Uncovering Cicada Wiki

No New Puzzle for 2015?

As far as we know, Cicada 3301 has not released a new puzzle for 2015. We were expecting a new puzzle to be released in January of this year, but several months passed and we received no official word from Cicada 3301. An official message must be signed with Cicada's PGP signature, otherwise the message could be from anyone. A verifiable PGP signature is the only way to prove that a message is genuinely from Cicada 3301, as they are the only people who can use their own signature. (If this is confusing, read the info pages that explain PGP).

There were a ton of fake Cicada 3301 puzzles this year, probably more than any other year, and a vast number of "solvers" wasted their time and effort on false puzzles with no PGP signature.

However, the 2014 puzzle remains unsolved, as far as we know. Though there have been many claims, no one has proven that the 58 rune pages have been solved. Some believe that this is why Cicada 3301 did not release a new puzzle for 2015; others say that the 2014 puzzle was meant to be the final puzzle, and solving it would give us more info on Cicada 3301 as an organization.

A New Post on Cicada's Twitter Account

Screenshot 2015-11-17 09.35.05

At 10:35 P.M. on the 27th of July 2015, Cicada 3301 broke the silence and posted a Pastebin link to their official Twitter account, @1231507051321:

10:35 PM - 27 Jul 2015 [Direct Link]

This tweet links to a message from Cicada 3301 on Pastebin.

2015 "Planned Parenthood" Pastebin Message (Raw Text)

PGP-Signed Message
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

     
Some news organisations have recently claimed that "3301" is
tied to the illegal activities of a group that has claimed
responsibility for attacks against Planned Parenthood.
   
We do not engage in illegal activities.  We are not associated 
with this group in any way, nor do condone their use of our
name, number, or symbolism.
  
3301
     
       
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJVtw9HAAoJEBgfAeV6NQkPIP0P/3JCIXeJwMERQ2Ofzduoh3Jo
Ll27XoYWQ5Q2OFL//HCn4fVR3qf5bCh8IlapeW3vq2dLTIPMlHf/FPUL9oSWoXN2
3F94PWnGN1GlCvUlNFsUxIxPwR+bP2bzr7dOZry/aWrV4RchjYE26xsZp+Vc5w7T
WAT6zX1SA8fhJH4XmJUKsF+7bnIW8TmzUpuHDcYwMGAgwQPoxibprFwY+juJp8KV
ZJOW76rU3F18KhHLbDrFUNwDkXddI7mkf8Nsux+I/Pz0+vqvdFH15nEuv2MORh5w
nYOg3X3duqQ8LLVxmlIIbMIM5hj8I95QnXxebN1bp6yn92RvHqKU++1MyQ1f4ivW
KFeNWAtuF47DTcoadBDVRFLrtcYWYFkcRj913i7bT+Kt3q3pBtdMlP/CAFaO3WwV
fN7jFhTKQIcVGl9RL44CMFCvL1VVUZzT+4SQxLjwSaSfXKN2NF9zbPoWGfx9dHHF
fFulsVTQbBMHYaJhGTa6lkPHlJgbtf0kYsRnNnQ1Rk6zSzGT6l5fvzMi6ahxro+S
zrPAdjLJK5VXYaI/bVD+qZXTMpa4VbETTUDPgpAKvW6aYzuLld4t4v3EbHlDfNyT
XWyqoo3+/JP6VkeSPMyBP4xIdsEiu9jPd0OSmU6UOFPI2OH5zAjdoZ/rqMzvO5pk
aZ3Wu1GK9nmbAhMQPNi+
=77uq
-----END PGP SIGNATURE-----
Kleogoodpgp

This message has a PGP signature; checking it against the Cicada 3301 PGP key proves that this message is in fact from Cicada 3301. Therefore, this is the first official message that Cicada 3301 has given us in 2015.

This message was posted shortly after a series of cyberattacks against Planned Parenthood were carried out by a group claiming to be Cicada 3301. This message refutes their claim, and states (once again) that Cicada 3301 is not involved in illegal activities. Soon after this message was released, the group admitted that they were not associated with Cicada 3301 in any way.

