Uncovering Cicada Wiki
Register
Advertisement


The Start[]

On January 4th, users browsing 4chan's /x/ board were greeted with a mysterious image, unlike much else really seen on that board. It displayed the following message in simple, white-on-black font:

Final

final.jpg

There was almost nobody browsing /x/ at that time who didn't notice it. Many initially thought it was another ARG, some thought it was an NSA recruitment program, and to this day few know where the rabbit hole leads to, and those that do have disappeared from the internet and have not told anybody else any more than they fear to let on.


There is a message hidden in this image

Solvers were quick to try different methods to find it. A common use was to initially open the image file into a text editing application, which allows users to read a dump of the bytes in the image. An unusual text was appended at the end of the file:

TIBERIVS CLAVDIVS CAESAR says "lxxt>33m2mqkyv2gsq3q=w]O2ntk"

This was quickly found to be a Caesar cipher because of the repeated characters, hence the reference. Once deciphered, it read: https://i.imgur.com/m9sYK.jpg

Decrypting this cipher and following the URL led to the discovery of the following image file:

Decoy

m9sYK.jpg from the Caesar cipher, a hint to use outguess on final.jpg

This was a difficult clue to follow, but solvers soon realized that it meant that the program OutGuess had to be used (hence the words guess and out).

In its simplest form, OutGuess is a steganography program designed to hide messages within images. More on OutGuess can be found at its very own wiki page.




The Message[]

Opening final.jpg in OutGuess led to the following message (concatenated to fit better formatting. The original text can be found here):

Here is a book code.  To find the book, and more information, go to http://www.reddit.com/r/a2e7j6ic78h0j/

1:20, 2:3, 3:5, 4:20, 5:5, 6:53, 7:1, 8:8, 9:2, 10:4, 11:8, 12:4, 13:13, 14:4, 15:8, 16:4, 17:5, 18:14, 19:7, 20:31, 21:12, 22:36, 23:2, 24:3, 25:5, 26:65, 27:5, 28:1, 29:2, 30:18, 31:32, 32:10, 33:3, 34:25, 35:10, 36:7, 37:20, 38:10, 39:32, 40:4, 41:40, 42:11, 43:9, 44:13, 45:6, 46:3, 47:5, 48:43, 49:17, 50:13, 51:4, 52:2, 53:18, 54:4, 55:6, 56:4, 57:24, 58:64, 59:5, 60:37, 61:60, 62:12, 63:6, 64:8, 65:5, 66:18, 67:45, 68:10, 69:2, 70:17, 71:9, 72:20, 73:2, 74:34, 75:13, 76:21

Good luck.

3301

The subreddit in question can be found here.

The Subreddit Code[]

The subreddit contained several text posts and two images, Welcome and Problems? [1]. While the Problems? post was created by the user Reddit u/ImagoOnNib, all others posts were created by u/CageThrottleUs. [2] [3]

At first, only a handful of posts and the "Welcome" image were available. As time when on, more posts regularly appeared and the "Problems?" image was posted. For more information, check out our interactive timeline.

Welcome
Problems?

Welcome

Problems?

Welcome
Problems?


Note : Years later, several deleted posts and another deleted account were found using Reddit's developer portal [4].

Cryptographic signatures[]

Each image contained an OutGuess message. Welcome's was this:

PGP-Signed Message
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- From here on out, we will cryptographically sign all messages with this key.

It is available on the mit keyservers.  Key ID 7A35090F, as posted in a2e7j6ic78h0j.

Patience is a virtue.

Good luck.

3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJPBRz7AAoJEBgfAeV6NQkP1UIQALFcO8DyZkecTK5pAIcGez7k
ewjGBoCfjfO2NlRROuQm5CteXiH3Te5G+5ebsdRmGWVcah8QzN4UjxpKcTQRPB9e
/ehVI5BiBJq8GlOnaSRZpzsYobwKH6Jy6haAr3kPFK1lOXXyHSiNnQbydGw9BFRI
fSr//DY86BUILE8sGJR6FA8Vzjiifcv6mmXkk3ICrT8z0qY7m/wFOYjgiSohvYpg
x5biG6TBwxfmXQOaITdO5rO8+4mtLnP//qN7E9zjTYj4Z4gBhdf6hPSuOqjh1s+6
/C6IehRChpx8gwpdhIlNf1coz/ZiggPiqdj75Tyqg88lEr66fVVB2d7PGObSyYSp
HJl8llrt8Gnk1UaZUS6/eCjnBniV/BLfZPVD2VFKH2Vvvty8sL+S8hCxsuLCjydh
skpshcjMVV9xPIEYzwSEaqBq0ZMdNFEPxJzC0XISlWSfxROm85r3NYvbrx9lwVbP
mUpLKFn8ZcMbf7UX18frgOtujmqqUvDQ2dQhmCUywPdtsKHFLc1xIqdrnRWUS3CD
eejUzGYDB5lSflujTjLPgGvtlCBW5ap00cfIHUZPOzmJWoEzgFgdNc9iIkcUUlke
e2WbYwCCuwSlLsdQRMA//PJN+a1h2ZMSzzMbZsr/YXQDUWvEaYI8MckmXEkZmDoA
RL0xkbHEFVGBmoMPVzeC
=fRcg
-----END PGP SIGNATURE-----

It is signed with a PGP signature, a secure method of ensuring that a message originates from a confirmed sender. You can learn more about PGP over at its wiki page.

You can download 3301's PGP key straight from the MIT Keyserver (remember to always check the signature and data against the one available from MIT). Note: in case the MIT server is down, you can download 3301's key here

King Arthur references[]

The message embedded in 'Problems?' is:

PGP-Signed Message
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

The key has always been right in front of your eyes.

This isn't the quest for the Holy Grail.  Stop making 
it more difficult than it is. 

Good luck.

