BTW - 6 confirmations now (first clue coming soon)...

Okay - the "riddle" part is to work out what I might have changed to the script that "lightly salts" the password and the "guess" is a four character password that was used before it was "lightly salted" and then hashed.

There is a point to all this (very much along the lines of a similar thread that Mike Caldwell did recently) about achieving security, although I think that my point is a little different.

Does that help at all?

What exactly is the problem (I will help out and will give hints to make it easier in time - understand that this 10 BTC is intended to be given away)?

BTW - if anyone has managed to work out the IP address I am using here it won't help you as the only information on this computer related to this challenge is what I put in the OP.

Well - in the festive spirit - who cares if I made a stupid mistake - have at it anyway (10 BTC charged up)!!!

Am waiting for at least a comment from someone with some crypto skills before I load up the address - but the only likely change might be to increase the password length from 4 to 5 (in which case the Bitcoin address and GPG message holding the private key will need to be changed).

If no-one has claimed the reward within an hour of me charging up the address I will give a hint (and more will follow until it is claimed).

No worries - that just lets the end-user type in a password (but so it can't be seen from the console) - this is where the 4 char password was typed.


If the password was "test" (and it isn't) then you would get:
test+test=testtest@L3AsT


Yup - just strips out trailing crap after the actual hash.


Indeed - the password is not being heavily salted - just lightly salted according to a little creative string manipulation.

The one comment is the only part that was changed - but what exactly else can I help explain about it?

(it just adds some salt to a password then SHA256 hashes it and puts that hash onto the X clipboard - if you're wondering about the AWK bit that is just to get rid of the trailing " -" from sha256sum)

Solution Results

December 28, 2012, 08:44:16 UTC

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

the privkey got cracked

K1773R
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBAgAGBQJQ3VurAAoJEG9KjkBCBMba/uUH/28vQfVQV/Y+3Cb5q0Bfd1Od
FIUpVbGebxq2OH+lrNI1QJitKRWxCe7iUrk4ORJybqb7XDkclDYBrDyvZ3n+A74p
m2v2ExsupVNFnIsv3HPvHezab4cXhmYDV2PTyM0/yUiGsliqqFAqDqi7tdVA3eDB
dmjpsGOe8GAOH2Eoh4p2cwu7geXmgOs3gRgCN9MOp2S+waZfeghX7Y3+pN2JRcPX
/nIO3gZuLC/oeIiahmxW9Efq8La8Ffw19m5I9zDdRf7vQ8TgMgjZ6jIFJ0GLuewR
eGmZ/M5UOfrphkS67uljBAHI9bGMCfucxeeLH8ovYTF8YYeKhRzUTNgCgQ3hezg=
=qkYa
-----END PGP SIGNATURE-----

GPG Password: 41087438dbac5b77c3922cbe1f4d2f529ae3a4eb96a7534e4803361f1437f7e7

Private Key: 5Hq96RktdCU3BL1U4b7Wxse2wWCiSRXierJdS68RE1Mf8BXphjg

Stretched Hashed Password: "3a5Y+3a5Y=2x3a5Y(at least)\n"

Starting Four Character Password: 3a5Y

Modifications and Hints

Relevant code changed in the script used to generate the password

Hints given (and when)

December 26, 2012, 04:28:24 UTC (10 Confirmations)

December 26, 2012, 05:58:56 UTC (51 confirmations)

December 27, 2012, 03:52:09 UTC (202 confirmations)

December 28, 2012, 07:21:30 UTC (300 confirmations)

December 28, 2012, 07:57:16 UTC (300+? confirmations - last hint wasn't enough so I finally put out this)

What did we discover?

An unpredictable "salt" is of far more power to preventing "brute forcing" than the password itself (to the point that I think I successfully proved that even a 4 character password was going to be "unbreakable" without my hints - and without the hint released at 300 confirmations I very much doubt this would have ever been cracked).

This is along the same lines as Mike Caldwell's use of scrypt but with a more "creative" twist - amazingly enough even just the use of the letter 'x' to indicate "multiply" was simply not even understood by nearly all that were trying to break this (hint - get someone "older" to help you create the "salt" as most people trying to brute force your password are likely to be young and will quite likely not even be capable of thinking the same way).