This message is modified, but is directly copied from another message which Cicada 3301 released in 2012. There are, however, some unusual differences between the two that are worth mentioning.

Note: although this message is from a trusted source (the twitter ran by Cicada 3301), PGP is not capable of verifying the whitespace in the message aside from newlines. PGP messages from untrusted sources may contain modified whitespace but will still produce "Good" verifications.

"Planned Parenthood" Message vs "Necrome" Message

In 2012, Cicada 3301 released a message on Pastebin denying any affiliation with a hacker called "Necrome." The language and form of this message parallels the 2015 "Planned Parenthood" message, but there are several differences in formatting, and the 2015 message contains two minor 'mistakes'. These differences are best seen in a comparison of the raw Pastebin texts for these two messages. The texts are highlighted to better demonstrate the formatting differences:

"Necrome" Message (2012):

Necrome

The 2012 "Necrome" message has paragraphs which are separated by line breaks. Pastebin automatically converts line breaks to a blank character, but the raw text shows that there is technically no character between the paragraphs in this message. In the body of the message, 3301 refer to themselves as "Cicada 3301," and the message is signed "3301."

They use an unusual spelling for "organizations", with an 's' instead of a 'z'. This is a French form commonly used by both the French and British. However, it is more common to French writing as the correct British spelling is technically "-ize".

"Planned Parenthood" Message (2015):

Plannedp

The 2015 "Planned Parenthood" message begins the same way, and uses very similar language. They again use the French "-ise" form for 'organization'. This time, however, 3301 refer to themselves simply as "3301", not "Cicada 3301." On the 7th line of this message, Cicada has omitted/forgotten a 'we': "...nor do [we] condone their use of our name..."

Sequence of Numbered Spaces in "Planned Parenthood" Message:

Interestingly, the lines are separated with more than just line breaks in this new message. There is a set of spaces between each paragraph, with a seemingly random number of space characters, before the line is broken and a new paragraph is started.

On the line before the first paragraph is a set of 5 spaces. Between the first and second paragraph is a line with a set of 3 spaces. The second paragraph is followed by a line with a set of 2 spaces. The next line has has the signature "3301", followed by a line with a set of 5 spaces, and ending on a line with a set of 7 spaces.

From the top down, this sequence spells out 5-3-2-5-7, or 53257. Individually, these digits are all prime. When you consider their placement in the message, the numbers 5-3-2 act as spacers between paragraphs, while 5-7 separates the "3301" signature from the end of the message. So you have the numbers 5-3-2 or 532, "3301", and 5-7 or 57. Remember that the rune pages were numbered 0-57, so this may be significant.

The "message.txt.asc" File From 2014 Rune Pages

Cicada used sets of spaces to represent numbers in a previous message as well, the message.asc.txt file from the unfinished Rune Pages step in 2014 (that link goes to the original file, open it in a text editor like notepad). Most of their other messages and Pastebins are not separated with sets of spaces, but with ordinary line breaks (as in the "Necrome" message.) In the message.txt.asc[pastebin version], the spaces were used to represent the prime sequence with an interesting omission. Here is a raw text version of message.txt.asc with the characters highlighted to show the sets of space characters:

Messagetxtasc

Looking at the image above, we can see that Cicada 3301 used sets of spaces to separate and format this message. This is unnecessary, they could have simply used line breaks. The number of spaces used in each "set" follows the prime sequence, from top to bottom in the message. The number 19, however, is missing from this sequence and nobody could really figure out why it was omitted. Interestingly enough, if 19 were included in this sequence we would have a total of 12 primes. Without it we have 11, which is also a prime.

Below is a comparison of this message to the 2015 "Planned Parenthood" message, which shows these sequences in better detail.