3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJPCBl3AAoJEBgfAeV6NQkPo6EQAKghp7ZKYxmsYM96iNQu5GZV
fbjUHsEL164ZLctGkgZx2H1HyYFEc6FGvcfzqs43vV/IzN4mK0SMy2qFPfjuG2JJ
tv3x2QfHMM3M2+dwX30bUD12UorMZNrLo8HjTpanYD9hL8WglbSIBJhnLE5CPlUS
BZRSx0yh1U+wbnlTQBxQI0xLkPIz+xCMBwSKl5BaCb006z43/HJt7NwynqWXJmVV
KScmkpFC3ISEBcYKhHHWv1IPQnFqMdW4dExXdRqWuwCshXpGXwDoOXfKVp5NW7Ix
9kCyfC7XC4iWXymGgd+/h4ccFFVm+WWOczOq/zeME+0vJhJqvj+fN2MZtvckpZbc
CMfLjn1z4w4d7mkbEpVjgVIU8/+KClNFPSf4asqjBKdrcCEMAl80vZorElG6OVIH
aLV4XwqiSu0LEF1ESCqbxkEmqp7U7CHl2VW6qv0h0Gxy+/UT0W1NoLJTzLBFiOzy
QIqqpgVg0dAFs74SlIf3oUTxt6IUpQX5+uo8kszMHTJQRP7K22/A3cc/VS/2Ydg4
o6OfN54Wcq+8IMZxEx+vxtmRJCUROVpHTTQ5unmyG9zQATxn8byD9Us070FAg6/v
jGjo1VVUxn6HX9HKxdx4wYGMP5grmD8k4jQdF1Z7GtbcqzDsxP65XCaOYmray1Jy
FG5OlgFyOflmjBXHsNad
=SqLP
-----END PGP SIGNATURE-----

As expected, it is PGP-signed.

The image depicts a repeating pattern of an "King Arthur" tapestry. Furthermore, trained eyes can see a cup hidden with a autostereogram - given the Arthurian context, it represents the Holy Grail.

Problems?
The Holy Grail
The tapestry

Problems?

The Holy Grail

The tapestry

Problems?
The Holy Grail
The tapestry


Solving the code[]

Mayans numerals

The subreddit header image

On the subreddit header image, a sequence Mayan numerals can be read. Their Arabic counterparts are: 10 2 14 7 19 6 18 12 7 8 17 0 19

Solvers noticed that the subreddit title, a2e7j6ic78h0j, could be converted to the above sequence by replacing each letter with their position in the alphabet starting with A as 10. Numbers could simply by left as is.

0 -> 0
1 -> 1
...
8 -> 8
9 -> 9
a -> 10
b -> 11
...

The subreddit description contained a 23 characters string starting with its name:

a2e7j6ic78h0j7eiejd0120 Verify: 7A35090F

Continuing the conversion process with this new string gave the following sequence:

10, 2, 14, 7, 19, 6, 18, 12, 7, 8, 17, 0, 19, 7, 14, 18, 14, 19, 13, 0, 1, 2, 0

Finally, this sequence can be transformed into a character string by taking the associated letters, starting with A = 0:

kcohtgsmhirathosotnabca

This was found to be the key 'Problems?' mentioned. To decrypt the different text posts, solvers used it as the key of a Vigenère cipher. In short, each letter of the ciphertext should be shifted in the alphabet by an amount of places given by the corresponding value in the key. Characters other than letters (spaces, commas, quotes...) should be left untouched. The shift key is repeated until the end of the line and reset at the start of each new post.

The decrypted text reads: (full text)

King Arthur was at Caerlleon upon Usk; and one day he sat in his
chamber; and with him were Owain the son of Urien, and Kynon the son
of Clydno, and Kai the son of Kyner; and Gwenhwyvar and her
handmaidens at needlework by the window.  And if it should be said
that there was a porter at Arthur's palace, there was none.  Glewlwyd
Gavaelvawr was there, acting as porter, to welcome guests and 
strangers, and to receive them with honour, and to inform them of the
manners and customs of the Court; and to direct those who came to the
[...]

The text is from The Mabinogion, "The lady of the fountain". The Mabinogion was first fully translated from Welsh into English by Lady Charlotte Guest. 3301's Reddit usernames are anagrams of "Mabinogion" ("ImagoOnNib") and "Charlotte Guest" ("CageThrottleUs").

Later, it was found the key was derived from the King Arthur text: it corresponds to the sequence of first letters of the decrypted text.

The Phone Number[]

Having retrieved the source text, the book code mentioned in the OutGuessed message of the initial image could be applied. In a book code, each letter is encoded with two numbers: a line number and a character index in the line. Applying the book code to the text with the full stops removed gave the following string of text:

Call us at us tele phone numBer two one four three nine oh nine six oh eight

This was a telephone number, specifically (214) 390-9608. This number has since deactivated. Calling this number gave the following message:

Voice_On_Phone_(2012)

Voice On Phone (2012)

Very good. You have done well.
There are three prime numbers associated with the original final.jpg image.
3301 is one of them. You will have to find the other two.
Multiply all three of these numbers together and add a .com to find the next step.
Good luck. Goodbye.

The original image had the dimensions of 509 by 503 pixels, both of which are prime numbers. These were multiplied with 3301 to get 845145127, which gave us http://845145127.com. Note that 845145127 is also in brackets in the PGP key's name.

An archive of the page can be found here: https://cicada-solvers.github.io/845145127.com/countdown_reenactment/[5]

The Website[]

Going to this website led to an image of a cicada and a countdown.

845145127

The countdown set to expire on January 9, 2012 at 5:00 PM

Using OutGuess on the image produced the following message:

PGP-Signed Message
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 
You have done well to come this far.
 
Patience is a virtue.
 
Check back at 17:00 on Monday, 9 January 2012 UTC.
 