For those that have said this is just a "brain wallet" I would like to just say that the "salt" and the "password" are two separate things (and with as little as four characters proven to being effective I think most people can probably remember a reasonably "random" password). If you turn the "salt" into something like an "equation" (or even let's say a "knitting pattern" if we are considering how to help out Gavin's grandma) where the "password" is transformed into each of the "variables" within in it then you can easily create an extremely hard to crack hashed password (my use of p+p=2p "vs" p+p=p.p with the seed password as "3a5Y" I think should be a convincing enough example).

Okay - I have sent 10 BTC to the following Bitcoin address (generated using vanitygen):

1CpueVNsEWgEhGD44ymVNoksyFp9Eekec7

and the next piece of information is the private key for that address that has been GPG encrypted:

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.9 (MingW32)

hQEMA8M4in1e/mjNAQf9HZKDFHUx+bn1/UqxSnEL161h1Yjplp5ijqeW36CrO6HR
PQgxfgT8Jddxkly+7bqZHwOHW68J8X0J/yfuO0mQ4MSVg3+x8Y1Ty/cujVv55bD0
/S3bHmPepKm57dHLsZ1CY3DT3/9mACnhqsQ84pPQKLQl7UNbhXhc9Il8hkcLS/Co
zpXh7GUuAMrA6TZZM+FLcD/oy5RU/50l5HIomG/fmRimtYu/N7i7y4mJYLh506DW
3HEaRUH4uEgPlpUIiSEQPPsiTt/9nRWdZB6t0mRLMivs/uvqmXygEa+BDV9ZWe7W
wB71vA+IHfPWmu5nXnYuqIvVBlGR8aCi6toXgaD5eNLADAG6kctTwLVA3l8dP/BE
bJNdi5HrYiPuz4hiE4xgTcwL8zppWoWfZCvmSpo1UE7Pmvdw2o60jtCOcK/qM/Bo
jpmvGRRvZVUuGV2flbf0DiTHTOGZ03AR81B+zoJKcN+VqeX/aLSG/QgKZAmkonSt
mGynLSYJgXlKttMNy6bzdSH1ImXH4ZYHjK4HLmVdoZ2DX5tEPMwRa7v9EzGmwNxT
Ii+TXhbaSd5PIRHobqticGcMGaLOgaAOloml18Pz65pYvzOMRTUBhyFu07BnOQ==
=nmS0
-----END PGP MESSAGE-----

Now the GPG public key and private key (encrypted of course) are as follows:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.9 (MingW32)

mQENBFDZhQIBCAD7GbsEa7PGP69KBSc/iOiXcqPr1BfYg6jBTZOz1G/qpJcSjG/Y
asGmnTh4zYlNy2qXvmcvoz0HAg3JatMUJKRTLIhs784QrzC3iRsvvf1RkWA2L34d
2B3/N3hI+ws/Q+3Q2lv5KkpcfYCZeVFkzPhGx3kanwZdGycTxmtlSBvLBYXKYpTF
aw/NE93of584/C/zzr0dqGj4T4izGBhW6SioPFgKwCE6meQJhHtstprDM0PYE7Uq
huZ5pgUL270KBctDqau6jXUMXRaRURFElcZmFzHhMagcDovcScmk1LHyQ5IwrAxs
6ZdIOLnZin1GQqwcpt4IPdb+CXLFFDIoFWr1ABEBAAG0H0NoYWxsZW5nZSA8Y2hh
bGxlbmdlQGNpeWFtLm9yZz6JATgEEwECACIFAlDZhQICGwMGCwkIBwMCBhUIAgkK
CwQWAgMBAh4BAheAAAoJEG9KjkBCBMbav1sIAOpol6INIBZ96QX8EGKJ38ptcW+C
7iFfZcCR8ObaTqpwvlgOw+n+H6sbw3i9xbfnplHo59dfhCCSQaObRIIH7Nb7Xxn7
Ep490lBcAXeeWd7jcnEKEFvuOUhSlQVGiunMUroHlZ1j38cNeXwUm9+hyZTZ+oHv
Izs0DeXZZDIvc51aBreTTJd6d9NSk+Zr99xw5oBdWfyPqFv+wnB60w4IEtdS5r6K
26O6JelDCzek0C9umOIRv3S6RlR0s9vkaunviV8zqfYnxZR6cch9utEcc3cdApus
uSjZS4nAQxBdUmyzY3hDKXHkLweS9MWBRAD6y+qJ9xyntac2/+QD3KKYVO65AQ0E
UNmFAgEIAOfP4v8I1Dy86eJUdqvVEAJlPPa0XGrPT2ew1AkNsxvBrEBSV4iQvnQW
x8VbEVxPa9jK/DB08wCNsC2gOhLVOf3GMSEeqhJVr+eZoHAF6f/Ozuw6kL04tb0I
GjHMtRh1MtJJBs3q3rBhGnB67weyY9VZmtcanCHTGygfzmGlfQuHwC1e/exl6AtW
HRZTEhx3FK+f/6kU8Zci6WA1QjDfxoCFXey8Va9XPdr8VPwPzyPDhEtlZD8/cIVZ
l55l77NhubYl1qs2SH6sWCDEYyA23O0pxrN2EGVv4jz6GkH5Ufr8IkfS5oEKEeHb
XLUOIK++ABQPLvvbJ9M1rFdxD11NGfsAEQEAAYkBHwQYAQIACQUCUNmFAgIbDAAK
CRBvSo5AQgTG2j7CB/9yQMbYz3tC8X7uoUrHAWYT/9JajH1Qr/2lzssvBYO8CEZY
6zedXBanMWNsTKHcDQkhZ2GFSsC74nA7Nn8vTv2WkY1Nfp/qZT95cg8B0FNQPLOu
/zHU5lZD/oJkgc28uv0z7C+saMXpNnoddhztEn7IOyXrSIu1+TucWnyDapzeOS4x
sUMk8nYzrdCjg1dbpqm+EEW0iFaZlITRkeUA94F627DWa3Fp7g+u/z3pUtkpFmRB
YYzRUiI7HEoNUmTGN1sSfgUD1bT0kd5Azy2+bE53B0LEUjMsBKcKQ5SHciLnkhU+
ehVrzP1BZQI6RuF14c7Bzkba7wt8OafmEAqoYO8Z
=nIuP
-----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP PRIVATE KEY BLOCK-----
Version: GnuPG v1.4.9 (MingW32)

