Blog Description



This blog is a personal examination of the "Pizza Code Mystery" ARG created by Christopher Horn for the Black Mesa video game.
I will attempt to update this blog on a regular basis, for as long as the ARG is in existence and folks are willing to attempt to solve it.
This will not be a complete overview of the clues and such associated with the ARG--you can find a complete, up-to-date version of that material here.


Monday, June 15, 2015

Further Information From Storm

Just a brief update regarding a few bits of information that Storm provided during a conversation today. Here's the pertinent info from our conversation:

[EVIL]GunslingersRequiem: 1. Were you really Code_ / 0418 from the forums? 2. Should we spend more effort constructing the story in the game rather than focusing so closely on the web-based clues?

[BMS] stormseeker: 1. yep 2. a bit of both. I suspect if all else fails, something will come along and assist


To recap, Storm really was Code_ / 0418, so we could definitely take his PM at face value at least in the sense that we are probably on the right track with the encryption methods we've considered. Second, the web-based clues are relevant, but we also need to spend some time in the game continuing to look for clues that may assist with the HALOS file and possibly other future assets of the ARG. That said, I have included a new page entitled "Steam Release Clues" under the "In-Game Clues" heading on the front page of the wiki. Please do not hesitate to post whatever you may find that looks important, for we can always weed out (as a collaborative effort) those things we deem unnecessary, or redirect information we already have to their proper places on the ARG. Furthermore, you are all of course always welcome to contribute any thoughts you have to the blog and continue to submit key/keyphrase ideas you come up with. I have a list already in the works, and once I hit a certain threshold I will begin posting them to the wiki in alphabetical order.

Storm also mentioned that, if we are still unable to come up with a solution prior to a certain time, something may assist us down the road. However, I think we should continue to focus our efforts on what we have rather than simply play the waiting game. We owe him at least that much.

Thursday, June 4, 2015

Possible Key Submission Form

I have added a page where anyone can submit a possible key and describe how they came up with it. Visitors to the page can also view previously submitted keys to ensure that someone else has not already come up with it. You can directly follow the link below, or utilize the one found within the "Quick Resource Guide" box on the right side of the page.

Possible Key Submission Form

Monday, March 9, 2015

JohnNotJohn's Secret Identity

Well, if you're here you probably already know that user JohnNotJohn on the forums is actually HALOS.  I ran across this message earlier today, one of the first posts by JohnNotJohn:

"I've been looking over some of the earlier pages of the thread, and I noticed that Storm said we were close two years ago, when the HALOS file was found. All of the work that has been done since then has focused on ultimately solving that one puzzle. Meaning everything Storm has done since then must have been subtly hinting at the solution to that puzzle. However, he might just be messing with us. Also, I personally recommend the 80s and 90s, corresponding to about a year ago. Lots of interesting stuff, including acronyms, anagrams, analyzing static, large amounts of numbers, and more. Old thoughts sometimes inspire new thoughts. See if anything occurs to you while re-reading.

Just keep your eyes peeled, and you might find something."

"I AM HALOS"

Anyhow, now that we have this information, I've decided that it would be wise to collaborate all of the posts by JohnNotJohn.  If no one beats me to it, I will update the Wiki with a page sporting these posts, as well as a section left open for speculation by visitors to the Wiki.

It turns out this is not really a reference to the "real" HALOS, but a horrendously cruel ploy by one of the users on the forum.  Nonetheless, JohnNotJohn's got some good ideas, so I figured I'd leave this up in case it helps anyone.

2/27/15
Hello, long-time reader, first-time poster here.
A strange thought occurred to me, and I felt like I should share it.

If kxbm.net is supposed to be a local news site for the area around Black Mesa, and if localdesertsingles.com is supposed to be a dating site for the same area, isn't it odd that both sites are reporting unusually high server loads?

Also, I don't know if it's been mentioned yet, but Thomas Lee is an anagram of "Meet Halos."  




2/27/15
"Tim Evans" = "TV in Mesa"  


2/27/15
Thanks!
I did an anagram search of Tim Evans after I noticed the Thomas Lee one. I would have posted it earlier, but I didn't want to start a wild goose chase involving every TV in the game. Apologies for that.