3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
 
iQIcBAEBAgAGBQJPCKDUAAoJEBgfAeV6NQkPf9kP/19tbTFEy+ol/vaSJ97A549+
E713DyFAuxJMh2AY2y5ksiqDRJdACBdvVNJqlaKHKTfihiYW75VHb+RuAbMhM2nN
C78eh+xd6c4UCwpQ9vSU4i1Jzn6+T74pMKkhyssaHhQWfPs8K7eKQxOJzSjpDFCS
FG7oHx6doPEk/xgLaJRCt/IJjNCZ9l2kYinmOm7c0QdRqJ+VbV7Px41tP1dITQIH
/+JnETExUzWbE9fMf/eJl/zACF+gYii7d9ZdU8RHGi14jA2pRjc7SQArwqJOIyKQ
IFrW7zuicCYYT/GDmVSyILM03VXkNyAMBhG90edm17sxliyS0pA06MeOCjhDGUIw
QzBwsSZQJUsMJcXEUOpHPWrduP/zN5qHp/uUNNGj3vxLrnB+wcjhF8ZOiDF6zk7+
ZVkdjk8dAYQr62EsEpfxMT2dv5bJ0YBaQGZHyjTEYnkiukZiDfExQZM2/uqhYOj3
yK0J+kJNt7QvZQM2enMV7jbaLTfU3VZGqJ6TSPqsfeiuGyxtlGLgJvd6kmiZkBB8
Jj0Rgx/h9Tc4m9xnVQanaPqbGQN4vZF3kOp/jAN5YjsRfCDb7iGvuEcFh4oRgpaB
3D2/+Qo9i3+CdAq1LMeM4WgCcYj2K5mtL0QhpNoeJ/s0KzwnXA+mxBKoZ0S8dUX/
ZXCkbOLoMWCUfqBn8QkQ
=zn1y
-----END PGP SIGNATURE-----

When the announced time finally came, the website changed.

The Global QR Codes[]

The updated website gave a list of coordinates, with seemingly the same cicada image.
Archive: https://cicada-solvers.github.io/845145127.com/coordinates/

845145127

However, applying OutGuess on the cicada image produced a different message, containing coordinates. They were the same as what could be found on 845145127.com except for two missing coordinates.

PGP-Signed Message
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

52.216802, 21.018334  
48.85057059876962, 2.406892329454422 
48.85030144151387,2.407538741827011  
47.664196,  -122.313301 
47.637520, -122.346277 
47.622993, -122.312576 
37.5196666666667, 126.995 
33.966808, -117.650488 
29.909098706850486 -89.99312818050384 
25.684702, -80.441289 
21.584069, -158.104211 
- -33.90281, 151.18421 
3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJPChn7AAoJEBgfAeV6NQkPZxMP/05D9TkSpwRaBXPqYthuyqxx
uo+ZDyr/yVIlAdurTBiWb3aGxKJjtWg/vlcHcatK0TGL2qaHwB/FFZQAaqOyU7Zf
DXdpWr8PWoWhpWNYUK8IrOaYu1SmWlJnkTdUSzGrX0lbwjwMmJJoPNS7CJuO6MaA
2GIwpv2G7lYqnH3xeX3kzGlPMsVb/wucKRjobsbdbreh1SNuQuRnhfe4s+oHTTqs
XjtGL/VhBI0DUAdfLqW7z4C+Gvbx6okC8x5Sj2N2UTJOiyMYXz5+QyHoA6fo9g5V
6zodNpx/RvxuZP2Ssc9TqERgTo5FjRBpON1vjDalHgg0H2Fus2LK3gh+NZfj1i5b
Oqa4Cqd9epI2pe+glXn86j9crS+2BEAr1cguqAFepvI9sdFEornDja4VXwDtUdM8
9hMVkU5NiTUYfvxZbL6W7rHIF7wxjGUwpe1ViuixG+cKNfv0enrt60PrtDByBOWI
9LLIUE0cB5HDT1xrczZ/55CtuM3Zf07/l0nLFdmgR0oa8KUA9gWcPs6S1EpBa185
VcyOTqbpIPiT8neiJEkXarbJeFk15m1P73Fr8XZxdj7EHK0aOwGYcc8e4PmW/dSh
gcrSNXiePCbcRVRD2n9L47C0LkNyRpoBkmjvtpcRyp5ISe+0xcx/QI+gc1lkSijC
89qV+ymCHae1RiSDxVbd
=ZJ37
-----END PGP SIGNATURE-----


These locations were scattered across the globe, compelling solvers to collaborate. At each of these coordinates, a sheet of paper could be found stuck — in most cases — to a telegraph pole. All posters retrieved had a QR code and an image of a cicada. This was the first appearance of the puzzle logo.

<
>

Miami, US
Other pictures: 1, 2

Seoul, South Korea

Seattle, US

Paris, France

Seoul, South Korea

Seoul, South Korea

Warsaw, Poland


At this point the community realized 3301 could potentially be a global organization of some very talented people, not just a single skilled 4chan user.

The Posters Book Codes[]

Each QR code contained a URL to an JPEG image on 845145127.com, named by 12 digits. For instance, the QR code found in Paris linked to: http://845145127.com/427566844663.jpg. Each image had an overexposed white cicada logo on a black background, along with the text "everywhere" and the group name.

Using Outguess revealed that one PGP-signed message was embedded in them. Two kinds of messages were found:

PGP-Signed Message
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 
In twenty-nine volumes, knowledge was once contained.
How many lines of the code remained when the Mabinogion paused?
Go that far in from the beginning and find my first name.
 
1:29
6:46
the product of the first two primes
2:37
14:41
17:3
27:40
the first prime
2:33
1:1
7:45
17:29
21:31
12:17
the product of the first two primes
22:42
15:18
24:33
27:46
12:29
25:66
7:47
 
You've shared too much to this point.  We want the best,  
not the followers.  Thus, the first few there will receive
the prize.
 
Good luck.
 
