What is an 'escape room' and what skills does solving one develop?

A physical puzzle game where players are locked in a room and must solve interconnected puzzles to 'escape' in a time limit — develops logical reasoning, teamwork, lateral thinking, and pattern recognition A security training simulation where employees practice escaping from ransomware attacks A computer game where players solve cryptographic puzzles to escape from a virtual prison A type of puzzle box that can only be opened by solving a series of mechanical challenges

What is an 'ARG' (Alternate Reality Game)?

An interactive narrative spread across multiple real-world and digital platforms — players collaboratively solve puzzles hidden in websites, videos, phone calls, and physical locations to uncover a story A type of video game set in an alternate historical reality with different technology An augmented reality game like Pokémon GO that overlays digital elements on the real world A role-playing game where players create alternate identities and solve mystery scenarios

What principles make a well-designed cryptographic puzzle?

Fair cluing (all information needed is provided), a unique solution (no ambiguity), satisfying logic (the 'aha moment' is rewarding), appropriate difficulty, and clear indication that a puzzle exists Maximum difficulty to challenge solvers, requiring extensive research outside the puzzle Multiple valid solutions to accommodate different solving styles and approaches Randomness — good puzzles should have no pattern that gives the solution away

What is a 'puzzle hunt' and how is it different from a single puzzle?

A competition where teams solve dozens or hundreds of puzzles over days — individual puzzle answers feed into a 'meta-puzzle' that uses those answers as clues, requiring both breadth (many puzzles) and depth (meta-logic) A casual event where participants search for hidden physical puzzles around a city A solo competition where a single person solves many puzzles as fast as possible A puzzle that hunts through a database for specific pieces of information

How can CTF (Capture The Flag) competitions develop cryptography skills?

CTF crypto challenges present real cryptographic problems — weak implementations, vulnerable parameters, protocol flaws — that require both theoretical knowledge and practical coding to exploit CTF competitions only test memorization of cipher names and historical facts CTF crypto challenges focus only on unbreakable ciphers — you learn what can't be solved CTF competitions use made-up ciphers that don't relate to real cryptography

What is the 'ECB mode penguin' and what vulnerability does it demonstrate?

A famous example showing that AES in ECB (Electronic Codebook) mode encrypts identical blocks identically — encrypting a bitmap image leaves the overall pattern visible as a blocky encrypted image A Linux mascot that was discovered to contain a hidden encrypted message by researchers A vulnerability discovered in AES that affected only devices running the Linux penguin logo An attack that uses a penguin-shaped key schedule to break block ciphers

What is a 'birthday attack' in cryptography?

Exploiting the birthday paradox — finding two inputs with the same hash requires only √(2^n) attempts, not 2^n — making hash collision attacks easier than expected An attack timed to happen on a target's birthday when they're distracted A brute-force attack that gets twice as fast each year as computers get more powerful Attacking a cipher using date-based patterns — ciphers generated on specific dates have predictable keys

What is 'padding oracle attack' and what historic vulnerability did it exploit?

Exploiting an error message that reveals whether decrypted data has valid padding — allows an attacker to decrypt ciphertext byte-by-byte without the key, by observing 'valid padding' vs 'invalid padding' responses Attacking a cipher by having an oracle (all-knowing entity) guess the padding bits An attack that removes padding from encrypted messages to make them shorter A vulnerability where database padding allows SQL injection in encrypted queries

What is 'timing attack' in the context of password comparison?

Exploiting that a naive string comparison returns false as soon as it finds the first wrong character — measuring response time reveals how many correct characters are at the start of the guess Guessing a password by timing how long it takes a user to type it An attack that exploits time zones — systems are more vulnerable at certain hours Using a timer to determine when a password is about to expire and attempting login then

What is 'fault injection' as a cryptographic attack?

Deliberately inducing errors in a cryptographic computation (via voltage glitches, clock manipulation, radiation) to produce faulty outputs that reveal information about the key Injecting false data into a system to cause it to encrypt incorrect information Introducing bugs into cryptographic software to create exploitable vulnerabilities Sending malformed data to a cryptographic system to crash it and bypass security