Another riddle - guess script win 10BTC [SOLVED]

[cozz]

Bitcoin Address: 1cozzzrJAsYd7rE7FqvbmhTotBtX7Qhds
Bitcoin Privkey: 5J1...

EDIT: this is for people who at least know the basics of writing code and are capable of writing a simple script.

I have stolen the idea from this thread: https://bitcointalk.org/index.php?topic=133263.0
Bitcoin address 1cozz... is loaded with 10BTC.
I give you the gpg encrypted private key to this bitcoin address.
I also give you the gpg private key.
The gpg password though has been created by a script and is longer than 20 characters.
Your task is to guess that script from the story below. I dont plan on giving any more hints as it really shouldnt be that hard.
(EDIT: I guess I changed my mind, hints will be given throughout the thread)
Just to be sure I have written 2 solution scripts one in php and one in bash. Both spit out the same password. Have fun!

Story
 My name is cozz. Once i made a journey and visited some of my old friends.
 The first one is a doctor and he has 5 children. He lives in very beautiful house.
 The house always impresses me so much that I drive 5 rounds around it before actually ringing the bell.
 The only problem with this friend is that he uses pepper instead of salt to all his meals. So I decided to leave quickly and
 went on to another friend. This friend always says that he even doesnt spice his meals. The funny thing
 is after eating there you feel like your stomach has grown about 137% of the original size.
 The trip went on to Maryland. Sadly the friend I was going to visit there wasnt at home. But accidentally
 I met a friend of this friend, who also wanted to visit him. After all the only thing I can say about
 this friend of the friend is that he literally is a stupid or unpleasant person.
 As the trip was more expensive than I thought, I decided to step by at one of my richer friends and ask for some money.
 I dont even know which country he is really from, but his name sounds like japanese.
 Having filled up my wallet I could now afford a flight to europe. Of course for that I had to make some money exchange.
 I simply exchanged all my numbered coins I had and became one 500euro note, which fit very well at the end of my wallet.
 The friend I visited in europe looks so old I always make fun of him that he must be born before jesus.
 Whenever possible he tells me his war-stories and how some fat guy kicked his ass.
 I even met a woman in europe. Her name was alice. She invited me to her house. It was great she even had a whirlpool there.
 Immediately we both jumped into it. The neighbours already shouting cozz+alice didnt really bother me at this time.
 After jumping in the pool with her I felt like we have become one now. We jumped like another fifty times in that whirlpool.
 When I had to get back to america I was looking for my flight number 888 at the airport, but I couldnt find it anywhere.
 So I called another friend in europe and asked him for advice. He has won his first race championship in 1996 in europe driving with a speed of 160 miles per hour.
 This friend now guided me really really quickly until I found my flight back home. Funny thing was that my flight number was at the very beginning of
 the airport.
 Over all this was a very exciting trip, and the hole trip I never felt like I had to add another entering somewhere.
 The only thing that bothers me is that I have lost alice phone number somewhere. Only thing I can remember it was an eight digit number starting with 78.
 Well at least I know where I can find her:)

gpg encrypted private bitcoin key

Code:

-----BEGIN PGP MESSAGE-----
Version: GnuPG v2.0.19 (GNU/Linux)

hQEMA5eLPH2ixq4fAQf9FSr5DCG9ffYBSx0/8BnK5jlQZa9LPvqSMX9UYl3DlQCp
xPsnjG50BSlqVyVqMHIhLCd33cL+Swu6QO93D4LCdK225R3pOguT6J4KPEt5fE2i
gpZIZToeZSSQuY4gXh/7cr/R9O2yNSmZbWH4xcLbirNzY4Bv4aaUZxXiqbk3r/1B
fXayEtQnulLQMtHqvD5oSLugwh1e0gl8Pml8wgTdqv2Lss7xsY3vEc3JgjJ7Uq7j
Fay4NmKY9Y72641k3BeeTknucsAslbkLb3STggaeQZFzuh84Bi+/R/+upXq98LXR
w/sOeL/YEpVID0iqMt/4WcK14FIQL/DTTUGJu8e0ttJ3AYoLUgmP4uQsgF3yd+vp
CxwQOh8G9+0W4Q5cgNecz8C+Qo8jvjaaZBO+mE5dcYsgrlGSjlU/7URsrqbpybqn
bGBPuQGm0n4+qQd7Ibw+OYYghaLxlm4oq+JPJWop0Zl4+t57tkfeQ7uIgGPXLx4W
zAxks15U+Ck=
=VKBC
-----END PGP MESSAGE-----

gpg private key

Code:

