0ggUURER0wgQkJaWUggSEVKTVYgUkJMSkggQ0xIWVAgRlNBQUEgS05SUFggSUtTTlggUUFTR0kgWEJNTlAgRkxBRkEgS0ZFR1YgWVdZVU4gSkdCSEggUURMWlAgVUpXTU8gQ0NFVUwgWUZJSFIgR1RDT1ogR0VRTUwgVkZVQVYgVVJYVVUgQkJHQ0kgWVpKUVEgUk9RRlUgU0pEVlIgSklMQUogWFlDQkMgSUdBVEsgTFFNQVAgVURQQ0cgT05XRlYgTUhCRUMgQ0xCTFAgSkhaSk4gSE1ETlkgWUFUSUwgRlFTTkQgQU9DQU0gTUdWUlogRkVWS0wgQ0VETUcgQUlXWEcgUVBDQkkgVlRWWlUgSFFHRkQgWkpJQ0kgRUlXTFAgSUZLQUIgTE5WWkkgWFJaVFIgU0xHQ0EgU1pQRkYgSEdCVUsgSkFYTk4gSkhVU1YgVUZQSU0gWlpMQVcgU1lPSEIgVE9MUkYgS1dBTlggRk5FRkQgWFhMTlIgTExHWVMgVlRHWFAgTkpRTUMgV0FLUlAgSktXRFAgV1ZUTlAgV1JZRUogUlNPREkgUURZT1EgREpEQkkgU0xBVkIgVVBERFIgQVRIWUcgQU5KUVIgWFBHRk0gRkFNSlIgWlNKSEMgU1lXUVEgVkJJSFggWENRRlcgWFpCVUggWlJYV1YgVFBFU00gRUdWVlkgUEJKU1M). As in the guide, we need to step through the right-hand rotor (keeping the offset) until we find the Decrypted text in step 1. I automated the task using a script and we find that setting the third rotor to ```('G','M')``` gets us [there](https://gchq.github.io/CyberChef/#recipe=Enigma('3-rotor','LEYJVCNIXWPBQMDRTAKZGFUHOS','A','A','BDFHJLCPRTXVZNYEIWGAKMUSQO%3CW','A','E','AJDKSIRUXBLHWTMCQGZNPYFVOE%3CF','A','C','ESOVPZJAYQUIRHXLNFTGKDCMWB%3CK','G','M','AY%20BR%20CU%20DH%20EQ%20FS%20GL%20IP%20JX%20KN%20MO%20TZ%20VW','EK%20BC%20DQ%20II%20JJ%20LP%20MN%20OO%20RT%20SU%20XZ%20YY',true)&input=SkdZSlogTk9YWlggUVpSVVEgS05URE4gVUpXSUEgSVNWSU4gUEZLSVIgVldLV0MgVVhFQkggUkZIREkgTk1PR1EgQlBSSFcgQ1hHQUMgQVJCVU4gSUhPV0ggUURER0wgQkJaWUggSEVKTVYgUkJMSkggQ0xIWVAgRlNBQUEgS05SUFggSUtTTlggUUFTR0kgWEJNTlAgRkxBRkEgS0ZFR1YgWVdZVU4gSkdCSEggUURMWlAgVUpXTU8gQ0NFVUwgWUZJSFIgR1RDT1ogR0VRTUwgVkZVQVYgVVJYVVUgQkJHQ0kgWVpKUVEgUk9RRlUgU0pEVlIgSklMQUogWFlDQkMgSUdBVEsgTFFNQVAgVURQQ0cgT05XRlYgTUhCRUMgQ0xCTFAgSkhaSk4gSE1ETlkgWUFUSUwgRlFTTkQgQU9DQU0gTUdWUlogRkVWS0wgQ0VETUcgQUlXWEcgUVBDQkkgVlRWWlUgSFFHRkQgWkpJQ0kgRUlXTFAgSUZLQUIgTE5WWkkgWFJaVFIgU0xHQ0EgU1pQRkYgSEdCVUsgSkFYTk4gSkhVU1YgVUZQSU0gWlpMQVcgU1lPSEIgVE9MUkYgS1dBTlggRk5FRkQgWFhMTlIgTExHWVMgVlRHWFAgTkpRTUMgV0FLUlAgSktXRFAgV1ZUTlAgV1JZRUogUlNPREkgUURZT1EgREpEQkkgU0xBVkIgVVBERFIgQVRIWUcgQU5KUVIgWFBHRk0gRkFNSlIgWlNKSEMgU1lXUVEgVkJJSFggWENRRlcgWFpCVUggWlJYV1YgVFBFU00gRUdWVlkgUEJKU1M).
