1. Recover server keys (k3, k4)

• Relation: quad = E_{k4}(E_{k3}(enc_user)).
• MITM:
  • Precompute for all 2^16 keys x: mid = E_x(enc_user); store in a map.
  • For all 2^16 keys y: compute left = D_y(quad) and look up in the map.
• Collision yields (k3, k4).

1. Recover client keys (k1, k2)

• From dec_client = D_{k1}(D_{k2}(quad)) ⇒ E_{k1}(dec_client) = D_{k2}(quad).
• MITM:
  • Precompute for all y: right = D_y(quad).
  • For all x: left = E_x(dec_client) and match to right.
• Collision yields (k1, k2).

1. Decrypt and build flag

• Recover message = D_{k1}(D_{k2}(enc_user)).
• Per server.py, flag is message + k1 + k2 + k3 + k4 (keys as 2 bytes each).

1. Result

• k1 = b'e4', k2 = b'b3', k3 = b'f8', k4 = b'd}'

🏴 Flag

scriptCTF{s3cr37_m3ss4g3_1337!_7e4b3f8d}