-----BEGIN PGP PRIVATE KEY BLOCK-----
Version: GnuPG v2.0.19 (GNU/Linux)

lQO+BFDekGwBCADNyU2caYXduq0TNo0BZnvtY06g35TdrlUl2X18m0xVX3iE8Un3
9xvyqY6806SmHg1Pa91jGVL9TAFUp0bcMQU2tUzDzd2FzH5v5/zJQD5S9B0kfPFH
qOA/BmIlDyPN/39PCi4csbLfn7cdNf+E8UVC/LkQMiSYByoHHPMX3lFvjmQpWCtK
Cu3gN87VLBieQlT0a3e8et9Ne0mde+Miz8Q91Udjw4tdCaEPJXQfQKxB4vgLLZGD
NGfMazdb29Agowd3WMd4yiJfcyRAeEaEiYyCDhx1FXieBnyS9LxDFz4PAbIhNTXd
L6j6Kbp3ddUjiY4+i7hxYdzU5PQJRyOw/me/ABEBAAH+AwMCa/9W4DyUvSvUFtor
nD/VorjgB2sN7bZncVD6GHR9I0lHZm+k0ZwOg0z2/JQ5q8eULdPj8eLlaF6qy/WO
mUqhvXkH3sXInDTlxKlzcgrhRyr33dMvxOERJWNKTpckizkUHkZy77SPIwugY9ti
x2DqMnl82V1y5a9rduRq28jimNbcMXbybu6CiGR5OmLfB6GyRcfh/jW7FHopj52o
VpkGGwwuqdxKdQmNM/UbCtZTKHmpX7Rpkkcj5E7VJ+Id3FDeY/TSZYs4tnwPlQWH
tNAz1b+em7/03I4eH4RMSvT5cPRtWB6nc+8fppDq1GcJ5tDsZE+D4XCflwkvQXYW
cG2vs0ss2zufV+W9BUfaqTqWydSjKIEyMpec6vc4or3Qqy6Tdrn97DmgzP3hR0JZ
BEQPUeRXQI/N9jLf4xViugaUURQbRjtMPxnKkig2nedpMFoS3vBsTvApufX+V0CS
IAIriRBfz7GQsyOT4ReNRKK1QVroPUsRVhg9eS+K+SJj8MtUwgUlKAiatZmkHL7B
TWGHK8NT0M4aiNUiOhJFQLTvmt/T+q68dr9cf8g/6kd0TcCXodgH0bMoWf7C/bY7
VAjdfOtB50EepT/qnbm3Diya5luH4s55omBn17qWh9im7+//ameruNfb7//uHZuZ
yk5p04p6gQmC2ujwIbYjqNYc21wM1GriTyk8UaEdcEJFmz/fiXUxe4ku/2aROy5y
xR7556vyPUZTsMOx+JVzzDjsX6G3wWXL1IwO0/ZI8nit9/EygEdmCfNJENfkZHzb
5rTwuW8bCxZntYpQfXNHk0yAhJPOx3pyhD+UC3UbScSbkVyTg1C8ZHLywY14rA7F
IWL+sAAVAq+hz0qN+u3NUbFfMFEfulyS2HLmhB2kUuVz3fjgrZ99cJgBlgopNlXo
G7QiQ296eiBMb3ZhbiA8Y296ejAwbG92YW5AeWFob28uY29tPokBOAQTAQIAIgUC
UN6QbAIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQHaHO9hYEg8vjCwgA
jf2hCxDMUKYQ4BMMt27SyLImyT1FXUYF1iuwdZO3TFXdJdVcnbLImkg9Bm3c+onj
W6eMUscitO5GuswdUn9uZucp+fc8WXJhQNPOr+qSQtGhD7PaSIkw5hY0LeBEhzwW
qsnEuqW3Voq6yunKVxUW4gqMzNlfcD9GhuXRe/E8NWnJWZG9p98ShmSOhk34kSVW
nhbgC4H1AXZamJGCtBDYiwSMseSPPU3oox7ijv0k/3JwHY75JXsgQLtbnZr0HhWx