I'll keep my eyes peeled for anything else. 



2/27/15
faed:  "Which actually is 2000.0037245213093 milliseconds."

I'm curious about those numbers. It would have been simple enough to just encode 2000ms



2/27/15
I was working on that name. Nice job noticing the BMRF. With that in mind, I was able to get "Frank Abrams" = "BMRF as an ark"

It's a bit of a stretch, but it might be something.  



2/28/15
I've been looking over some of the earlier pages of the thread, and I noticed that Storm said we were close two years ago, when the HALOS file was found. All of the work that has been done since then has focused on ultimately solving that one puzzle. Meaning everything Storm has done since then must have been subtly hinting at the solution to that puzzle. However, he might just be messing with us. Also, I personally recommend the 80s and 90s, corresponding to about a year ago. Lots of interesting stuff, including acronyms, anagrams, analyzing static, large amounts of numbers, and more. Old thoughts sometimes inspire new thoughts. See if anything occurs to you while re-reading.
Just keep your eyes peeled, and you might find something.



3/1/15
Doing a bit of research, it seems AES, Twofish, and Serpent all use key lenghts of 128, 192, or 256 bits. This means the password would need to be 16, 24, or 32 characters long. BENALOHPAILLIER is only 15 letters.

Rjindael, whichwas used as the basis for AES, can also be used with a 20 or 28 character password, in addition to those mentioned above.

This is just from the Wikipedia entries on those systems.  



3/1/15
Clue 6 pointed to the HALOS file.
Clue 5 gave the password "BENALOHPAILLIER."
Clue 3 was the first mention of HALOS, as far as I can tell.

Clue 4, however, doesn't seem to add much at first. But consider this: it gave a login "HALOS"
Combining the login and the password gives a total of 20 characters, which can be used as a 160-bit key for a Rijndael cipher.



3/1/15
thewizard99: "After looking back, someone mentioned about SP/Twofish a while back ( 2 years ) and someone brushed right past it. With this board and it being noted. We seem to be on the right track.
Now how does Serpant/Twofish work?"

I mentioned this earlier.  

JohnNotJohn: "Doing a bit of research, it seems AES, Twofish, and Serpent all use key lenghts of 128, 192, or 256 bits. This means the password would need to be 16, 24, or 32 characters long."


3/2/15 
"congratulationsyouwonthePIZZA" is 29 bytes, but I can't help but feel it's related somehow.

Was the capitalization of "PIZZA" a part of the solution?

Edit: I checked the wiki. The cipher used ASCII characters, so the capitalization is intentional. Curious, considering the suspected encryption of the 752 hex code requires a case sensitive password.  





3/5/15 
I've taken some time to look into the underlying story of the ARG, seeing as it is something Storm has repeatedly told us to do. While reviewing the clues we have been given, as well as the current established theories, a few points stuck out.

First, there is the connection between HALOS, Niobium, and pizzas. The first time all three were mentioned in a single clue was in the 'Tempus Omnia Revelant' page, posted after the trail went cold on the HALOS file.
There is a long-standing that Niobium was being smuggled in on pizzas and used to build an AI called HALOS. While this would explain the large portion of the budget being spent on pizza, it doesn't explain why the Niobium was being smuggled in the first place. The use of Niobium in the construction of an AI is established in whiteboard c0a1x_labboard_am1. However, from the same whiteboard, it can be inferred that Dr. Montero, often noted as an administrator, was aware that Dr. Bottomley was in possession of Niobium. Why, then, were measures being taken to smuggle it in?
My theory is that the Niobium was initially being used in the development of the Tau Cannon. After all, the usage of Nb alloys as a superconductor is often linked to its use in particle accelerators. This would explain why Dr. Montero was aware of its presence in the Biodome. However, if Nb can also be used in an AI, and Dr. Horn and Dr. Bottomley were secretly using for this purpose, they would need a way to smuggle in additional Nb so as to avoid detection. This is why they used pizzas. A stockpile of pizzas, while strange, would seem much more innocent than a stockpile--or worse, unexplained disappearances--of an element often used in jet engines (see C-103 alloy) and currently being used in the Tau Cannon, the destructive power of which we are all familiar with.
This theory doesn't replace the long-standing one, but rather acts to fill on some of the gaps, and make use of the clues which have been provided.