"message.txt.asc" vs "Planned Parenthood" Message

Here are the raw text forms of both messages, if you would like to count the number of spaces yourself:

"message.txt.asc" (2014)

"Planned Parenthood" Message (2015)

For a better visualization of the numbers being represented, I have replaced the space character sets with crosses(+), and include counts for each set:

"message.txt.asc" (Spaces Replaced and Counted):

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello.  Your enlightenment awaits you.++ <----- 2 
+++ <------------------------------------------ 3
+++++ky2khlqdf7qdznac.onion+++++++ <----------- 5, 7
+++++++++++ <---------------------------------- 11
We look forward to hearing from you.
+++++++++++++ <-------------------------------- 13
+++++++++++++++++ <---------------------------- 17
Good luck.+++++++++++++++++++++++ <------------ 23
+++++++++++++++++++++++++++++ <---------------- 29
3301
+++++++++++++++++++++++++++++++ <-------------- 31
+++++++++++++++++++++++++++++++++++++ <-------- 37
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJTO88vAAoJEBgfAeV6NQkPEfsQAI0jGcmBaQr2AGGr1/ic839I
fc58EyVNLgWs6Aox0/Dc2Tj8dXOxc0sBNWY98tICIy2T0Vbpf1VF65nFs+cVcxXI
pXIU5X0O3XKRfxequIZQQUnt4elLIfFAIgrXbE9N7K5qkD47xg4kaYkPQh7/mDBa
NBVHsLkw8bbLUo7lBtv5VFHTeTikSnT3m7FsoSHl5WlsY9WvITO5VcYd48jFbBSS
P9Uk7v7cg1ohWpDB0BiYUTfOVxXYuZpnFiR6vAADP5KkY/qrFF7wrpYbhSmageId
Qcxyc/dajUTlwK7dl+OwAJn4XRPceBPMjW9SbCr33y1C3ijCuxn06penu0KnUyge
yYjyedXg11UPb/B6eT+hwAOPg/DLDTQ57QOQlGOX19lB56iZbHKuglQZUZ5kJq54
dTobWhi6FBtwu+QLnJCz2SASLCuKDIWFkwSoYro/F9Zlo7b0UUO2IOkcKw7tKzq9
uyPtBDQayCSIIHJhVjAtNiVFjNe+TcBf1VppAGY/7jfUfwxJ7Sfbv5Jwll+6MDYr
YdsnJBZjhLuoxFyr9g4TF0OTXmxT+TyAZ4qoItu4C0bcEncBcfLJz+J74X1upsZl
DMq7On1paQAkXvzr6ywDBpMJbDZETkl9gZbzHn1Ji+9f3fANrqU+5kZ1su2OReQf
++CO13gAUF4WohKip4mC
=VAo/
-----END PGP SIGNATURE-----

"Planned Parenthood" Message (Spaces Replaced and Counted):

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

+++++ <--------------------------------------------------------- 5
Some news organisations have recently claimed that "3301" is
tied to the illegal activities of a group that has claimed
responsibility for attacks against Planned Parenthood.
+++ <----------------------------------------------------------- 3
We do not engage in illegal activities.  We are not associated 
with this group in any way, nor do condone their use of our
name, number, or symbolism.
++ <------------------------------------------------------------ 2
3301
+++++ <--------------------------------------------------------- 5
+++++++ <------------------------------------------------------- 7
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJVtw9HAAoJEBgfAeV6NQkPIP0P/3JCIXeJwMERQ2Ofzduoh3Jo
Ll27XoYWQ5Q2OFL//HCn4fVR3qf5bCh8IlapeW3vq2dLTIPMlHf/FPUL9oSWoXN2
3F94PWnGN1GlCvUlNFsUxIxPwR+bP2bzr7dOZry/aWrV4RchjYE26xsZp+Vc5w7T
WAT6zX1SA8fhJH4XmJUKsF+7bnIW8TmzUpuHDcYwMGAgwQPoxibprFwY+juJp8KV
ZJOW76rU3F18KhHLbDrFUNwDkXddI7mkf8Nsux+I/Pz0+vqvdFH15nEuv2MORh5w
nYOg3X3duqQ8LLVxmlIIbMIM5hj8I95QnXxebN1bp6yn92RvHqKU++1MyQ1f4ivW
KFeNWAtuF47DTcoadBDVRFLrtcYWYFkcRj913i7bT+Kt3q3pBtdMlP/CAFaO3WwV
fN7jFhTKQIcVGl9RL44CMFCvL1VVUZzT+4SQxLjwSaSfXKN2NF9zbPoWGfx9dHHF
fFulsVTQbBMHYaJhGTa6lkPHlJgbtf0kYsRnNnQ1Rk6zSzGT6l5fvzMi6ahxro+S
zrPAdjLJK5VXYaI/bVD+qZXTMpa4VbETTUDPgpAKvW6aYzuLld4t4v3EbHlDfNyT
XWyqoo3+/JP6VkeSPMyBP4xIdsEiu9jPd0OSmU6UOFPI2OH5zAjdoZ/rqMzvO5pk
aZ3Wu1GK9nmbAhMQPNi+
=77uq
-----END PGP SIGNATURE-----

