Dancing Queen

cryptohack

Task: a custom ChaCha20 omits the final feed-forward addition (keystream = permute(initial_state) with no add-back), making the 20-round permutation fully invertible; a known plaintext and the flag are encrypted under the same key. Solution: recover keystream block 0 via known-plaintext XOR, invert the ARX quarter-rounds to reconstruct the initial state (which contains the 256-bit key), then decrypt the flag under iv2.