Second, understanding the significance of the pizzas, what is the implication of their theft by Dr. Stone and Dr. Welsh? Whiteboard c2a4x_labboard1 already shows Dr. Horn's frustration regarding one of the security guards taking and eating the pizzas. This is understandable, because it would mean that more pizzas would have to be ordered to replace the Niobium. But consider what would happen if someone made a concentrated effort to steal and hide as many pizzas as possible. Recall that the events of Half-Life 1 take place in May, while the diary entry from Dr. Welsh mentioning the plan to steal the pizzas is dated in either September or October, depending on what format was used for the date. Since we are still able to find countless pizzas scattered throughout the facility, and the large contribution of pizza orders to the Biodome budget, as well as their continued theft (see whiteboard c2a4x_labboard15). is still being seen as an issue, it would appear that this has been going on for several months--almost a year, in fact.

If something about the previous statement seems strange, that is because it should. According to the evidence presented above, Dr. Horn had been continuing to smuggle in Niobium using pizzas right up to the events of HL1. However, this seems to contradict IRC clues 2 and 3, which points to the recovery of Niobium at Holloman Air Force Base, and the subsequent continuation of project HALOS thereafter. I have several theories regarding this, but they are mostly speculation.



3/6/15
If we're looking at elements, here are some fun facts. Element 22, titanium, is often alloyed with Niobium and other elements to produce superalloys for use in rocket engines and other assemblies. Additionally, niobium-titanium alloys are type II superconductors, with applications in MRI machines and particle accelerators. For some fun with 21: Scandium, element 21, was historically alloyed with aluminum for use in the Russian MiG.

Edit: For those who would rather not grasp at straws, here are some interesting thoughts I have on some of the clues we've been given:

IRC Clue 1: Applying the [Recipient] [Message] [Sender] format yields the message "Don't let him find us," from Dr. Welsh to Dr. Horn. Also, the version that appears in "Tempus omnia revelant," under a section evidently written by "HALOS AUTOMATED," adds an attempt to triangulate the source. That section also contains a list of Niobium isotopes.

IRC Clue 5: The inner code is designated as a message for Dr. Horn, to be sent by HALOS "in level seven cases." The inner code transmission is preceded by an attempt to connect to "User H," the subsequent sending of data, and the statement "SECURITY LEVEL 7 ALPHA." The clue also contains an attempt to locate the leak suspected in IRC Clue 3

If I were to take a guess right now, I would say HALOS is online and not friendly. 



3/6/15
1 is the ASCII code for Start of Header. The Hex code is 376 bytes, 8 short of an even 384 for a 128 bit block. Scandium is element 21, and consists of 8 letters.  


3/7/15
Nice work! I've been pouring over all the whiteboards for clues, so I was aware of the change in the samples, but I never paid attention to the numbers. There is a good chance 21 may refer to the sample EP-0021. However, I not entirely convinced that 1 refers to the Anti-Mass Spectrometer. EP-0021 never technically went into it over the course of the game.

The mention of the switch in samples, however, reminded me of what was written on the whiteboard with the budget and the description of the cascade cipher. There is a not mentioning a specimen transfer from the Lambda complex to the Biodome.

Remember how the keyword for the SECOM cipher, "laseroptroniclinearinducercannon," was written on the same board as the ciphertext? This might be a similar case. After doing a bit of background research, and considering how the board mentions that the area is still under construction, we may need to widen our search for clues.  



3/7/15
A few days ago, I looked over the IRC clues to see if there were any clues the formatting. I reached the same idea regarding the [********] in IRC 4 at that time.

What strikes me as most notable regarding IRC 6 and HALOS.txt is the proxyhost, which is different from all previous messages.

