Garbage In, Flag Out — broncoctf2026

Description

"I've finally fixed the entropy issue with the OTPs! The secret: use them twice, but only slightly. It'll make more sense once you look at the code. Anyways, I'm so confident in my new algorithm that I can send the flag (which I assure you is valid English leetspeak) with it and you will know NOTHING!"

Two files are given: challenge.py (redacted FLAG) and output.txt with two hex ciphertexts labelled "Random garbage" and "The flag". Goal: recover the flag.

Semantic clues

• "use them twice, but only slightly" — the one-time pad is reused across two messages, with a slight (reversible) transform between uses. This is textbook two-time-pad reuse.
• "valid English leetspeak" — the plaintext follows human-language / leetspeak structure, a language crib once the candidate set is narrow.
• Title "Garbage In, Flag Out" — the random garbage message is not noise; its known character set is the exact leverage needed to pull the flag out.

Analysis

challenge.py generates one random key and emits two ciphertexts:

key = random.randbytes(N)               # N = len(FLAG) = 25
real_garb = "".join(random.choices(string.ascii_lowercase, k=2*N))  # guaranteed a..z
garb = block_encrypt(key, real_garb)    # ciphertext #1

key = scramble(key)                     # per-byte bit reversal
flag = block_encrypt(key, FLAG)         # ciphertext #2

Two crucial facts:

1. Same underlying key. The flag is encrypted with scramble(key), and scramble merely reverses the bit order of every key byte:

   for i in range(8):
       num |= ((k & (1 << i)) >> i) << (7 - i)

   This is fully reversible: flag_key[i] = reverse_bits(garb_key[i]). So both messages share the same pad, just bit-reversed per byte — the "use them twice, but only slightly."

...