6
\$\begingroup\$

In this game of cops and robbers, each cop will make a vault: a program that stores a secret, and requires a key to unlock. The robbers should find a way to get the vault to reveal its secret without knowing the key.

Cop rules

Cops will write two short segments of code:

  • A vault, which takes a key and secret, then allows a robber to guess the key
    • One way to do this would be to use a class, which is constructed with a key and secret, and has a method to enter guesses into
    • The poster should specify a certain set of valid keys and secrets, such as 32 bit integers or strings (note that, unless you add code to prevent it, robbers can still input things that aren't in that set as part of their crack)
    • When a correct guess is made, the vault should return the secret. Otherwise, it should return nothing or a deterministic value that isn't a valid secret
    • Can not rely on cryptographic functions, or any system that can only (realistically) be defeated by brute forcing a value
    • Any code necessary to create an instance of the vault does not count toward the byte count (such as let vault = faulty_vault("key", "secret");
  • A fault, which makes the vault reveal its secret
    • Should work for all keys and secrets
    • Should follow the robber rules

Cop submissions should contain the following information:

  • The name of the language used
  • The byte count
  • The format of the keys and secret
  • The maximum number of guesses needed for the fault (to prevent brute forcing)
  • The code for the vault

Robber rules

Robbers will post their cracking attempts as answers in a separate thread, located here.

  • Should work for all keys and secrets
  • Should require the same number or fewer guesses as the cop's fault, to prevent brute forcing
  • Does not need to be the same as the cop's intended fault
  • Multiple cracks may be made for the same cop, as long as they use different methods

Example

Cop:

Javascript (V8), too many bytes

Maximum 2 guesses.

Keys and secrets may be any string

function faulty_vault(key, secret) {
    return function(guess) {
        if (guess.constructor != String)
            return;

        if (guess == key || typeof(guess) != "string") // Second condition is impossible...right?
            return secret;
    };
}

Robber:

Javascript (V8)

Uses 1 guess

// Assumes vault instance is in variable "vault"

var not_a_string = new String("typeof thinks this isn't a string");
vault(not_a_string);

The winner is the shortest cop not cracked after seven days (safe). Good luck!

\$\endgroup\$
13
  • 1
    \$\begingroup\$ @user Either. You just need to let the robbers know how the vault expects keys and secrets. "all keys are integers, all secrets are strings", "all keys are integers, and all secrets are integers twice the size of the keys", and "all keys will be 4, 5, or 6. all secrets will be 7, 8, or 9, respectively" would all be valid. \$\endgroup\$ Sep 6 '20 at 15:07
  • 3
    \$\begingroup\$ I'm confused by what the intention is with vaults and multiple guesses. Is it just meant to be "Find an input that makes a given function output True"? That is, the vault dispenses the key only if the input passes this test. That's what the example looks like. What might a cop look like that uses multiple guesses, or where the secret itself is used in a meaningful way? \$\endgroup\$
    – xnor
    Sep 6 '20 at 21:12
  • 1
    \$\begingroup\$ Oh, so is the validating function supposed to only check whether the guess equals the key (if not for the fault)? That is, it shouldn't check some more complicated property of the guess or guesses? \$\endgroup\$
    – xnor
    Sep 6 '20 at 21:23
  • 3
    \$\begingroup\$ I don't get how you can possibly write an interesting cop challenge if you allow extracting the key directly. What's to prevent me using runtime reflection, or introspecting /proc/self/mem? \$\endgroup\$
    – Sisyphus
    Sep 6 '20 at 23:32
  • 3
    \$\begingroup\$ When a correct guess is made, the vault should return the secret. Otherwise, it should return nothing or a deterministic value that isn't a valid secret - Does it mean I'm allowed to give a result that depends on the guess when it is wrong, e.g. let the robber play Mastermind? \$\endgroup\$
    – Bubbler
    Sep 7 '20 at 0:05