lQO+BFDZhQIBCAD7GbsEa7PGP69KBSc/iOiXcqPr1BfYg6jBTZOz1G/qpJcSjG/Y
asGmnTh4zYlNy2qXvmcvoz0HAg3JatMUJKRTLIhs784QrzC3iRsvvf1RkWA2L34d
2B3/N3hI+ws/Q+3Q2lv5KkpcfYCZeVFkzPhGx3kanwZdGycTxmtlSBvLBYXKYpTF
aw/NE93of584/C/zzr0dqGj4T4izGBhW6SioPFgKwCE6meQJhHtstprDM0PYE7Uq
huZ5pgUL270KBctDqau6jXUMXRaRURFElcZmFzHhMagcDovcScmk1LHyQ5IwrAxs
6ZdIOLnZin1GQqwcpt4IPdb+CXLFFDIoFWr1ABEBAAH+AwMCFjQ1G6zKAqxgwLG1
VWj/tRSQhSb6e7JvNVLhok7sRtgF4FmcbU3vYRHSLEMfx4jO0BzBPqplYpMtAyUb
d+bwYLx42etKy77Ky8xATUjQ/Wg3rL6q1H3NUCqvFxNVXTgL9auV/5vTgYjCftOZ
fK3f36uRnaDYcxAdL6xU8znALQnG3ytJkNKOkrOIg1N+gfCZIVM1gzLLJYMecjnF
y+CmGFLtyCd65B65YayetNHLqyhHQcWWiqJfEkMt7VqWczOhHVx6NWN868zTImMy
+Xo05/YXxNJ49qZdogSfFqk/mib5/nQD7tvRVuF9cKIBL1eoiQ0FgDYD7BtEnzeV
1qwab9xrQpupv45qqRbnUqhFQp96Xx4LysXAdkjt8TLOeHEt+t4J9yN/fBbgn0qo
W5FNyXhaI4FqgN/mnBw26GWKisdWD3oOptA/n/fA3ATn+QOFBg1++pIjbCuqWsnD
76ZxX2t1e1t7jAOsG964PxM6WfIdsAdYaUyfiNw+P9URky97dphYDGXslpcsgNfq
POTDZPEdOK27Ugyo1NNzgX31l3/Q1XqjjWj+u9/zf/+6illj1xjDA5T6trYVDAPL
49uTs/NKiI5cJsvcYrc9x+RsZaTcz1nOq3rI6mKUhaajOv8VVc55odzDG89fYnQB
pFGBhKZsxSUAmddUjzxNAlxL9/zPC4dLJBetyt+84TvFc88BOnD8aOG08tdsBoiQ
7uja99fHMsEtf9Tjtgta9DMVQT/LljiG28AEvLgrhPdWF6llf3phwDow9LO49GO9
42pKmFa2QL/KfVnb6wYRE3cWv2Rv1vKM3RbD+A/+DMjUSQDM+KuEAHAVhmaHHVO2
n94k0U6kobMAQiprAOQo79wRza7xexWTtmpZgX8JFlSnByhUnDZUQhoFvG2PsXb8
q7QfQ2hhbGxlbmdlIDxjaGFsbGVuZ2VAY2l5YW0ub3JnPokBOAQTAQIAIgUCUNmF
AgIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQb0qOQEIExtq/WwgA6miX
og0gFn3pBfwQYonfym1xb4LuIV9lwJHw5tpOqnC+WA7D6f4fqxvDeL3Ft+emUejn
11+EIJJBo5tEggfs1vtfGfsSnj3SUFwBd55Z3uNycQoQW+45SFKVBUaK6cxSugeV
nWPfxw15fBSb36HJlNn6ge8jOzQN5dlkMi9znVoGt5NMl3p301KT5mv33HDmgF1Z
/I+oW/7CcHrTDggS11Lmvorbo7ol6UMLN6TQL26Y4hG/dLpGVHSz2+Rq6e+JXzOp
9ifFlHpxyH260Rxzdx0Cm6y5KNlLicBDEF1SbLNjeEMpceQvB5L0xYFEAPrL6on3