3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
 
iQIcBAEBAgAGBQJPB1luAAoJEBgfAeV6NQkP9oAP+gLu+FsRDf3aRcJtBkCOU2MX
r/dagOTvCKWtuV+fedy0enWUZ+CbUjXOr98m9eq2z4iEGqKd3/MBXa+DM9f6YGUE
jPum4wHtQDSJlZMazuYqJOVZGw5XmF25+9mRM6fe3H9RCiNDZpuXl3MzwdivYhcG
B5hW14PcdHHteQf3eAUz+p+s06RDs+q1sNGa/rMQIx9QRe71EJwLMMkMfs81kfJC
tCt21+8ud0Xup4tjUBwul7QCcH9bqKG7cnR1XWsDgdFP6a4x9Jl2/IUvp1cfeT7B
YLS9W3lCM8thMemJr+ztQPZrpDlaLIitAT2L0B3f/k4co89v5X2I/toY8Z3Cdvoi
hk0AdWzMy/XLDgkPnpEef/aFmnls53mqqe9xKAUQPMrI73hiJ+5UZWuJdzCpvt+F
BjfQk15EJoUUW16K2+mBA1cSd+HJlnkslUTsjkq0E36XKChP+Cvbu/p6DLUMM2Xl
+n3iospCkkHR9QDcHzE4Rxg9A435yHqqJ/sL2MXG/CY8X4ec6U0/+UCIF9spuv8Y
7w66D05pI2u9M/081L7Br0i0Mpdf9fDblO/6GksskccaPkMQ3MRtsL+p9o6Dnbir
6Z2wH2Kw1Bf0Gfx4VcpHBikoWJ5blCc6tfvT+qXjVOZjWAL7DvReavSEmW1/fubN
C3RWcjeI4QET2oKmV2NK
=LWeJ
-----END PGP SIGNATURE-----

and

PGP-Signed Message
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 
A poem of fading death, named for a king
Meant to be read only once and vanish
Alas, it could not remain unseen.
 
1:5
152:24
the product of the first two primes
14:13
7:36
12:10
7:16
24:3
271:22
10:7
13:28
12:7
86:17
93:14
the product of the first two primes
16:7
96:4
19:13
47:2
71:22
75:9
77:4
 
You've shared too much to this point.  We want the best,  
not the followers.  Thus, the first few there will receive
the prize.
 
Good luck.
 
3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
 
iQIcBAEBAgAGBQJPB/nmAAoJEBgfAeV6NQkPEnEQAKl5qtb3ZE5vs+c08KuzAi4a
tQEE71fvb65KQcX+PP5nHKGoLd0sQrZJw1c4VpMEgg9V27LSFQQ+3jSSyan7aIIg
SDqhmuAcliKwf5ELvHM3TQdyNb/OnL3R6UvavhfqdQwBXCDC9F0lwrPBu52MJqkA
ns93Q3zxec7kTrwKE6Gs3TDzjlu39YklwqzYcUSEusVzD07OVzhIEimsOVY+mW/C
X87vgXSlkQ69uN1XAZYp2ps8zl4LxoaBl5aVtIOA+T8ap439tTBToov19nOerusB
6VHS192m5NotfQLnuVT4EITfloTWYD6X7RfqspGt1ftb1q6Ub8Wt6qCIo6eqb9xm
q2uVzbRWu05b0izAXkHuqkHWV3vwuSfK7cZQryYA7pUnakhlpCHo3sjIkh1FPfDc
xRjWfnou7TevkmDqkfSxwHwP5IKo3r5KB87c7i0/tOPuQTqWRwCwcWOWMNOS7ivY
KQkoEYNmqD2Yz3Esymjt46M3rAuazxk/gGYUmgHImgcu1zzK7Aq/IozXI7EFdNdu
3EoRJ/UL9Y0l0/PJOG5urdeeTyE0b8bwgfC2Nk/c8ebaTkFbOnzXdAvKHB03KEeU
PtM6d6DngL/LnUPFhmSW7K0REMKv62h9KyP/sw5QHTNh7Pz+C63OO3BsFw+ZBdXL
hGqP6XptyZBsKvz2TLoX
=aXFt
-----END PGP SIGNATURE-----

Solvers knew these were book codes along with a description of the book needed. A warning about too much collaboration was also included, saying that only the first few, or the active few, that make it to the end will receive entry.

Agrippa[]

A poem of fading death, named for a king
Meant to be read only once and vanish
Alas, it could not remain unseen.

By typing in keywords from its description, solvers were led to the poem Agrippa. Applying the book code (and interpreting literally the product of the first two primes) produced:

sq6wmgv2zcsrix6t.onion

This was the address of a hidden service on the Tor network, a anonymity-oriented communication network. Visiting this page with an adequate browser, solvers found the following message along with an email form:

Sq6wmgv2zcsrix6t

sq6wmgv2zcsrix6t.onion (source code prior to submission)

PGP-Signed Message
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Congratulations!

Please create a new email address with a public, free, web-based service.  
Once you've never used before, and enter it below.  We recommend you do 
this while still using Tor, for anonymity. 

We will email you a number in the next few days (in the order in which 
you've arrived to this page).  Once you've received it, come back to this 
site and append a slash and then the number you received to this url.  
(For example, if you received "3894894230934209", then you would go to 
"http://sq6wmgv2zcsrix6t.onion/3894894230934209")

3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJPCikYAAoJEBgfAeV6NQkPtCkQAIEa2HC20SduG8zWtH/0LSJ9
dnQLfjTI/MAPsnp0KXpzcQJ4p2UbNdRb5qtqp3HZQ5qwKK3b/MT+2eB5X+h5q5v/
bVOsPKXN7W+krTi8a2v5KA1fRj8mKcFTXkx9hdq6z6qeePVpeOGXeitU0jgO4uXu
1N9hor4AQFQoXvuELnlqS4YX+/nNgK+Y1Vu1ekvyn9LusidMpSxS/ciiZLD5d3Tl
TJeUOQzdw9TlUmmdeigfBRoqZDnm5UESnS8qS1vd7zg9Ulpw2GfCV8QQl0zWp0lS
KCrArG0Qg4K4shZRQ2BopGM95oFVw2pOnzYr9pp8kpipBWQ6URRF7IEcuG1k5fBt
sfiz7Eb7WWr4Cwk/1Ri625FMyo0Z2KDc1Wo8nkFXZ0/Xle6tyyhhJUZGRbZuHLau
LR5+oQEKKYTRrJFNhqswcXYsCQBBYM2XS+v3nbmTDVKyGNmMpp3/yC/RR91hQ7fr
FqMd5qHKSD0pc5tU5G29J+Ez3CDVN7E60Xy3I1I5ugGE8GP5DmqHn4k/x272lroX
BtiIRTh4f+ghcC6DLdPBclPRAfLtRbpVR3GVTSCJ/EwBZrH4QJTEGcuXfPQryHbF
0BO795yyXxM6lQ9QnU4dkAAQepKLHgcvDlrEJYJzMWo+BOCu7MChoOyo1Zq4eeuI
cPx04KJd4sGtMVWolA3/
=zGQW
-----END PGP SIGNATURE-----