i8bn4Z5fCKhXO4GG6KqN3cymV3pZPDPKlAq4Ks5uUkY3MYucqId4FZfMpKFqokIP
pZewgJ85USOmn6NYu03rl50DvgRQ3pBsAQgAual9FPCkjAm9vbnxacd5AqfTD7Jo
yC0CgykLHAR6LeqwHVtYtbcHj7ajMgPFArMmU1pPX879ODt8l6Xc00r88UK9QWy9
sM3TFflTPlnkl4YAlWJh3NayZs7/qasbOatcqtFdDjiX01rlDfapXWfyMhifunMJ
bb/VaPZ093cVigQmKmCsq/kFZAXb29yCucLnJQtWebaMTuq4+mSRQw54tNs1S/Zj
HgbIBxW/aRjOoXDRIuwrk7GtqhOnnXbx1MvwWtRvgDVTALyhkDjY7NQKKKOBmcs/
GeBRnASKNqvd3z27wXx2mMHgAtFUX1E9YfeMM049ljf0yetVlEHeHY7R3wARAQAB
/gMDAmv/VuA8lL0r1APtPSDJGPcsZf/xid5Js+AQ0BWbQjV40t5l1P6kOTbr1nWh
8LstBlWyMzWiGTQib7s2Q8Y+JlOSeW75rW7wewyl2MxmCJ5R7sJVvdR0Mqy/8shO
47epXG3ftJytV3TXP1GC55pFlohJfbdxrhSElxmGvyj7PAPxYVO7kpU8zJ4F7EGC
jGeEsiakX31V1qEdtlo+lBt5fm4OlCtSp/17jvT36mmE2bWq2QI6RsH3w8i29ZwA
+SilA1e/IxULRs/hJ6M3aPH8i9y3Su0zp8bmU+EhRkbLMTS+dd8w1p/ZK3x/L5pF
N4Xm7irEW9H28++VkPOtwMYtO6qPcKjD0xXHfNHzjBEvUtvK0GCqQPQ+erS5A81L
EjzLLoKHma5wFJIMbLikVDtbUHRZFHGldyZKqMUqPhOprKCINDj6hfBLAWNN/zP1
37ctEThD4TnATTmDMXv5vIQ5PkPnLNbJE4ZFiDWRc+v9XPYwa3yZuUKk8sqLOBGg
uFu5Rnq49iznmX9+gGZlh8yERfS2W8ahaJZLKo20lyn4hwVj5WVRK6J13ehR10y/
Pi3zY16q3+r+iQUwvHl3LOMVzzNx6OgcX/41AS/v8eU2Fdho/sxwwrLIBngWMdOK
QtLiLrqxLUDFJby1nYgWWMkLuhSrjIajQr8LuyYcaMXuZPY2x0IxkIiO2gzra8IF
63o0oobkSvBxkZ21pYUJjHOdtS1kqEFr983k0hvxch/77XJPkqeCo4ybFGTtql8X
Oj7AHCpVogl7INrHfOvoB22UwNKQjoUICed/OSM8a7TVQ/IgAlPtI7fjYCJPKtdc
irFEpKYgP2gktDlAl30phOXROEylAHqkJmraWV20r79fLqMn9vj5eOPtSxVW7FFi
vNmuIFU7mkUoKvshfrrgfYOJAR8EGAECAAkFAlDekGwCGwwACgkQHaHO9hYEg8sT
QQf/V31tzlbmdgIClBqs2V9rR/dhUcs6KW3c4fbVyJxKYhgx9mRyRCytos0onaPs
ZSHzFfHvV6vVxPKV4th++a3DGGax1qefHCVQ1hNAlH+lY9NuEefFHAAWafBefSeg
t3nahYKiaNNHLE2+vGn+Yn/p41dMBjvsndPNf6FFBHKTpweule5h0Q8pe2vf67rv
/CcacoPitpCtIHHA7b46Z9ZEM+ABHCoxLBpRDES2Tn08AYkFmtQ17C7VPADKBmac
WOFih0Xz6vN6tyxiR3OS+101W4dUWCO8eMnQogyV4aZIaln9jGtQxdJvPqqJq3r1
72D1c+CzZ2690Fz1H6l+2jtaJQ==
=G2Gf
-----END PGP PRIVATE KEY BLOCK-----

