Third Onion


From the second onion we got a third onion address which dumps the following message via HTTP:

PGP-Signed Message
Hash: SHA1

Standby for coordinates.

Version: GnuPG v1.4.11 (GNU/Linux)


How the coordinates worked

After a while the third onion started to get updated with coordinates from around the world. In everyone of the coordinates there was an A4 paper with a cicada printed to it, a phone number

Example of one of the found A4 papers in one of the coords

and after that two english characters. By decrypting the characters to numbers with the use of gematria (a hint of gematria was found in a past part of the riddle)we used the numbers as access code while calling the phone number of each of the coords.

Each phone number provided us with an offset and a file message followed by the main message. Upon decrypting the message, it would show you an .onion site having something like the following example from Oregon:

Hash: SHA1

ssss, Threshold: 5


Good luck.



The SSSS means Shamir's Secret Sharing Scheme. For those unfamiliar with secret sharing scheme In cryptography, a secret sharing scheme is a method for distributing a secret amongst a group of participants, each of which is allocated a share of the secret. The secret can only be reconstructed when the shares are combined together; individual shares are of no use on their own. More formally, in a secret sharing scheme there is one dealer and n players. The dealer gives a secret to the players, but only when specific conditions are fulfilled. The dealer accomplishes this by giving each player a share in such a way that any group of t (for threshold) or more players can together reconstruct the secret but no group of less than t players can. Such a system is called a (t,n)-threshold scheme.

Drop List

Here is the complete list of the drops and all the possible information found by the participants:

Location Coordinates Image Phone # Access code Message file / offset Message Onion SSSS
Dallas TX 33.092817, -96.08265 +1 205-396-3301 JD: 3789 17, offset 16433 (actually 33461) f6a2d0a48e1b1ae40cbd454f77baa7d2557683d0cd4998 y2wyuvrqraowagc5.onion 02-41cc481a51fe77f91600f593c1db2ce9babd2626ea6e
Okinawa Japan 26.41968, 127.73254 img +1 626-586-1033 YF: 1032 13, offset 37861 f286b8438cb85eb191ec7bf10a28a54ec06f9a27eb91c5 wzwmcwmsk5cb7gjn.onion 03-7678a5f6b72042d839151b34b02ffe161cf997fed484
Moscow, Russia 55.793765, 37.578608 img +1 928-237-3301 CR: 1311 13, offset 1111111 c657b2707c4266fda4af4a83acf19cc46e69540c0bc5da qw7mhchzvuq6f2mf.onion 05-fcd82965b6632ea25d80edc3e58baafb4b2938895cbd
Little Rock, AR 34.7477910, -92.2690863 img +1 719-428-3301 LM: 7167 13, offset 13831 5edb5e8029dd2182560da925ec6cd3e1257efc0b8328b4 4l6uipnstbggwjyv.onion 07-f3adb3aacb0b4336fa28178bc1e5edce940c16ce5caa
Unkown Location. (Possibly Annapolis, MD*) 38.977845, -76.486451 *was not physically recovered +1 253-655-1033 PX: 4347 17, offset 77977 d5a6cb76e55a2166bd6a4d78857ec1f68ea6afa9738 erwfcsdvx6pm2rsk.onion 08-b970e507dbc4ac115a273126f62671654c480fce32e5
Portland, OR 45.50092, -122.652512 +1 424-999-1033 GH: 1723 13, offset 12821 28c07e1b102d4d5c4c1a376e064477e1416fcc94928765 gbyh7znm6c7ezsmr.onion 09-82a98a7fe06014f783b752506cf6cd1fabaa3d8b3750
Columbus, GA 32.478944, -84.983674 img +1 469-251-1033 NR: 2911 17, offset 617 d4b10626d65995e8fb010f4388787d56433f90c6df8d8d ll5afyskb6v6g7ga.onion 10-1668a611ba9fccddee2a0d8fd7e05df4d01c6d42a26davk

Decrypting the SSSS message

In order to get the secret message we needed exactly 5 SSSS parts (given the threshold 5 in the .onion pages). When someone decrypted the message (something that can be done here)  it directed to another .onion page: p7amjopgric7dfdi.onion

*The Bruteforced Number

As you know one drop (Annapolis) was torn down and we didn't get any new onion coordinates. We bravely start to wardial all possible phonenumbers that ends with 1033, and surprisingly found working one. Gods of faith play dirty game so we didn't record first successful code entry and then number went down. Few hours later (01:36 GMT 19.1.2013) phonenumber was back up and we were able to get last needed ssss code.

Previous: From the first puzzles to the first onions

Next: Test page and email submition

Community content is available under CC-BY-SA unless otherwise noted.