Vigenere then Base64: Reversing a Classical Cipher Wrapped in Base64
Le défi
Un vieil outil interne « protège » les chaînes en les passant dans un chiffre de Vigenère puis en encodant le résultat en base64. Vous avez trouvé un tel blob dans une sauvegarde de config. Décodez le base64, inversez le Vigenère avec la clé « acme », et soumettez le flag récupéré (HDNA{...}).
Ce que tu vas apprendre
- Recognise base64 as the outer transport layer by its character set and padding
- Identify a classical letter cipher by which characters it leaves untouched
- Decode a Vigenere cipher with a known key
- Peel two stacked transforms in the correct inverse order
- Explain why classical ciphers are puzzles, not real protection
Compétences testées
Prérequis
- Comfort with base64
- Knowing what a substitution or shift cipher is
Comment ça marche
The Vigenere cipher shifts each letter by a different amount, driven by a repeating keyword. It looks more sophisticated than a single Caesar shift, and for centuries it was called unbreakable - but it is a classical cipher with a fixed key alphabet, and it falls to a known key instantly or to frequency analysis without one. Wrapping its output in base64 only changes how the bytes are stored; it adds no security.
The tell that this is a letter cipher and not a byte-level one is what it leaves alone. Vigenere only touches a-z and A-Z; digits, braces and underscores pass straight through. So in the decoded ciphertext you can already see the flag's {, } and _ in place, with only the letters scrambled. That is your cue to add a Vigenere step rather than an XOR or hex step.
Peel in reverse order. Decode the base64 first to get the ciphertext, then add Vigenere and type the key acme. The recipe runs base64-decode then Vigenere, and the plaintext flag resolves in the output. The other operations (ROT, XOR, hex, atbash, reverse, URL-decode) are decoys - ROT is the closest trap, but it uses a single fixed shift, not a repeating keyword, so it cannot undo Vigenere.
Erreurs fréquentes
- Reaching for ROT instead of Vigenere. ROT is a single fixed shift; Vigenere uses a repeating keyword, so ROT alone will not recover the flag.
- Trying XOR. The non-letter characters are untouched, which rules out a byte-level XOR - this is a letter cipher.
- Skipping the base64 decode. Vigenere has to run on the decoded ciphertext, not the base64 wrapper.
- Guessing the key. The key 'acme' is in the brief; do not brute-force it.
Comment s'en protéger
For defenders and builders, the takeaway is that classical ciphers like Vigenere are recreational, not protective. If an internal tool 'encrypts' secrets this way, treat those secrets as plaintext. Recognising a classical cipher quickly saves time in CTFs and in real triage of legacy systems.
- Never protect real secrets with classical ciphers - use vetted authenticated encryption with a managed key.
- When auditing legacy tools, flag any custom or classical 'encryption' as effectively no protection.
- During triage, note which characters a transform leaves untouched to tell letter ciphers from byte-level ones.
- Remember that base64 is encoding, not encryption - it never adds confidentiality.