Speculation

From here, I can only speculate. The similarity between these messages is surely not a coincidence:

  • The "Planned Parenthood" message is the only official message from Cicada 3301 in 2015. Everyone was expecting a new puzzle in January, and we were met with silence. We had to wait until July to receive the first official communication from them, and it was a PGP-encrypted message which seemingly has nothing to do with the 2014 puzzle or a new puzzle for 2015.
    • This should prove, once and for all, that Cicada has not abandoned their PGP key. Anyone who is trying to solve fake puzzles without a PGP signature to verify is wasting their time. I hate to say I told you so but seriously: I told you so. Go read my Kleopatra tutorial, learn2pgpffs!
  • The "Planned Parenthood" message has a series of space character sets which represent prime digits. The sequence that the spaces represent seems to be: "5-3-2-5-7". This method was used by 3301 to hide a version of the prime sequence in the "message.txt.asc" from 2014; 3301 used sets of space characters to represent the prime sequence from 1-37, but 19 was missing from the sequence.
    • "message.txt.asc" was the last PGP-encrypted message released by Cicada 3301 in 2014. That step (rune pages 0-57) remains unsolved, and 3301 did not release a new puzzle for 2015. The "Planned Parenthood" message is the only message which 3301 has released in 2015. Is the hidden sequence in the "Planned Parenthood" message intended as a hint or clue for "message.txt.asc", or for the rune pages?
      • The "Planned Parenthood" sequence has five prime numbers, "5-3-2-5-7", and the highest digit "7" is the 5th prime in the prime sequence. The "message.txt.asc" would have had 12 prime numbers (37 being the 12th prime in the prime sequence) if Cicada 3301 had included 19 in the sequence. Without it, we have 11 prime numbers in "message.txt.asc", so the amount of prime numbers in both messages is also a prime number (5 and 11).
    • It seems that Cicada 3301 wants everyone to refocus their efforts on the unsolved rune pages (0-57) from the 2014 puzzle.

A prime number

Concatenating the prime sequence found in message.txt.asc, 2, 3, 5, 7, 11, 13, 17, 23, 29, 31, 37 and the sequence found in the "Planned Parenthood" message, 5, 3, 2, 5, 7 gives: 23571113172329313753257 This number is prime.

Adding 19 to the number sequence won't result in a prime number. It is speculated that this might be the reason why this number is missing.

hello hexdump

In 2013, the PGP-signed message obtained from the hexdump returned when the hello command (or equivalent) was entered was:

PGP-Signed Message
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

     
Very good.
   
You have done well to come this far.
  
xsxnaksict6egxkq.onion
  
Good luck.
   