My guess is that the IRC clues are transmission from HALOS. (IRC 1 included an intercepted transmission, as the Tempus page suggests)

Taken together, there are three adresses, which I've taken to indicate three HALOS sites. The first is 164, which intercepted IRC 1 and sent IRC 4. The second is 155, which I believe was built using Nb from HAFB. This one sent out IRC 3, with IRC 5 being a sort of automated "dying message" when the site was compromised.

The third is 345, which I believe is the newest site, set up by Horn after he received IRC 5, hence "you should bring pizzas," being code for Niobium to build a new computer to run HALOS.

I'm not sure how IRC 2 fits in.

EDIT: Perhaps IRC 2 was just a simple message, rather than a transmission from HALOS. That would explain the lack of the typical formatting.  



3/7/15
Perhaps something in the IRC clues can help us with the HALOS code. If only we had been discussing that earlier, say, in the last few posts.  


3/7/15
CPU: "The same happens here.Whiteboard C2a4x labboard15.jpg references Anamalous Materials which is the chapter name of where the Anti-Mass Spectrometer is located and it also mentions the Resonance Cascade which is what the Anti-Mass Spectrometer caused. Storm had aslo said "It's everywhere you look" which would indicate seeing the results of the resonance cascade. His comment that "the password will probably be hinted at, perhaps in a less than obvious way" also matches" 

I'm not disagreeing with you. If the password works, then it works. Try it and we will know. In the mean time, I'll continue following Storm's other advice, and work out the story.  


3/8/15
Astij: "I think 'its everywhere you look' is in relation to the fact that that particular message was decoded by SECOM, which was hidden in the very message we were reading. Also, where is that second quote from, I don't think I've seen it before."

It's from the PM from 0418_08151814, an alias of Stormseeker. It's on his page on the wiki. The PM includes several hints at the method of encryption. 


3/9/15
I've always felt that the phrasing "21 goes into 1" is indicative of some form of metonymy. Subject-verb agreement requires that "21" be a singular object. Youdon't say "21 somethings goes into so." That why I agreed with CPU regarding a reference to Xen crystal EP-0021.

It's mentioned quite a bit on some of the whiteboards. Also, since it's referred to as a specimen, I would guess that it was the specimen transfered to the biodome.

Either way, I would agree that the key probably references the biodome, and the encryption is probably referenced in the PM from code. Personally, my (metaphorical) money is on an AES encryption, since it is mentioned in both the PM and the whiteboards.

EDIT: Remember the OTR-style security breakdown from Code_'s PM? It mentioned cascade ciphers later on, but only a single cipher for the hex code. 

Friday, August 29, 2014

Possible .JPG Image Hex Buried Within .PNG Image On BMRF.us

What follows is the hex code with the .jpg signatures found within the .png image on the BMRF.us site:

FFD82688844564C413116AD534C9D534349B44A3A7F1C6A709AB . . . 

It turns out that this is not a .jpg embedded in the .png, as it does not include a complete signature.  Oh well; worth a shot!

Monday, August 25, 2014

Update Part 2 of 2: Concept Map

 You can now open or save the concept map simply by clicking the link below.  You can also click the embedded picture to open it in a separate screen for closer examination. Keep in mind that the picture is fuzzy here, but opening the link provides the full, high-resolution version.

Open/save the Concept Map


Update Part 1 of 2: Timeline

I will be updating the blog and the Wiki pages to reflect two entities that I believe will aid us in our quest to solve the 752-character Hex Code.  The first, which I've included here, is a timeline of hints/solutions that began after IRC Clue #1 and prior to Code D being solved.  I am also constructing a concept map to identify key ideas that are reflected throughout multiple parts of the ARG--my hope is that this will aid us in determining possible relationships between clues, whilst also potentially excluding red herrings.