After submitting an email address, a message told solvers to patiently wait: "Got it, thanks. We'll contact you soon."

Encyclopædia Britannica[]

In twenty-nine volumes, knowledge was once contained.
How many lines of the code remained when the Mabinogion paused?
Go that far in from the beginning and find my first name.

Back in 2012, it is unclear whether some solvers knew how to solve this book code. If some did, nothing was properly documented and a most of the community wasn't aware of it [6] [7]. Still, they thought the description given referred to the "Encyclopædia Britannica", 11th Edition[8].

On 6th January 2012, no posts were made to the r/a2e7j6ic78h0j subreddit for about 24 hours. After this period, encrypted text lines have been once again posted about every 6th or 7th hour.

A2e7j6ic78h0j pause

A chronological view of the 24 hours pause - Interactive version

Before this pause, 76 lines of ciphertext have been posted. The Mabinogion book code used the first 65 lines, in sequence:

[...] 
68:10
69:2
70:17
71:9
72:20
73:2
74:34
75:13
76:21

So, when the Mabinogion paused, 11 lines of the code couldn't yet be resolved and remained. This hinted solvers to use the 11th Edition of the Encyclopædia Brittanica.

"my first name" referred to the word "cicada". When applied to the "Cicada" article of the encyclopedia, the book code revealed another onion address. However, the formatting from the "Project Gutenberg" transcript had to be used and the first line had to be skipped (equivalent to using a 0-based numbering).

eq6emgv2ehsrix6t.onion


Note: this is the only instance where 3301 referred to themselves as "Cicada".

Unfortunately, this hidden service is long gone. It is thought to have hosted a similar email form as could be found the Agrippa onion address. Again, whether it was accessed by someone in 2012 is unclear. The rest of this wiki page will thus refer to the Agrippa onion address.

The RSA Emails[]

Those who applied early enough were greeted with an email giving them a number. Following 3301's instructions, they went to "sq6wmgv2zcsrix6t.onion/NUMBER". A similar message to this one appeared:

PGP-Signed Message
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 
This message will only be displayed once.
 
Here is a message that has been encrypted with RSA (the Crypt::RSA Perl module available in CPAN) :
 
- -----BEGIN COMPRESSED RSA ENCRYPTED MESSAGE-----
Version: 1.99
Scheme: Crypt::RSA::ES::OAEP
 
eJwBzQAy/zEwADE4OABDeXBoZXJ0ZXh0Ca4y//uzl/HvFoP9Klf53nEFH0T4c+ui5de8+vqGOnZc
9DlrsWQe+xxVaPaYgKAD9Wn9VWQ6A5o254r5pa4hkDIY5RRmVfqOm88HJpGdbGGTckyEwJapCLDT
tHzZWAZ0FIVj6fH2whErHoVmZ82zQJ64OLtzr1gYk+2kIZuqtLclV9RDhs6j7meTaod2BDrF26tY
d33awv0txxrgXRhd/FDFVtKb0K84cQs2xtO/9A0yLs5GEK2xpG2yM4AeWWft
=I1r6Wtzf/29vTggAK+ELEA==
- -----END COMPRESSED RSA ENCRYPTED MESSAGE-----
 
 
Here is the public key used to encrypt it. Note that it has a low bit modulus and is therefore breakable:
 
$VAR1 = bless( {
                 'e' => 65537,
                 'n' => '7880891639791153779530258464649693928733411681581577103690292822333198036864739065916344030512697162068582555837',
                 'Version' => '1.99',
                 'Identity' => '<quaetrix0@gmail.com>'
               }, 'Crypt::RSA::Key::Public' );
 
 
The encrypted message is a number.  Break the decryption key, then come back to this same URL and enter the 
decrypted message to continue.  Each person who has come this far has received a unique message encrypted 
with a unique key.  You are not to collaborate.  Sharing your message or key will result in not receiving 
the next step.
 
There is a second chance to get your own RSA message and key.  Follow the "Numbers dot TK" hint to find it.
 
There are many fake messages out there.  Only messages signed with public key ID 7A35090F are valid.  
 
Good luck.
 
3301 
 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
 
iQIcBAEBAgAGBQJPEi5eAAoJEBgfAeV6NQkPuiMP/27jZQ7t27p8cg8R8//Cj4Sf
RWVF09jFYtAZ9S38atQy2bFlkBYRejQu49iZa2mGp2ITa2zfsbI3NviOeY3XJXRy
9zxzNIF6IkPm6dCwRARTsXGYz4/9I6AgyLT6OyT1ltzys+c2kccGJ+2XXo9VNpA5
D8EoWRWAaiIJhF9ezLK/j2ImaDJnQ/y2PnjVm+QE4ywivp6arSoAbxwOga6TIef4
uwjw9PKMkHR+9nJOvKSkG9S9FKxMhSo9r0jr7AVLmls8Q30t2fJ6wDNI+ygWBljo
JIvu+Av6ACmhktO6XMW3xNe2TG3W7WnhrmERm+DgzOWkfCRa2lAd42CPiwTgVI5x
1tIPowTpW0HvZlqT2/wxKmSEs994MJkPzHI+82GkXxv3FbWms/ztdBuMcv7+sUbT
IS2549fOw51S2zLvZ1RoSaKIQGZd9ycGMOPQs8etxgOWtK34tOdZlntpDQHyTDqj
NX+0/Aer7pFmtVE92iYBLlDIHH9xZnNkN6ZZSC+oXl9SP6ivs535qyYDTuM/IfFc
6zNlhuVOqosIbRp51EhWLG0vhOtNDMUTaPaQk7t5dnm6SmYjLcv5xc6qyo/3Xu2F
vCvmA0zgTaYbtWD6NI+ejTjGhZ8Pk+WeVxSyJ0Io9Q5S90/hxdAegtAVGUnLhxYa
vbacP/zEyYKHfIdkNn9R
=LMdX
-----END PGP SIGNATURE-----