HKe1pzb/5APcophU7p0DvgRQ2YUCAQgA58/i/wjUPLzp4lR2q9UQAmU89rRcas9P
Z7DUCQ2zG8GsQFJXiJC+dBbHxVsRXE9r2Mr8MHTzAI2wLaA6EtU5/cYxIR6qElWv
55mgcAXp/87O7DqQvTi1vQgaMcy1GHUy0kkGzeresGEacHrvB7Jj1Vma1xqcIdMb
KB/OYaV9C4fALV797GXoC1YdFlMSHHcUr5//qRTxlyLpYDVCMN/GgIVd7LxVr1c9
2vxU/A/PI8OES2VkPz9whVmXnmXvs2G5tiXWqzZIfqxYIMRjIDbc7SnGs3YQZW/i
PPoaQflR+vwiR9LmgQoR4dtctQ4gr74AFA8u+9sn0zWsV3EPXU0Z+wARAQAB/gMD
AhY0NRusygKsYO5Pw1DjgpQRR40Ap2/VtpklqmVVphBk8Vr6SdnULIAU14S+7VS6
8jJInTtntgG/KqXGALCAbHZjehcq1pt5KLaQxjAAgDgo4YOEqqsU2/6vVdOyuLBp
DUG0HbIEKFicUcsw7LUIpHukAk7kajomRIYCKjwsGU5/igVeIu9N3vOT1DOWz5Fd
FvilzXmazIIms1RUZhWdS1kojXK1Rw5osW5TxuLMTmtS6Cw1v5U8PTJoi+/OmxtH
RnCcGS3liZIBTrv6YvgcD+MZ2xgY87LzZKeEGq9eG34cLme64pNgjSoPqRcbgWDU
wgE6x8eTRLqQaZ1bwIBciRE08X+PyiHcxPZAOEopahuNguMpn+5THfOhwOLESxP1
yvXpQtSZdtKoLdMzMRQ3f2JK+IBjuVOCOek1tky2IeScFDyFRRuyAn8PEqMTkzOs
DGP0QgVaVx7BYzfVyYEkVSPmzPIxt+trRiaVaOCOwTY/8zCXIP5JAGTYEBT1S6/b
2OkbuNn5d3QBY+3OD0bSGt6pcQqhPVj8O7YNz+TatQ60oyKdQN7RXfodAT0gcgVn
QGjXCF7eytByIY6TPmE3Ch63vPLYqjmsJk5xbBa9kfVm027C7CMdJYU86BVp9OGm
4nH8LWnnUtlQEzqPSzes0cJiKF7xCQR094xzwvWIuYanQ/qSORovlI3VzcNnmZlf
7DFjk0HVJxzdudhdOYxSMEAs6c8u+yQeyNFdBsFQtO40auvg2La4dPJMRqwQuowa
qS9G3Dy+NqfUp1KW1lwzJopB4dKcRo28MIrteUQjKDCh+WKq6rQsXWz+AZ2b5mmX
wlFEBmxy52s8qSrPIjBUmeSRsPK8WFTJQ8cSZGjlyQ4Zko6BNZB9AbosQk2ujU32
ojz03DmV/Q/LdAMd4nWJAR8EGAECAAkFAlDZhQICGwwACgkQb0qOQEIExto+wgf/
ckDG2M97QvF+7qFKxwFmE//SWox9UK/9pc7LLwWDvAhGWOs3nVwWpzFjbEyh3A0J
IWdhhUrAu+JwOzZ/L079lpGNTX6f6mU/eXIPAdBTUDyzrv8x1OZWQ/6CZIHNvLr9
M+wvrGjF6TZ6HXYc7RJ+yDsl60iLtfk7nFp8g2qc3jkuMbFDJPJ2M63Qo4NXW6ap
vhBFtIhWmZSE0ZHlAPeBetuw1mtxae4Prv896VLZKRZkQWGM0VIiOxxKDVJkxjdb
En4FA9W09JHeQM8tvmxOdwdCxFIzLASnCkOUh3Ii55IVPnoVa8z9QWUCOkbhdeHO
wc5G2u8LfDmn5hAKqGDvGQ==
=llev
-----END PGP PRIVATE KEY BLOCK-----