Final Timeline - Codes A-D Onward
(Events begin after IRC Clue #1 and before Code D solution)

  1. October 4, 2012
    1. IRC Clue #2 - “Note Welsh”
      1. “N38°57'8.05" W77°8'44.82".
        Solution two ignore loc data N32°52'50.77" W106°20'49.40" not buried at initial loc, fly here.
        Travel 14.16 miles east we transferred the niobium there.
        Await further instructions.”
      2. Capital letters in initial solution spell out “NOTE WELSH”

  2. October 5, 2012
    1. IRC Clue #3 - “X01/X02”
      1. INCOMING TRANSMISSION - LOC 2 LAYER 2 SUBSTRATA 3 X01/X02 HALOS PROJECT INITIATED
        41Nb recovered. HAFB Compromised.
        Transfer to site complete, project HALOS underway. Further INFO [Classified].
        CODE BASE 64 compromised, switch to old code talker.
        They are watching, assume leaker on site.
        WSMR No longer viable location, move to main site, check external sources.”

  3. November 4, 2012
    1. SECOM cipher solved
      1. Grilled Pizza image on site
        1. Message hidden at bottom of page:
          1. ‘They stole the lie, as if that matters to me, HALOS is far too complete to stop now. They can't hide there, not now, not now I have this, this holds the key to all things... they CAN'T hide from me. I will follow them, I'll set up a link and this to remind me. Perhaps I should hide it on the secure site, perhaps that would be best. I'll find them though and they will pay, they will definitely pay. Dr Marcel was right when he said, "When you're building a cage for Satan, you don't ask him to wait around whilst you put the doors on." Welsh is probably behind this, but he won't get away with it.’
        2. Decoded image message:
          1. “congratulationsyouwonthePIZZA”

  4. November 4, 2012
    1. IRC Clue #4 - “Prime Site Compromised”
      1. Base64 decoding: “Proxyhost@-84-9-123-164.dslgb.com//closed.proxy.accepted//?OTR,1,3,?OTR:[I---MI-G TR--SMI---ON - UN---WN S##RCE]Access detected to personal site.
        Security compromised.
        HALOS project under threat. Site offline as response. Switching to new protocols.[********] ~[OTR//2.0]Q0FZRUlMVEhEWkVIVEhBTlpJRVRLSU5OQUFTVFNPU
        0lCSVNPRElIVEhBTlpJRURaRUhUS0lOV09MTEFDSEVFRElCRUhUSEFOWklFQ0FZRUlMVEhEWkVIRElCRUhUSEFOWklFTkFBU1RTT1NJTk9EQUlIVEhBTlpJRU1BRU5BQVNUU09TSUdBSFRLSU5ORUFTSEpTTlRIQU5aSUUKRElCRUhZQVpaSUxJTlNIVVNIRFpFSEtMSVpaSUVORVNIQ0hFRUNBWUVJTFRIS0xJWlpJRVlBWlpJR0FIU0hVU0hCRURJQk
        VIWUFaWklTSFVTSEJJU09ESUhOT0RBSUg=[/]~
        [Transmission Ends]”
      2. Navajo Code + Playfair (Key: “Terminal”) decryption of inner portion:
        “PRIMESITECOMPROMISEDRETURNBMRFLOGINHALOS”

  5. November 5, 2012
    1. IRC Clue #5 - “BENALOHPAILLIER”
      1. Base64 decode #1:
        “[[Proxyhost@-84-9-123-155.dslgb.com//closed.proxy.accepted//?OTR,1,3,?OTR:[INCOMING TRANSMISSION UNKNOWN SOURCE]LEAK SOURCE DETECTED. TRIANGULATING...MIX CASCADE
        HOP DETECTED...ATTEMPTING TIMING ATTACK...[TERMINATED] CANNOT CONNECT TO HOST...ATTEMPTING CONNECT TO USER H... SENDING DATA. SECURITY LEVEL 7 ALPHA.[OTR//3.0]
        QkFRS1ggSk9BSkcgWEFIRUQgSUZHSVogRlpEUEIgVVNYTEcgR1hIRkEgVUFVV00gSEJRQU0gV0FYVlkgTFFRUlkgV1JVV1YgRVRRT0sgQkFDQkUgSldITVMgSFZPTlogSUFIUEEgU09XQ00gTEdBVFggVUVYT1EgRFJ
        RRUogQlZMQk8gREpJSEUgQ1pUSE0gWktISUUgTk9NTFMgQVhWVlcKRVRXSVMgRVRJR00gUlhFVkYgUVlBVUIgVkZDRUIgUFdCVUsgRU1OT0wgVw==[/][End Transmission]|¬[Terminal.] ~~ [Transmission Ends]]”
      2. Base64 and running key decode #2 (inner portion):
        "This is a message left for Dr. Horn. Just to remind you in case of emergencies that the password to the HALOS files is BENALOHPAILLIER. I have programmed HALOS to send in level seven cases. You should bring pizzas."

