PROBLEM LINKS
DIFFICULTY
CHALENGE
PREREQUISITES
Ad-Hoc, Brute Force
PROBLEM
You are given N servers, out of which a vast majority are honeypots. You have to guess the passwords at these servers. You know that the servers mix the passwords with some random salt, and then compare SHA-1 hashes of both the strings.
The score is equal to the sum of the square of the number of bits correctly matched. Honeypot servers do not affect the score at all.
EXPLANATION
Firstly, you can try to find which servers are honeypot servers.
This can be done by first getting a reference score by using some a set of passwords initially; then
- Change a single password to some other string
- If the score changes, then that server is not honeypot
- Otherwise the server is honeypot
Since we know that the density of honeypot servers is high, we can be smarter and try to find blocks of honeypot servers together. In case we find the score did change for the block of servers we were hoping to be honeypot, we can then try them one by one.
After finding the honeypot servers, we must now try to find the passwords.
The chances of finding the exact password in this problem for any server are extremely narrow. Because of the nature of SHA-1, you cannot even hope to change a string ever so slightly to try and get a better result.
Your best bet is to generate random strings and see which one gets you closer to better and better scores.
One method is to only generate random strings and then try to run the corpus of random strings for each server (of course not for honeypots) while keeping all the other strings constant to try and maximize the score.
This is what the tester's solution does. You have to be careful that you should not exceed the number of attepts you have.
SETTER'S SOLUTION
Can be found here.
TESTER'S SOLUTION
Can be found here.