Everyone received a different 'n' value and a different RSA encrypted message. Of course, the "Identity" field would also be different. [9]

A mention of the "Numbers dot TK" hint made people that didn't receive an email aware — presumably through leaks — of the existence of a second chance. Around the same time, the 845145127.com website changed. To know more about The Second Chance, see The second chance (2012).

Regarding publicly shared keys or messages, their owner would be emailed the following message by 3301:

PGP-Signed Message
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Hello.  You have shared your information online.  You are now removed from this altogether.
Even if you crack the key you've been given it doesn't matter, because you have demonstrated
that you can't be trusted to follow simple instructions anyway.

Thank you for your participation to this point.

Goodbye.

3301
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJPEsO0AAoJEBgfAeV6NQkPJRUP/1JyxwilMLUX0J+2gLofZV/C
/eIJkO3lxYuLQQWiouJVzBSddZ/GVP2XLP86OaZpYoChzGRxYaIia62e0ZnRQHei
d7UNWvOjenveo7QUpxpY+xPvPq41l/JJAntE6H82yO4NlCTTFi7UJBG2r8EgSc/s
gQs1A5TANcJgq8mFoscPH4T1QxT5N0AXbALMNyEUS37UqBcV40/7v9AJq52tyLnQ
IInxdmY38RO/sJJIAi/4hCquJ6OYFYmQxBTldKhacEE0/e8BQXIm/eIXClPL3ff0
mET9uP8CwyFQW8nUM7dBRO4CKTUJ0cYxjj3PlHnRUdfM7AyywWeXkqwlDB4OFOy2
Jw9/18phYSxTV2cM6ETRBK1xSGwevHHBaEdJF7xZAIA3EYbqyjW09YQnf4dihEg7
O3faR8docXTPwQ0qhuU65krI5O17N3Sn731RvBz9bZcDm+E8nh0m6wA0yRBYYjYo
8SW5MscEN2SI7xq8lskHdX9uogDVnb9IqTV2YfrQplnpZIR5jfLU+uWgVXMA2faQ
i9QMtyvKGGZ6ejPX+euPmp8XRIUHeXD5H/YQSTTy6D/0WnMHpH/h9p1FRcWOZSbR
1Gmmxi/Oix4PtBXjuNJt51KuQxVsh3s1f2KTcVV3tILalYtyPtoqTRST05KwV/Jj
GnHprhtOWRq4pAHlQktc
=kPlo
-----END PGP SIGNATURE-----

The RSA puzzle[]

To crack the RSA encryption, people had to factor their n — the modulus — into its two prime factors. In general this factorization is too computationally expensive, but the modulus being small made it possible (it has a low bit modulus and is therefore breakable). Decrypting the message could then be possible using a simple perl script.

For the above message, n factors into 80411114232571782218163489375797613948878398942588985417 and 98007492061325958997349177934627388613835953553459586261. To determine these factors, solvers had to use tools such as factmsieve, letting them run for a few hours. The decrypted message is[10]:

33521494043430258676


Submitting the correct answer to the same onion initially resulted in a 500 error, however on the 17th January at around 2:49 UTC, it instead reported:

Rsa submission internal error 2012

A screenshot of the 500 Internal Error initially shown

Correct. We’ll email you.


The MIDI puzzle[]

As promised, 3301 sent an email telling people to go back their 'sq6wmgv2zcsrix6t.onion/NUMBER' page. The page now had a message unique to each participant.

PGP-Signed Message
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This song is your own path
Another stop on the road toward enlightenment
Follow it, and share not 

Let the Chorus be your guide to the depths :

	Let the Priests of the Raven of dawn, 
	no longer in deadly black, with hoarse note 
	curse the sons of joy. Nor his accepted 
	brethren, whom, tyrant, he calls free lay the 
	bound or build the roof. Nor pale religious 
	letchery call that virginity, that wishes 
	but acts not. 

	For every thing that lives is Holy.

Good luck.

3301
- -----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.11 (GNU/Linux)