  6. November 7, 2012
    1. IRC Clue #6 - “HALOS.TXT”
      1. Reminder to check website which led to discovery of HALOS.txt:
        “[[ProxyhoSt@-84-9-I23-345.dslgb.com//closed.proxy.accepTEd//?OTR,3,4,?OTR:[INCOMING TRANSMISSION]ThEpIzZaIsaLiE...HALOS[Transmission Ends]]”
      2. Not mentioned on Wiki (I have since updated to reflect this), but the capital letters after the first “p” spell out:  “SITE”
        1. This is obviously just a hint to return to the site

  7. CURRENT
    1. 752-character hex code retrieved from HALOS.txt . . . .

Saturday, August 2, 2014

Feedback For Writers • Index page

My latest pet project:

Feedback For Writers • Index page

Check it out if you have a knack for writing, need a critique on an essay or other written work, or just like giving constructive criticism!  Even if you don't, do me a favor and sign up.  Your registration helps improve the numbers!

Saturday, July 12, 2014

Two Notable Things On the "Tempus" Page

There are two things I recently noticed on the "Tempus" Wiki page; one seems more crucial than the other, but they both bear mentioning.

1.

The primary examination is on this part of the Wiki page:

INTERCEPT 099.00//a 

Report{BMRF-HALOS-AITR-0001,
author =     {HALOS AUTOMATED},
title =      INTERCEPT DATA,
year =      20xx,
month =      OCT,
institution =  {Black Mesa Research Facility - HALOS DEPT},
number =      {099.00//a}
}


I have no idea why I didn't notice this before, but that looks exactly like programming language.  At first it looked like a mix of simply HTML and CSS, seeing as how there are no called functions, but there are tons of programming languages that I don't know--Python, for instance.  Perhaps someone else would have a much easier time noting trends or key indicators that point toward one language.

2.

The second interesting thing is the line:   institution =  {Black Mesa Research Facility - HALOS DEPT},

I don't think that the HALOS project was a well-known entity within the facility (only a few people were "in on it"), so calling it the HALOS DEPT (HALOS department) seems to indicate that this message is as we originally suspected--a direct message within the systems or makers of HALOS that was not supposed to be "leaked" to the public.

Anyhow, hopefully this will get some gears chugging along again!  Any thoughts?

Tuesday, February 18, 2014

Where We Currently Stand

Code/Storm's Private Messages

We haven't had much success with the ARG lately, as we're still stuck on the Hex Code puzzle.  I recently revealed that Storm had been PMing me directly about the ARG, although his messages revealed little:

"Apologies for the time delay, things have been hell here for the last month or so.

I ran the code through a few programs that analyze entropy via auto-correlation, the n gram results indicate a weak encryption, but one that results in highly entropic data (which I correlated against a similar data set size from a randomness extractor) when decoded via Hex, which I suspect is a secondary encode, as most encrypted data sent via communications is encoded in order to avoid corruption. This may have skewed the block size analysis done previously (resulting in 376bytes or 64bits).


