Rating:
tldr;
- the three ciphers are AES-ECB, AES-CBC, AES-CFB
- security of the keys are 24 bits each
- AES-CFB is a stream cipher that encrypts/decrypts data by by encrypting an IV with AES, then XORing the result with the plaintext/ciphertext
- we have access to a encryption and decryption oracle
- firstly, obtain a plaintext/ciphertext pair $(p, c, IV_1, IV_2)$
- next, guess the 2^24 possible keys and ask the oracle to decrypt $(c \oplus E_{k_3}(IV_2) \oplus E_{k_3}(r), IV_1, r)$ for some arbitrary $r$
- if the key guess is correct, the result will be the same as our original plaintext $p$
- a problem is that 2^24 takes way too long (and there's a timeout), so instead just guess up to 2^16 and run the script many many times. it works with ~1/256 probability
- this takes ages on the remote, so set up a few droplets in the same region as the server and wait a while...
- perform a meet-in-the-middle attack to recover the other two keys (complexity is 2^25)
there are much better solutions (see hellman's writeup or #ctf-challenges in the cryptohack discord server) that don't involve an excessive number of oracle requests
[writeup](https://jsur.in/posts/2021-03-07-zer0pts-ctf-2021-crypto-writeups#three-aes)