owHtWHtQVFUYv8tuKhhpTcVpwABLBwEXlm3locgCoyMmkuOjdXx0FdQY0wQtEcJY
rmbYw0eThlNOaY0paPZQ8zFmOaSllRMpTjqNji/yUc6oU2RG5z6+c8/jXmCm6b/9
676+8z1+3+/8vrO7MtIphTlQrONCpS+8l2NrYv30iPzS4mkl09xzSkuK0EVv4bin
SyRJ6iY5JKckF44rn42fEqV2R1/dLm7agrjh5aVxI6fNjUtLjUv1ZvnSs7yZ+N6T
JrWnSPqK+97p6ooxzu7vxUlfdpO+GiC1B1zdHaiH1D4xzCFJq3LkoD+Yg2+yZRTM
xtcM9UUGvkmXFSmYjm9y8Zdc7Soz1yH4/RApOI+21L9kqz6yJbQqH5vka76QZsBF
Uw1kzYBEBRdCXjn4Qw5eMUT9MIRYIrwUaSvBZTZ+n015ylIXZGn5aiuRkbjpGp7T
8Yp0bQXSFkDWJCS7wCIXWGkCoecCuZEFJjAQUksS4TKRVjbENoBZ5heDCemRG/gC
3gE7Fkt1gcwUDp2G7ITCYSFbF+3QgBiAIH0FSxtMoRpE5aAzQ39WPcqaR9ORRjoT
McDcCIlsaUmZgDOohwdOB4iGGhlI61ehPEI20lCT+gCRzh2SDBQKzYBs2ZiIyonQ
mCOEwC5+SwgubEEldQiyYC8YxhosCDaJ2BNRoAvpnYkOXzVfpO0HniAANA94ruog
V9g2JgWJAUc1WhBkTkl47SFtJ5/sotnWY8qTnVwhSgUsHAmstYXQ1jJD7Q/9gRNw
RAm5bKn41GZEBoY8dkjbQDYcxTQTIATtAJoJfBdazFXcJdHoQkKiLqKOyQu9o/SD
bbJ+NQ2pzrDjjs9XnFq8a+gIv1kpdnNjIF99Yb0rO9Ui6NH/KLmw4YVDhR6TooE4
hnVoOmMDskoDcayAbc3ppannnTLN3DvGFwCNPfOIGoyPC11w35meWUwxruyX6KMA
L2yACGxsfYli0UqIrzNRkUSRgCjEAjYhKy9UEIAI+sDVpjB6z51JWBooIt7sCGGi
IYrFlAF/EjZhY09SRpoKfQCCcywyYGXlx8iaisEf1PUVFgZizwT4qIkMCiWzlrDb
bE94Nrpi0URzQkNJ1JGW3aH2KEDm4jnKzsKQM0UUU3aIKSKnBSQJu0zKkC+ywXoE
1bNzm0BNYQ7ij5j5JnRJrIQAJzTQEAaFOYLgm3Q6WZv9rtA6F/TzWzLIHHYsqGAO
ag5XfhrYb0Vu0gikoUw7+S1psSF4HaXqNiXJ+ujKzq8ud4D9vcgfTbk2WHoVlM/2
DMFPSvu6rQRAFAuqJ8i6UiKx4t63EBirHa5YclHWK+V7AfuDP1KL0FiLqtLBqLU4
Tln1ShHw4TtE7RiozDyBsT8FKfLZ8FRgsqh27A6y+3OAEnILUhjgCMwSQIGGkz+p
ot7+739SrU6V5dpUfPXIqNajPQf92gtyg4uqTScWCD/L2nOyapCMb5LwiyTKhVv9
4KZdGG/Qah829eEXXmzqxc+2QSjnSHPuVV94qShe7Mpr6RJpHmGhT13oIwuUCuNG
MlYiAoHpCb4j7RkiGjkhUjCkACHBEELDewiQhMUJf1CrQ1px5gd9gRtf3dpVxtcK
M3eIyOGFCG6QO3gi+JFmALJs9ZRL3UBBJAuP+sXToTPb/hFLHlRbKiTj52SmEg2s
YEDImPQBggI6xLeIJ6LSlgiFudqhY4rZIVK6sD8guGChp0s1j++RB1892IC4MkqV
rFivl26YVljgrFdmUk5mKEcg0WG2SNdsJctFQlabHlMgmYUZhDHTVuFEYudgJVlh
Ehzy11d2LhDgm+VTx7SRDdqwmAmuzZ4DNLIhKYjZlUL9BuoKspdXaBxbF0MBA/+O
W2wBkWmofUCmdkLCFHhsJYCZoDdGNhVdiCaIFtECvlYTJoEPxBu/lcWZYiNoywKE
8wIDzK3KDRURfYt6Wah0CLvSBp5GQnRKvzhB4yWEmyhL/HZE62AHheZ4aI6H5nho
jofmeGiOW0ULzfHQHA/N8dAcl0NzPDTHQ3M8NMdDc7yrc1z9j74uLMYlOcKkbneF
FaGLXikivDeKdVyo9IX3KirtdSdm7/ktSfvmOwdfuLrl77GPBOvXJTiXzn6toCZy
xrs1flfE6Uuvx+5rXrSwKSNhyuYe7vi7r13YOnXWo9cjexaXnTp8/uqtkh8P5VZu
czWm3x4cuDG5Ye+sP1ra+wW6L7q09sm8iMfGjf1l+ZjLrUWTJrSl5p3Zt+bYPVP7
9a1rcc/NeSCmKCF288OjJ34y9+OUV/55rn3R3icWrSsv+Trw8/HLhZEVNyXPiIiy
hjH1aVE914w9tmS9//fY6MIBDe7R37911Le896bEw6NPXBl4cNiylrDpbdtijq6/
U/XdwkNjmmc6c1tOF2/4tvHg3oY59z+e9uyeLxom3bq0Jqk+e/HRxFEvREzInPFN
7tADK87kVhWEz4+6nFfv3H0zuXX2xWvHZrrzfjsxPqyx4o3Pqgs/KinJ3vzh8PMz
Nz4fVbxpQsyM2lcLGqKfGjalXzk6EmjNaDp7KFU+d8pVlrk0OSFwx7XxRta1rMkb
WoNRi+vaBtXINet3jWq4td1/buyg2/vjkwp2jH8/9Yd1+VVrrj/oLlkVDB5p+7U9
80CftP1bBu5o/enFouaXozeMCJ9//a/5CwZnlZ7YWls6p/lsnxFh+a4JyUOrh+5p
im97KPNg9O6CS8OiP3U5+98u61aRgEbmDw9PSas8U1sb+3l1sFop2Fzp2bX9SmFK
/5MpK48fb9xx496+OzftXPFmy5SdxcefaWmat6O8Kt73Z93JtVUfJLf9Cw==
=yk7h
- -----END PGP MESSAGE-----
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJPGOY0AAoJEBgfAeV6NQkP7KQQAJ7qfuZgtthyD6hXiPvrYXCl
Dnbj4viLPeiwVC/dYHn76yixqImr4+gzWEGzr+MrNpaPRBtCxu7kmBtwuyNHoqlz
KINmTLuwjpLkU/VBi02b17Z5UbCguEn8ZZDq8HFJgl3I8teQOBpmNorfsR0+CmjM
btuLdiZkLS0f9LS4mCivnlJmr6ULIwiAh7KaCQbj3s908raMQL+uIg6GXort1ilo
sppcEaykOHUmz+cxG2xpOD1KVt/IqSawimB3xfveCcLyRRfRQp4ACyL+eBiTzuT9
IJ9NmCrE3OcFtzJa0S2JjlOI5x1h70GEl1D/rpTu3zOR6I3YF68RufIxtnfpDsx3
6OORSR0kWVO1fVAotL3QfPxq6cjsy5Q+Gm5QeAvI+e5k2lGIL83d3JS23s0IjopS
gJWHwwIF5q9uHrg8oPIJkYkc1Dxzrvgc5DcHsYo+KQxWYsPhjh7nQp8hl0KpK8Q/
I8yFg3afBfH1ci15HifKVwAJGtrki3+NkPDw7IuwFDtW6NCd4SJ6XQv9fw7NyYQk
/qxbiOrz4yD7MOY9tKapdDMc5B4jIBaGULoKiMqk4KBHc05Z8I4yqaCfWI0BfijJ
VvKgLCx8mLillkKKH8A+f4CG191MKd0LwfrWNDCC62e5vWRaulV0coR2DTrCFFDA
FZL1IQd0u3QtmG5aRBhi
=kTmp
-----END PGP SIGNATURE-----

