Description
A ciphertext is provided along with the key CYLAB. Use any Vigenère decoder to recover the plaintext flag.
Setup
Download cipher.txt from the challenge artifacts.
Open the file to view the encrypted string.
Feed the ciphertext into our Vigenère Cipher tool with key CYLAB, or use CyberChef / dCode.
wget https://artifacts.picoctf.net/c/160/cipher.txtcat cipher.txtSolution
Want to try it yourself first?
The guided walkthrough reveals hints one step at a time.
Step 1Identify the cipher
ObservationThe challenge is named Vigenere and the problem hands over a five-letter key. There is no key to recover, only a ciphertext and a key to feed into a standard decoder.The problem statement explicitly names Vigenère. Tools like CyberChef → From Vigenere make decoding trivial.What didn't work first
Tried: Trying frequency analysis to decode the ciphertext before entering the key.
Frequency analysis works on Caesar and other monoalphabetic ciphers, where a plaintext letter always maps to the same ciphertext letter. Vigenere is polyalphabetic: the same letter shifts differently at each position, which flattens the distribution and defeats single-letter analysis. The key is given here, so plug it straight into a decoder.
Tried: Treating the key CYLAB as a numeric shift and applying a single Caesar shift of 5 (the length) or 2 (value of C).
Caesar uses one fixed shift for every letter, while Vigenere applies each key letter as its own shift, cycling through the five values in turn. Apply only the first letter's shift and you partially decode every fifth position and nothing else. Use a decoder that takes the full keyword.
Learn more
The Vigenère cipher is a polyalphabetic substitution cipher that uses a repeating keyword to determine the shift at each position. For a key of length n, position i is shifted by the value of the (i mod n)-th key letter. This means the same plaintext letter produces different ciphertext letters depending on its position - defeating simple frequency analysis.
Vigenère was considered unbreakable for nearly 300 years and was called le chiffre indéchiffrable (the indecipherable cipher). It was finally broken systematically by Charles Babbage (1854) and Friedrich Kasiski (1863). The key insight of Kasiski examination: repeated segments of plaintext (like "the") that happen to align with the same part of the repeating key produce repeated ciphertext, revealing the key length. Once you know the key length, each position becomes an independent Caesar cipher, breakable by frequency analysis.
When the key is provided (as here), decoding is instant: subtract each key letter's value from the corresponding ciphertext letter (modulo 26). Our Vigenère Cipher tool, CyberChef, dCode.fr, and cryptii.com all implement this. The key
CYLABrepeats: C(2), Y(24), L(11), A(0), B(1), C(2), Y(24), ...Step 2Apply the key CYLAB
ObservationThe first seven ciphertext characters mean nothing on their own, but subtracting the key letter by letter across those positions produces picoCTF. The key is right, so a straight Vigenere decode gives the flag.Enter CYLAB as the key and paste your cipher.txt contents as the input (example from one instance:rgnoDVD{O0NU_WQ3_G1G3O3T3_A1AH3S_...}). The trailing hash in the ciphertext and flag varies per instance. The decoder outputs the correct picoCTF flag.What didn't work first
Tried: Entering the key as lowercase 'cylab' instead of uppercase 'CYLAB'.
Most online Vigenere tools treat the key case-insensitively, since only the alphabetical index matters. Some do distinguish case, or accept uppercase only. If the output looks garbled, switch the key to uppercase and confirm the tool is set to decrypt rather than encrypt.
Tried: Looking at the decoded output and not recognizing the flag because non-alphabetic characters like digits and underscores look unchanged.
Vigenere shifts only letters, so digits, underscores, and braces pass through untouched and are already plaintext in the ciphertext you are looking at. The decoded letters fill in around them, and the result is the flag as it stands.
Learn more
The decryption formula for Vigenère is:
plaintext[i] = (ciphertext[i] - key[i mod keylen] + 26) mod 26. Non-alphabetic characters (digits, underscores, braces) are passed through unchanged since the cipher only affects letters. The flag wrapperpicoCTF{...}confirms correctness -rgnoDVDmust decrypt topicoCTF.You can verify this manually for the first letter:
r(17) -C(2) = 15 =p. Second:g(6) -Y(24) + 26 = 8 =i. Third:n(13) -L(11) = 2 =c. And so on. This illustrates why knowing the key makes Vigenère trivial to break.Without the key, breaking Vigenère on short ciphertexts is harder but still feasible. The index of coincidence method estimates key length by testing how "English-like" the ciphertext looks when letters at spacing k are grouped. Once the key length is known, each Caesar sub-cipher is solved independently. Python's
pycipherlibrary and the Dcode.fr Vigenère analyzer automate this entire process.For a worked walk through Kasiski examination, IC scoring, and column-wise frequency attack against an unknown-key Vigenère ciphertext, see the CTF Encodings reference.
Interactive tools
- Vigenère CipherEncrypt or decrypt text with the Vigenère polyalphabetic substitution cipher using a keyword.
Alternate Solution
Since the key (CYLAB) is given, the fastest path is the Vigenère Cipher tool on this site. Paste the ciphertext, enter CYLAB as the key, choose Decrypt, and the flag appears immediately - no terminal needed.
Flag
Reveal flag
picoCTF{D0NT_US3_V1G3N3R3_C1PH3R_...}
The trailing hash (e.g. 2951a89h) is generated per instance and will differ from the value shown for other instances. The human-readable prefix is always D0NT_US3_V1G3N3R3_C1PH3R. Vigenère is not secure - once the key is known, decoding is instantaneous.