Now - let me just explain that I created this GPG public/private key pair on an older laptop (that is not able to connect to the internet) running a Live OS in which I used the following script with some not so very creative changes and a 4 character password (a random [EDIT: actually not random at all but was not hinted at as it was going to be a last resort if it wasn't cracked without it], non-dictionary with numbers and letters both upper and lower case) with the final hash of this password being used as the password for GPG...


Santa has loaded up that address with 10 BTC (and the funds won't be being moved by myself until at least until January 3rd 2013).

Happy holidays!

Now that made me laugh - merry xmas Luke and I do hope the OP is able to return the funds to the rightful owner.

Is it that you don't like using Watch or that you wanted us to know that you are?

An important part of the CIYAM Open funding model is that it is 100% open - that is every single tx that takes place in the project will be able to be audited via the blockchain by anybody (this is achieved through the use of raw tx's that move funds from one specific donation address to either another or to the final developer's destination).

Another important part is the safety of the private keys that are generated for use with every Project Area and Project Task - a detailed explanation of how this is achieved (and the source for the tools used) will be coming soon.

Although the core of the CIYAM Open project involves C++ there will be some DHTML tasks appearing at http://ciyam.org/open down the track (writing UI is about my least favourite activity so I will be creating tasks and allocating BTC to help out with that).

Interesting - well the issue has now been duly noted (the problem being in the way that a .gif has been used for the table header as it shouldn't really matter how many lines it needs to flow in to) - also thanks for taking the time to look at the site.

I assume you mean 1280 x 800 but in any case I did have the Tab rotated - is your screen rotated to landscape?

(indeed if not rotated to landscape it won't look so good and UI is one of the main areas I will be allocating BTC tasks towards improving)

Actually even in portrait it looks fine on my Tab - what device are you using?

(reserved)

CIYAM Open is now ready for Contributors and Project Managers to join in creating a new kind of digital workforce.

The first 10 Project Managers to join (6 places are still left) will be able to have one Project in CIYAM Open "fee free for life".

Developers need to make a "dib" for each task that they wish to work on - understand that a dib is not to do with funds but with *time*. By submitting your dib you are committing yourself to providing a git pull request by the date and time you entered in your dib. The funds allotted will be paid out in entirety to the Contributor whose dib was accepted and whose git pull request was merged by (one of) the git repository owner(s).

Note that only the Contributor whose dib is Accepted would ever be expected to work on the task and understand also that each task includes one or more "skills" for which "skill points" will be awarded or deducted from the Contributor (depending upon whether an Accepted dib is finally Completed after a git pull request merged or is instead Rejected). Also understand that the acceptance of any particular dib is entirely up to the Project Manager (guidelines and further software will be developed to help with this down the track).

http://ciyam.org

(includes links to CIYAM Open as well as the CIYAM Safe distro which is used by the CIYAM project for 100% air-gapped offline transaction signing and the CIYAM github repository)

[mods] please delete this topic as I created another one for the project announcement due to a mix up

With the highest respect to the GNU Cash project and other existing accounting projects I really do have a very good understanding of creating this kind of software and with the approach taken in creating CIYAM Open projects the "man hours' gets reduced by a factor of at least a few hundred.

If you are skeptical please take a look at the following: http://ciyam.org/slideshow.html

This shows the creation of a complete app with Blog, PM's, Forum and a Project funding/management system in under 5 minutes with *zero* manual coding (and all done from a Galaxy Tab).