### Step 3: Finding the missing connections
As stated in the guide, this is a mix between art and skill. Basically we have our switchboard (partial) ```EK BC DQ II JJ LP MN OO RT SU XZ YY```. Take note that only dissimilar pairs are valid, the others are ignored. So basically we have the following pairs left: ```['F', 'H', 'I', 'J', 'O', 'V', 'W', 'Y']```. Now let's look at our plaintext. ```OLIVE``` should be ```OLIFE```. So let's add ```VF``` as a pair. Looking [better](https://gchq.github.io/CyberChef/#recipe=Enigma('3-rotor','LEYJVCNIXWPBQMDRTAKZGFUHOS','A','A','BDFHJLCPRTXVZNYEIWGAKMUSQO%3CW','A','E','AJDKSIRUXBLHWTMCQGZNPYFVOE%3CF','A','C','ESOVPZJAYQUIRHXLNFTGKDCMWB%3CK','G','M','AY%20BR%20CU%20DH%20EQ%20FS%20GL%20IP%20JX%20KN%20MO%20TZ%20VW','EK%20BC%20DQ%20II%20JJ%20LP%20MN%20OO%20RT%20SU%20XZ%20YY%20VF',true)&input=SkdZSlogTk9YWlggUVpSVVEgS05URE4gVUpXSUEgSVNWSU4gUEZLSVIgVldLV0MgVVhFQkggUkZIREkgTk1PR1EgQlBSSFcgQ1hHQUMgQVJCVU4gSUhPV0ggUURER0wgQkJaWUggSEVKTVYgUkJMSkggQ0xIWVAgRlNBQUEgS05SUFggSUtTTlggUUFTR0kgWEJNTlAgRkxBRkEgS0ZFR1YgWVdZVU4gSkdCSEggUURMWlAgVUpXTU8gQ0NFVUwgWUZJSFIgR1RDT1ogR0VRTUwgVkZVQVYgVVJYVVUgQkJHQ0kgWVpKUVEgUk9RRlUgU0pEVlIgSklMQUogWFlDQkMgSUdBVEsgTFFNQVAgVURQQ0cgT05XRlYgTUhCRUMgQ0xCTFAgSkhaSk4gSE1ETlkgWUFUSUwgRlFTTkQgQU9DQU0gTUdWUlogRkVWS0wgQ0VETUcgQUlXWEcgUVBDQkkgVlRWWlUgSFFHRkQgWkpJQ0kgRUlXTFAgSUZLQUIgTE5WWkkgWFJaVFIgU0xHQ0EgU1pQRkYgSEdCVUsgSkFYTk4gSkhVU1YgVUZQSU0gWlpMQVcgU1lPSEIgVE9MUkYgS1dBTlggRk5FRkQgWFhMTlIgTExHWVMgVlRHWFAgTkpRTUMgV0FLUlAgSktXRFAgV1ZUTlAgV1JZRUogUlNPREkgUURZT1EgREpEQkkgU0xBVkIgVVBERFIgQVRIWUcgQU5KUVIgWFBHRk0gRkFNSlIgWlNKSEMgU1lXUVEgVkJJSFggWENRRlcgWFpCVUggWlJYV1YgVFBFU00gRUdWVlkgUEJKU1M). But we can do better. Let's bruteforce each remaining pair one at the time and check our decrypted text. There aren't that many and we see that ```AG``` actually decrypts the end! Which is all we