3301
     
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJQ6S0HAAoJEBgfAeV6NQkP/J0QALDqa3VJy9xLLlgI5jPhRIp4
fxebbNhtELOHYFkD5Z9ztQYGle7lKPM8lkMSnciIY059KIi5NSTV7I97sJboG3wt
khHtZgNRw1v2WQ5uurCu5l1w+84/L5Jz2NmElxOBzWr68dlQYt2qfBQxk2zR/fTI
TLCEGvFZtlnrNfBk7jsIyJYcXXPgabS47oP9vOEXlB1+Pm0C7uPPBPN7aqkfUPGl
o1f2hscJf7Je2DvbZt+6exxYsm57Fp953XANAd/UpFVzT/852Xg63gtZrI+Smf3Z
BVcjpCzyH3wS8R0iM+rp02CwJpJzsWGLxeQGmXL2SXBB43zVZAJql5UdXLTGXkbd
nPMd3/CbJ+l7rO0YAg5p3Jf4KauX7Zd6Zc2wHKLOvfjQvEWXIY1CMhI68Bj0rZo/
M/fi313FFTPAm6xhKRv/tH/8wVrar2jY7wnE8XxhRsy74AZ5GqA2oHMefTAq3YuW
5PX8s682J4pkDUKHGa4y65vjIp16pmEInMALJGbwz6mtauBQqlS6ARsQfekDn3oZ
yosS+gWC3jdIvH5s5WUQGVl7jyz9t4+3Tg5cT9Rn6pX2NVNXSxgzXXB4nI2XrrYa
4kQr5aWB8lssav3ryj5Cg2FHl1+MKO0gYv/UF3QT75MixQMu4M+5wCnNekgfuyO6
Zvybzp4s4SzRjkk9sMM6
=WYVO
-----END PGP SIGNATURE-----


It contains the prime sequence 5-3-2-2-3-5:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

+++++
Very good.
+++
You have done well to come this far.
++
xsxnaksict6egxkq.onion
++
Good luck.
+++
3301
+++++
-----BEGIN PGP SIGNATURE-----

hint hexdump

A PGP-signed message could be obtained from the hexdump returned by the hint command of the telnet prompt:

PGP-Signed Message
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

  
   
You can't see the forest when you're looking at the trees.
     
Good luck.
   
3301
  
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJQ6SnrAAoJEBgfAeV6NQkP8k0P/21iHNB+ON8i8VkPbepPap6A
HIFPqGPMBZTYeuteVmHRgi+HhXPXypkWKyDM23oXbit6xXxSfK/h/FtQSPz3TS/R
i580OvFRIzRiLcs+AhMQano/JD+zp8vwtI/V6ZYedrf6Kfv0w/VOb4NW1bIv3mrU
Z12ORUrbsfzgKZMUGx6hTaTdc7ZcAAmWkFOtwsYBXVfwe1bmEE5BfnkdehyKTEuu
2WIAZluHd/J0kbngwYqMt6JHk17of6ewpoNHzVcAnA6IA5uB0n2P/6uJ8bFneMoH
ybyw7iSBEu3ixg0xaXCpWghr34jGc66HCSz6RKA6dwiN+CFoS8lEwMg94BjGc2MT
FZ8tOopB8Qg2+RpA2KegItZxBpWGMXBKqZM1+mRuVZU30BxhidmHN39wRlQ2Tu4V
n6RqAIOZhNctb6Kujx+1ujGkN90x9xHmhL8ik2FIrYRylX2a8PtmkgajO3y1fP0X
NKAPNimClJb/NZED7Wcjv2h7OBNyKdk7D1xjSXd3d7euxoENr4edetcQ8npVLEow
RJbJhznxeu5D/qNU6lse6y39EPFrpFDoMbpds7e7WvKcHeSorzcQGkRtYigoMsX3
KmQPKiiQYvinfBbu9qHR6FXmyIPfio4ncgxSV23mt11zYwJh/IBXkdVBnZIP6aZs
SEKC3iyNQLA8bppBZ+kk
=6gnK
-----END PGP SIGNATURE-----


It contains the prime sequence 2-3-5-3-2:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

++
+++
You can't see the forest when you're looking at the trees.
+++++
Good luck.
+++
3301
++
-----BEGIN PGP SIGNATURE-----