Search for:
Another Revelations cipher solved, and notes on the final one
Call of Duty: Zombies

Another Revelations cipher solved, and notes on the final one

By 3 Mins Read


I'm back with another solved cipher. This one is Rev-1, also known as "DE Bucket" or "Undercroft Paper".

Due to the extremely short length, I knew not to get too excited about the content of the plaintext. And indeed it doesn't really say anything new. The entire plaintext is just:

The many worlds are now one.

which resembles the start of Rev-12, which begins "Now that the many worlds are one…" Still, it's nice to knock this one out. There's only one Rev cipher and TheGiant left!

How it was solved

Like I expected, it uses a classical step followed by mcrypt, the outdated modern encryption library that was used in most of the other recently solved Rev ciphers. I assumed there was a classical step on top because it wasn't solved with the others when they otherwise all used the same tool and key. Since we have both uppercase, lowercase, and symbols in the base64, I searched for as many contemporary cipher tools I could find that would have preserved casing and symbols at the time and chained their output into mcrypt.

Original ciphertext:

OkEeZHnifuMdYB1IbHyAfb0g2FJzrVmfkKcSbKrpQGvhQ0/bvu76RdnGy/WtT7T3

STEP 1:

Beaufort cipher with alphabet "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz", key "ZOMBIES" (all caps)

For encryption purposes, capitals and lowercase are treated as separate characters and can encrypt to the opposite case. (For example, "Z" rotated by 1 becomes "a")

This was the default alphabet of the now defunct Cryptool-online, which I believe they used to encode it.

It can be recreated on modern cryptii by setting Case Strategy to "Strict" and manually inputting the alphabet. https://cryptii.com/pipes/beaufort-cipher/ (screenshot)

LeIXjxfrjSpfgR1RnFDIZr0t2JDCRjgueCZqdIiZwvNXC0/yTS76kfRMb/sTi7p3

STEP 2: RC2 ECB mode, key "Zombies"

=cSr+4oEQ6IObJJ8nRTt7+opLqDeJDJOunfLG2DTAHwc

STEP 3: reverse

cwHATD2GLfnuOJDJeDqLpo+7tTRn8JJbOI6QEo4+rSc=

STEP 4: Rijndael-256 ECB mode, key "Zombies"

The many worlds are now one.

I note that these are the only ciphers so far to use ECB mode instead of CFB.

RC2 was also reused in Rev-5, which breaks my theory that each algorithm used would be unique.

The final unsolved Revelations cipher

The last remaining Rev cipher is Rev-7, aka "Origins Trench". This cipher is unique for consisting of uppercase hex split into groups of 5 characters. The first group only contains 2 characters, which suggests that first we need to reverse the text so that it starts with "F74A1…"

After knowing this one used Cryptool, I believe even more strongly that Rev-7 also used it, because Cryptool has the option to output in groups of 5 for many of its ciphers. I also expect it to be transposition, because I would expect substitution to change the letters to be outside of the A-F range.

The two main candidates I see are AMSCO and Scytale, which automatically output in uppercase and split into groups of 5. However, I've already bruteforced all values for Scytale and all AMSCO keys up to length 9 with no results using mcrypt.

Some possibilities why it didn't work:

  • There could be multiple classical steps on top
  • There could be some mistake in the encryption or missing ciphertext that causes the transposition to not decode correctly
  • I'm wrong, and they used another site or something custom with a hex alphabet

Hopefully we can get this last one solved!