Code:
³+�:5ºÝfW|$ÁOÉCFÑ1§ÅK¸/þà"aWw?$y#Ü!ö,Ô.‘ògµE«Êí¯aQ
Nê‡Í3ÇÇ?q10œÄ(´$=TðDùÏb–Ù¿÷9~C˜æ2Ú
?äx³¥O]Üiuú÷I„žbYZŸc•‘=à>:¬?8ŒEû…þ‘5AÖÀƒ˜òȃ2¨/ß�(büÜOçäj?éQÅÈ´dã:¹,–†.‹À™¸8�Úy¶?ä¢Y›mHǹSŒîc‘D ôaº’äþu$,Ø?QÖ•Q˜‡j|ª½{@I"A0©f̳Á9F:?~š7ª†?²xü—1À œŒy~y“
@eF²Lšb›&Â?Î*KäXš7_ësÄ«"\„Œøž)²q3—6G?J‰(í֏TiŒ^[PgFövZo%Þ¤Ú@þ¶e?E$i6•ˆ=Ë!æûþû¸Z)‘”€6¥+]Thinking in a non linear way, I've tried to classify the OTR message header with its increasing scale as the puzzles moved on.

[CLASSIFIED INFORMATION LEVEL 8][OTR//4.0]

working from that basis and the other messages I have developed this list.

Level 0 - 2 = Non Encrypted or Encoded (similar to private and confidential?)
Level 3 - 4 = OTR 1 - Base 64 or Base 85 encoded
Level 5 - 6 = OTR 2 - Hyper-encrypted (layered) Pen and Paper Ciphers
Level 7 = OTR 3 - Hyper-encrypted (layered) One Time Pad
Level 8 = OTR 4 - ???
Level 9 - ?? = OTR 5 - ???

Considering a flawed OTP (which it was, considering the ability to analyze it), when done properly should be information-theoretically secure, the next level should be either hyper-encryption using random bits (which is unlikely considering the difficulty in making that crackable and for the fact it's usually used on hardware encryption chips), or some form of Block Cipher (from which if we assume the scale of Levels goes up to 10), can be extended into simple block ciphers with small block size, which analysis seems to indicate it is not, up to triple cascaded ciphers with high block sizes, salts and perhaps even key files to add additional strength.

It is just an assumption, but one using the available evidence, OTR 4.0 is either a 128bit or 256bit block cipher with an unknown mode and key length. I would assume AES or Rjindael as candidates to allow for the most commonly used (also as Off the Record encryption uses AES as its base algorithm, that may be a hint). So to modify the list -

Level 0 - 2 = Non Encrypted or Encoded (similar to private and confidential?)
Level 3 - 4 = OTR 1 - Base 64 or Base 85 encoded
Level 5 - 6 = OTR 2 - Hyper-encrypted (layered) Pen and Paper Ciphers
Level 7 = OTR 3 - Hyper-encrypted (layered) One Time Pad
Level 8 = OTR 4 - 128bit/256bit block cipher (AES or Rjindael or Twofish or Serpent)
Level 9 = OTR 5 - Cascaded Block Ciphers with salt (SHA 512 or Whirlpool etc)
Level 10 = OTR 6 - Cascaded Block Ciphers with salt and possible key file additions (to increase password strength)

For the moment therefore, I will continue to try and analyze the non Hex code and work out the block size, algorithm basis, key length etc.

If it is a block cipher, then algorithm cracking is pointless, and as such key forcing may be necessary.

If I were a betting man, I would say this is a 256bit encryption, probably of the AES or Rjindael cipher algorithm (not that you can tell from the code, but its pretty common) .

The password will probably be hinted at, perhaps in a less than obvious way. We can assume this much as it is almost impossible to analyze a cipher text with only one message and nothing to confirm patterns. Once I've got a rough estimate of what mode/algorithm it uses, I can dedicate some run time to rainbow table attacks on the key. I have a feeling this is a holding puzzle, designed to allow time to construct further aspects of the ARG or work on whatever is behind their NDA.

Recently there was a problem with the computer systems at work, so I may not have access to all the analytical machinery I usually do, it may take a bit longer to get more information, if i find anything interesting I'll let you know. I may have access to some more specialist equipment at a later date, so more progress will likely be made then. I think we can rule out SSH or OTP though."