need! [Here](https://gchq.github.io/CyberChef/#recipe=Enigma('3-rotor','LEYJVCNIXWPBQMDRTAKZGFUHOS','A','A','BDFHJLCPRTXVZNYEIWGAKMUSQO%3CW','Z','D','AJDKSIRUXBLHWTMCQGZNPYFVOE%3CF','A','C','ESOVPZJAYQUIRHXLNFTGKDCMWB%3CK','G','M','AY%20BR%20CU%20DH%20EQ%20FS%20GL%20IP%20JX%20KN%20MO%20TZ%20VW','EK%20BC%20DQ%20II%20JJ%20LP%20MN%20OO%20RT%20SU%20XZ%20YY%20VF%20AG',true)&input=SkdZSlogTk9YWlggUVpSVVEgS05URE4gVUpXSUEgSVNWSU4gUEZLSVIgVldLV0MgVVhFQkggUkZIREkgTk1PR1EgQlBSSFcgQ1hHQUMgQVJCVU4gSUhPV0ggUURER0wgQkJaWUggSEVKTVYgUkJMSkggQ0xIWVAgRlNBQUEgS05SUFggSUtTTlggUUFTR0kgWEJNTlAgRkxBRkEgS0ZFR1YgWVdZVU4gSkdCSEggUURMWlAgVUpXTU8gQ0NFVUwgWUZJSFIgR1RDT1ogR0VRTUwgVkZVQVYgVVJYVVUgQkJHQ0kgWVpKUVEgUk9RRlUgU0pEVlIgSklMQUogWFlDQkMgSUdBVEsgTFFNQVAgVURQQ0cgT05XRlYgTUhCRUMgQ0xCTFAgSkhaSk4gSE1ETlkgWUFUSUwgRlFTTkQgQU9DQU0gTUdWUlogRkVWS0wgQ0VETUcgQUlXWEcgUVBDQkkgVlRWWlUgSFFHRkQgWkpJQ0kgRUlXTFAgSUZLQUIgTE5WWkkgWFJaVFIgU0xHQ0EgU1pQRkYgSEdCVUsgSkFYTk4gSkhVU1YgVUZQSU0gWlpMQVcgU1lPSEIgVE9MUkYgS1dBTlggRk5FRkQgWFhMTlIgTExHWVMgVlRHWFAgTkpRTUMgV0FLUlAgSktXRFAgV1ZUTlAgV1JZRUogUlNPREkgUURZT1EgREpEQkkgU0xBVkIgVVBERFIgQVRIWUcgQU5KUVIgWFBHRk0gRkFNSlIgWlNKSEMgU1lXUVEgVkJJSFggWENRRlcgWFpCVUggWlJYV1YgVFBFU00gRUdWVlkgUEJKU1M) the final state. Not everyhting is decrypted but it's good enough to read:
```
THESECRETTOLIFEISPTOMERTYCTFSTANDSFORCAPTURETHEFLASDAZTYOWPYZUTKMOZVQEJYDPLNUYQZXCLEYBUATWOGXUIHSRNWACSCJVCDWUDLIPRVMLSPQEPKVGNJVMRIPTCNINLHHNALCESWVSCYBWNXRUKQUUERCZCPELDKIZNJYBNGODEMVVIZDGWIWISGTPKEIDUYPGCQURRWDUHBEHZNUEYDAZKNRAEDHNXGQSFETKVIYQXDAZAJYXWFCCRCBYJJXTSZBVVJKPYXNQMIUUFIUOSOIQITHIDWYMOANIFGPQUXVZADQJSTWWTUTCTUJJHALIFMMYJRGFJGIMRIDYPMXOLSLWMXACQWFMTWKGBFMYZUVXAEQLANDMJGXJNDDDOWHATEVERITTAKESTOCAPTURETHATFLAGWHENATEAMSUBMITSTHISFLAGTOASCORINGPAGETHEYWILLGETPOINTSTHEPASSWORDISINSECUREKEITHWASANENIGMA
```
The script contains a few helper functions that make it easier to bruteforce.
