Stormseeker’s Steam Profile Comments Analysis[/SIZE] or the difficulty of finding the right path to solve the code:
We will assume for this analysis that stormseeker did not lie at any point regarding the ARG progress, but that he could have tried to confuse the players in regards to the method needed to solve it (“How do you know solving this has anything to do with encryption? :freeman:”)
23-01-2013,07:09 - User: stormseeker
“[i]There will indeed be a conclusion to the ARG, when people have moved beyond the current gateway puzzle, but it might be a while before you get to it. 
BM is still being worked on, nothing has been cancelled. Information isnt forthcoming at the moment due to the processes involved with Steam Greenlight, which limits what we can and cant say regarding the mod.[/i]”
Meanwhile, on the forums, that very same day…
https://forums.blackmesasource.com/showthread.php?t=13735&page=70
23-01-2013, 10:19 - User: Ysrael214
“Bump, Bump, Bump. Stormseeker said you are near to the answer. Any updates?”
It would be great to know if user Ysrael214 was told by stormseeker that the solution was close, or he interpreted the steam profile comment that way. I’m assuming that the comment made by stormseeker the twenty-third of January 2013 actually implies that the solution was not close.
13-05-2013, 12:47 - User: stormseeker
“If it’s about the ARG, I’ve not set up or had any sites setup for hacking, so no. There is an answer, but you can’t brute force it, the CIA couldn’t brute force it. Someone is already close.”
Analysis:[/SIZE]
Assuming that the solution was not close the twenty-third of January, and it was close the thirteenth of May, we can infer safely that one of the theories regarding the 752 Code developed during the time span between the two dates is, in fact, the one that will lead to the solution; and the only discussed theories are DES or 3DES encryption, taking into account that DES is easily cracked by the CIA, and storm said “…the CIA couldn’t brute force it…”, it would be safe to guess that 3DES or more advanced algorithms are the way to go.
Another interesting theory was posted by Gunsrequiem, keep in mind that even if it sounds farfetched, it was the last theory made before stormseeker said that someone was close, and the activity on the ARG thread was very low during that time.
https://forums.blackmesasource.com/showthread.php?t=13735&page=73
18-04-2013, 20:02 - User: Gunsrequiem
“…Granted, we correctly decoded the ASCII-85 text, yet were are having tons of trouble with the hexadecimal portion of the code–despite having various potential leads. One thing we’ve not considered is that the hexadecimal portion of the code may need to be shifted in some manner–for example, ROT-1 = rotate each input once…”
If the Hex Code had to be rotated, I would personally bet it is ROT-2, since the IP on the HALOS.txt message and in IRC clue 6 is 84.9.123.345, and in previous clues it was within range, below 255.
That’s everything that was discussed between the two dates on the ARG thread in regards to the 752 code. We know that Gunsrequiem was speaking through private messages with 0418/stormseeker, but we only know what 0418/stormseeker wrote, so maybe Gunsrequiem wrote something to 0418/stormseeker that made him write on his steam profile that somebody was near the solution.
Now, the Code is 3008 bits long, or 47 blocks of 64 bits. If we assume that a block cipher was used, it has to be a 64 bits block size encryption algorithm. Unless it was used in stream mode, with a message made up by 376 bytes to give the impression that it was a 64 bits block size algorithm.
Another possibility is that the message has some random bytes added as padding at the start and/or the end, to obfuscate the block size; the problem with this theory is that the padding should be recognizable so we could know where it starts and where it ends, possible “codemarks” for the padding could be the bytes 02 03 and 04, since those are the ASCII control symbols used on the grilledpizza.jpg solution, but after a quick look to the code it seems it is not the case, since there is no pattern to be found that would allow to dissect the code from these bytes:
B3 2B 00 3A 35 BA DD 66 57 7C 24 C1 4F C9 19 06 43 46 D1 31 A7 C5 4B B8 2F FE [COLOR=‘Yellow’]03 E0 22 61 57 77 24 79 23 DC 21 F6 2C D4 18 2E 91 C3 B2 67 B5 45 AB CA ED AF [COLOR=‘Lime’]02 61 51 0D 4E EA 1E 87 CD 33 C7 C7 71 31 30 9C C4 28 0E B4 24 3D 11 54 F0 44 F9 CF 62 96 D9 BF F7 39 7E 43 90 98 7F E6 32 [COLOR=‘Yellow’]03 DA 0D E4 [COLOR=‘Lime’]02 78 B3 A5 4F 5D DC 69 75 FA [COLOR=‘Cyan’]04 F7 49 84 9E 1A 62 59 5A 9F 63 0B 07 95 91 3D E0 15 3E 3A AC 38 8C 45 FB 9D 85 0C FE 91 35 41 D6 C0 83 98 F2 C8 83 32 A8 2F DF 00 28 1D 62 FC DC 4F E7 E4 6A E9 0C 51 C5 C8 06 B4 11 64 E3 3A B9 2C 96 86 2E 06 8B 0C 16 C0 99 90 B8 38 1A 00 DA 79 15 B6 7F E4 A2 0F 59 9B 0F 1B 6D 48 19 13 C7 B9 53 8C EE 63 91 44 F4 15 61 BA 92 E4 FE 75 1D 1E 24 2C D8 8F 51 D6 95 51 98 87 13 6A 7C 15 AA BD 7B 40 [COLOR=‘Cyan’]04 49 22 01 41 30 A9 1F 17 0F 66 CC B3 C1 39 46 3A 7E 90 9A 37 AA 86 3F B2 78 05 FC 97 31 C0 9C 8C 79 06 7E 79 93 0A 40 65 46 B2 4C 9A 62 9B 26 C2 CE 2A 4B E4 8F 58 9A 37 5F EB 73 1F C4 AB 22 5C 11 84 8C F8 9E 29 1F B2 71 33 97 0C 06 36 18 47 4A 89 28 01 ED D6 8F 54 69 8C 5E 5B 50 67 46 F6 76 5A 6F 7F 12 25 DE A4 DA 11 40 FE B6 0F 65 07 45 24 1C 69 36 95 88 3D CB 21 E6 FB FE FB B8 5A 29 91 94 80 36 A5 2B 5D
TL;DR:[/SIZE]
“Someone is already close” – stormseeker
This could mean that 3DES is actually the way to decrypt the 752 Code, or that the step from DES to 3DES is in the right direction, and therefore the next logical step should be to try AES (as it was tried, in fact). So trying again to decrypt the code with OpenSSL with different passwords and modes, limiting the amount of algorithms to those directly related to 3DES and AES, to save time, could be a good idea.