Latest Message from Storm

 Another thing to note is that we have received another message on the ARG's main Wiki site, in the comments section of the "Tempus omnia revelant" page.  The message is as follows:

"Aug 09
--------------
W### has been p########## well on the L#### O####### L######## Can####, other#### kn### as the T## Cann##. My t##### to the #####etic
induction coil have reduced the likelyhood of overcharge by 200%! I still cannot fathom why the fuse we introduced continues to fail
however, perhaps the leptons have a mi7s6d0976)(&^A)S()F ()A^SF) A()&^  ^)(AS&^ (^6097^)(76)(*"_)"_)(*")(*!")(*!")(!"*)(.................................. ........ .........................................."


It is believed by some that the different symbols may be converted to numbers--the resulting "code" is:

7609760976090906090766097696609760976098202098209812098120912809

It's important to note, however, that this code is probably just produced by random keystrokes. 

My Prediction

Below is something I recently posted on the forums about the ARG, and I currently stand by it:

"I have pretty much concluded at this point that we're dealing with 3DES. The Lucifer cipher is directly connected to DES. Furthermore, we have things happening in groups of threes:

In the image with red writing, the word "lies" is written three times--there may be a fourth, but it looks like something else.

The first "lies" is also underlined three times.

We have three instances of Satan/Lucifer being mentioned:
* Once on the grilledpizza page: "When you're building a cage for Satan, you don't ask him to wait around whilst you put the doors on."
* The picture with the red writing
* Indirect suggestion with the Dante's Inferno references: "Raphèl maí amèche zabí almi"


Other than that, I think it's just a feeling. I found this page randomly tonight: It details how someone solved a hex code for a contest to win tickets. The first round of the code actually mentioned Lucifer, and the gentleman used DES to solve it. His hex code was extremely similar to ours."

Other Possibly Relevant Material

Lastly, here is some other information pulled from the Wiki that may or may not be helpful or even relevant:

Friday, September 27, 2013

Latest Attempt

My latest attempt at cracking the Hex Code was to run it through a binary conversion, then take that result and put that through a decimal converter.  The result is as follows:

179 43 0 58 53 186 221 102 87 124 36 193 79 201 25 6 67 70 209 49 167 197 75 184 47 254 3 224 34 97 87 119 36 121 35 220 33 246 44 212 24 46 145 195 178 103 181 69 171 202 237 175 2 97 81 13 78 234 30 135 205 51 199 199 113 49 48 156 196 40 14 180 36 61 17 84 240 68 249 207 98 150 217 191 247 57 126 67 144 152 127 230 50 3 218 13 228 2 120 179 165 79 93 220 105 117 250 4 247 73 132 158 26 98 89 90 159 99 11 7 149 145 61 224 21 62 58 172 56 140 69 251 157 133 12 254 145 53 65 214 192 131 152 242 200 131 50 168 47 223 0 40 29 98 252 220 79 231 228 106 233 12 81 197 200 6 180 17 100 227 58 185 44 150 134 46 6 139 12 22 192 153 144 184 56 26 0 218 121 21 182 127 228 162 15 89 155 15 27 109 72 25 19 199 185 83 140 238 99 145 68 244 21 97 186 146 228 254 117 29 30 36 44 216 143 81 214 149 81 152 135 19 106 124 21 170 189 123 64 4 73 34 1 65 48 169 31 23 15 102 204 179 193 57 70 58 126 144 154 55 170 134 63 178 120 5 252 151 49 192 156 140 121 6 126 121 147 10 64 101 70 178 76 154 98 155 38 194 206 42 75 228 143 88 154 55 95 235 115 31 196 171 34 92 17 132 140 248 158 41 31 148 113 51 151 12 6 54 24 71 74 137 40 1 237 214 143 84 105 140 94 91 80 103 70 246 118 90 111 127 18 37 222 164 218 17 64 254 182 15 101 7 69 36 28 105 54 149 136 61 203 33 230 251 254 251 184 90 41 145 148 128 54 165 43 93

I then took this result and examined it in a couple of different cipher detection programs--the resulting correlations were extremely high (a few points off a perfect match) for the following ciphers:

Tridigital
Monome Dinome
Morbit
Grandpre

I will continue trying different keys and attempting to bruteforce my way through it, but hopefully this will help others do the same and maybe, just maybe, this will lead to something!