How I cracked the NSA Crypto Challenge in Record Time

The NSA recently released an Android App called the "NSA Crypto Challenge".

Being in the security field, I was very interested in this app.  So of course I decided to give it a try, and see how quickly I could break the codes.  Being ambitious, I decided to jump straight into Advanced mode.  My score? 2 minutes, 43 seconds.

Now for those of you who have played this game on advanced mode, you're probably amazed by the speed which I was able to decode this.  For those who haven't played it yet, let me show you an example puzzle on "Advanced" mode.

I would have decoded this puzzle a lot quicker, but unfortunately I'm not a very fast typist with an on-screen keyboard.

Now you're probably wondering how I can decrypt this text so fast?  The secret is to attack the puzzle with "known plaintext", something the NSA probably wasn't expecting you to do.

It's a little known fact that Android .apk installers are actually compressed archive "zip" files.  To peek under the hood, all you need to do is download the .apk, and rename it to .zip.

Inside, you'll see a folder structure similar to this:

Once you've entered the archive, it's just a matter of traversing folders until you find something interesting...like this:

There are all sorts of interesting files underneath the Resources folder.  The first that stands out is "Cipher.txt".  I wonder what that is...

It just happens to be the encryption and decryption algorithms!

Unfortunately, the algorithms use a completely random key.  So this won't help us solve the puzzle.  But wait, remember that folder "PuzzlePacks"?  I wonder what's in there?

These files look promising.  Could it be that these files contain the original plaintext puzzles?

In fact yes they do, in XML format.

Now that we have the original plaintext, we can perform a "known plaintext" attack against the puzzle.

Count the number of characters in each word for the example puzzle. You don't have to do every word, just the first two or three should do.

Now we know we're looking for plaintext with "1 letter" followed by "8 letters" followed by "4 letters".

A quick scan of the plaintext files finds the following:

A wireless room set up in the Bletchley Park mansion’s water tower was codenamed Station X.

So, we simply start substituting letters, and we've solved our puzzle!

Is this cheating? Well, not really. Known plaintext attacks are very commonly used, and in fact helped the Allies crack German "Enigma Machine" codes in World War II.  No doubt this is not an attack method that the developers of this software intended...but when you're cracking encryption codes, sometimes you need to think outside the box.