# Secure Protocol

So, there's a secret `msg`, and we are given `salt1, salt2, h` such that:
```
h = sha1(salt1 + msg + salt2})
```

and we are tasked with finding `salt1', salt2', h'` such that:
```
1. salt1 != salt1'
2. salt2 != salt2'
3. h != h'
4. h' = sha1(salt1' + msg + salt2' + s3})
```

Note: We may assume `s3` as a given variable since it only changes every minute.

Let's assume we weren't required to meet condition #1. In that case, we could mount a length extension attack:
- We have a suffix of the original message: `salt2`
- We have the hash value of the message ending in that suffix: `h`
- We are trying to compute hash of an extended string ending with `s3`

And an length extension attack gives us just that. [This SO answer](https://crypto.stackexchange.com/a/3979/4449) does a good job of explaining how the attack works.

But how about the 1st condition `salt1 != salt1'`? A minor yet important detail is that we are not passing value of the salts directly, but rather in `base64`ed encoding. So, we can easily pad the string with a `=` and while our input string will change, the resulting decoded value won't. Hence we bypass the `salt1 != salt1'` check.

Another minor detail: There's a WAF that limits the number of requests you can make during a time interval. But it's not a big deal since you can wait between subsequent requests, and you will find the flag on message length = 64 anyway.

```
Wow, you have it! Flag: S4CTF{HasH_4nd_ba5e64_ok_0k_ok}
```