[John (John K.)]

*goes dizzy at the story written* Is the strange prose and grammatical errors an integral part of the script too?
I guess it is....

[cozz]

*goes dizzy at the story written* Is the strange prose and grammatical errors an integral part of the script too?
I guess it is....

As you have already noticed, english is not my first language. Sorry for that. Grammatical errors dont really matter, its about the content.

[Bowjob]

I'm actually not quite sure what to do here... Read the story and.. somewhere within the story is.. a "script?

[cozz]

I'm actually not quite sure what to do here... Read the story and.. somewhere within the story is.. a "script?

Yes, but I have to admit that this is for people who at least know the basics of writing code and are capable
of writing a simple script. Could basically be written in any language.

[Bowjob]

Okay, I'm out then.

[Tacticat]

Well, at some point it obviously requires whirlpool hash. That's what I got.

[John (John K.)]

Well, at some point it obviously requires whirlpool hash. That's what I got.

And cozz and alice are variables of a kind that could be concatenated/added together mathematically.

[wachtwoord]

The flight number should be at the start.

[CIYAM]

Well I thought I might have got somewhere with one of these - but unfortunately no cigar:

Code:

88812553199616078911616500
88812553789116161996160500
88812553789116161601996500
88812553199678911616160500
88812553160199678911616500
88812553160789116161996500
88816012553199678911616500
88816012553789116161996500
88819961255316078911616500
88819961255378911616160500
88816019961255378911616500
88816019967891161612553500
88816019967891161612553500
88878911616125531996160500
88878911616125531601996500
88819961255316078911616500
88819961255378911616160500
88819961601255378911616500
88819961607891161612553500
88878911616199616012553500
88878911616160199612553500
88819967891161616012553500
88819961607891161612553500

[cozz]

Well, at some point it obviously requires whirlpool hash. That's what I got.

correct. 1 BTC for you sir: d794e7cb39e187088483d567d9d8665546785744e4e2e7e8d4e9cc694fa8bfef (transactionid)

[cozz]

And cozz and alice are variables of a kind that could be concatenated/added together mathematically.

Not quite correct. Script uses concat operation, but the thing with the variables is just halfway correct.

[cozz]

The flight number should be at the start.

correct. 1BTC for you sir:  0d6ebe5a2953b4f02defa6d69fdb1644a060b33898c2e2404c90e9794e219b9f (transactionid)

HINT: The password starts with 888 and contains both letters and numbers.

[cozz]

Well I thought I might have got somewhere with one of these - but unfortunately no cigar:

Code:

88812553199616078911616500
88812553789116161996160500
88812553789116161601996500
88812553199678911616160500
88812553160199678911616500
88812553160789116161996500
88816012553199678911616500
88816012553789116161996500
88819961255316078911616500
88819961255378911616160500
88816019961255378911616500
88816019967891161612553500
88816019967891161612553500
88878911616125531996160500
88878911616125531601996500
88819961255316078911616500
88819961255378911616160500
88819961601255378911616500
88819961607891161612553500
88878911616199616012553500
88878911616160199612553500
88819967891161616012553500
88819961607891161612553500

How did you come up with these? As posted above password is not only numbers. Also the flight number does not really exist, this is just part of the story and made up.

[CIYAM]

How did you come up with these? As posted above password is not only numbers.

Didn't know that until after I had come up with that and posted.

For the earlier stuff I was assuming that "cozz" was hashed with MD5 (with another 5 rounds?) which is then base64'd?

And I also thought that Maryland (MD) was another reference to MD5.

Got confused about the whole stuff about richer (although was guessing SHA1 followed by SHA256) and then the stuff about getting the "coins" to make 500 Euros I thought meant "adding up all the digits" from the SHA256 hash.

Actually as I hadn't even heard of "whirlpool" before I think I probably have pretty much zero chance at this (although now have "hashdeep' installed which is where the "78911616" came from) - but I like the cleverness of it.

[cozz]

HINTS:

was hashed with MD5

correct. The doctor with 5 children is md5.

For the earlier stuff I was assuming that "cozz" was hashed with MD5

halfway correct

"cozz" was hashed with MD5 (with another 5 rounds?)

md5 is used 5 rounds total in the script. I guess the story should have been, that I am driving around the doctors house WHILE EATING the doctors meals.

which is then base64'd?

correct. I you look up the wikipedia page of base64 and search for 137 you can see what I was going for with the 137%

And I also thought that Maryland (MD) was another reference to MD5.

nope.

(although was guessing SHA1 followed by SHA256)

Well, maybe something like that...

and then the stuff about getting the "coins" to make 500 Euros I thought meant "adding up all the digits" from the SHA256 hash.

Not adding up all the digits, just removing.

1BTC for you sir: 39f77b5f297500d80701747b24f0e2d72cd1b9bc8cafea0a19132e28f3be96ab (transactionid)

[Scrat Acorns]

He has won his first race championship in 1996 in europe driving with a speed of 160 miles per hour.

RIPEMD160 (published in 1996)

[cozz]

He has won his first race championship in 1996 in europe driving with a speed of 160 miles per hour.

RIPEMD160 (published in 1996)

correct. you win 1BTC. whats your btc address?

[Scrat Acorns]

correct. you win 1BTC. whats your btc address?

14r9f5paWs67S8ixqssSvpN3yuiChA3Pcb

he literally is a stupid or unpleasant person.

ROT13?

I never felt like I had to add another entering somewhere.

No line feeds for all hashes

[cozz]

correct. you win 1BTC. whats your btc address?

14r9f5paWs67S8ixqssSvpN3yuiChA3Pcb

145cc0242d8266536ae1f60f69484352af8c512fbd7a743651e18668a48ff471 (transactionid)

he literally is a stupid or unpleasant person.
ROT13?

nope

I never felt like I had to add another entering somewhere.
No line feeds for all hashes

correct