The large 'PGP MESSAGE' block differed in each message. It is a PGP-signed binary file named 'Cicada.mid'. To extract it, the message must in the first place be isolated and the leading "- " on the armor headers should be removed. The file is then decrypted using:

gpg --decrypt message.txt > Cicada.mid

The resulting file is a MIDI music file. It contains of two songs, but neither of them sound to be real music pieces.

The poem included in the PGP-signed message is the "Chorus" from William Blake's poem A Song of Liberty

It was noticed the second music track encodes the poem. A MIDI file describes the presses/releases of instruments keys; thus, each tone played has a defined note (encoded as a number) and a duration. Each (note, duration) pair played could then be associated with a letter given by the poem:

Note played | Duration   | letter
=================================
48          | 96         | l
49          | 24         | e
48          | 192        | t
48          | 192        | t
55          | 24         | h
49          | 24         | e
55          | 96         | p
44          | 192        | r
43          | 96         | i
49          | 24         | e
46          | 192        | s
...         | ...        | ...

In short, the second MIDI song was a substitution cipher where each note played corresponded to one letter. Once the full substitution table has been created, the rest of this second song can be decrypted. It simply repeated the Chorus two more times.

Following 3301's hint (Let the Chorus be your guide), the same substitution table was tried on the first track. Unfortunately, this resulted in a failure as almost no notes were in common.

Using frequencies analysis on the (note, durations) pairs, or by noticing that early letters in the alphabet were associated with shorter durations, a new substitution table can be crafted. Alternatively, this is equivalent to shifting up all notes in the previous substitution table by an octave (which equates to an addition of 12). This could have been hinted by 3301 ("...your guide to the depths"), as the second song was lower-pitched.

However, 3 characters weren't in the poem: q, x and z. But the substitution table can naturally be completed:

(note, duration) | letter
==============================
(55, 24)         | a
(56, 24)         | b
(58, 24)         | c
(60, 24)         | d
(61, 24)         | e
(63, 24)         | f
(65, 24)         | g
(67, 24)         | h

(55, 96)         | i
(56, 96)         | j
(58, 96)         | k
(60, 96)         | l
(61, 96)         | m
(63, 96)         | n
(65, 96)         | o
(67, 96)         | p

(55, 192)        | q  [*]
(56, 192)        | r
(58, 192)        | s
(60, 192)        | t
(61, 192)        | u
(63, 192)        | v
(65, 192)        | w
(67, 192)        | x  [*]

(55, 384)        | y
(56, 384)        | z  [*]

Decrypting the first song results of the above MIDI gives :

verygoodyouhaveproventobemostdedicatedtocomethisfartoattainenlightenmentcreateagpgkeyforyouremailaddressanduploadittothemitkeyserversthenencryptthethefollowingwordlistusingthecicadathreethreezeroonepublickeysignitwithyourkeysendtheasciiarmouredciphertexttothegmailaddressfromwhichyoureceivedyournumbersyourwordsaremuscledroppumpkneebirdwatchbellballhammerpockethookhousebrakefeatherknotticketboatboxmooncloudbulbcarriageboxtraysquarecupstationmatchtoothovenhorsepenciltraycollartreescissorsbrushdrawerbrickarmenginesockumbrellasheepapplehornhatchainforkscrew

Finally, after properly formatting the text:

Very good. You have proven to be most dedicated to come this far to attain enlightenment.
Create a GPG key for your email address and upload it to the MIT key servers.
Then, encrypt the following word list using the Cicada 3301 public key, sign it with your key. Send the ASCII-armoured ciphertext to the Gmail address from which you received your numbers.
Your words are:
 muscled drop pump knee bird watch bell ball hammer pocket hook house brake feather knot ticket boat box moon cloud bulb carriage box tray square cups station match tooth oven horse pencil tray collar trees scissors brush drawer brick arm engine sock umbrella sheep apple horn hat chain fork screw


Each MIDI file contained 50 unique words. Running the following commands outputted the PGP-signed message which could then be sent.

gpg --gen-key # Key generation
gpg --keyserver pgp.mit.edu --send-key [KEY_ID] # Upload the key to be MIT keyservers
gpg --armour --default-key [EMAIL] --sign --encrypt # Encrypt the words

The Invitation[]

Those who sent an encrypted PGP signed email with their words received at around Monday, February 6th an email informing them that there would be no more puzzles. It also gave directions to log on to a Tor hidden service, with a given username and password. Around the same time, they were invited with the infamous "leaked email".

From here, nobody knows what really happened, as the original puzzle was not very well documented in its end stages like the second puzzle was. Hopefully one day this will come to light, but after receiving this email every person that did so went completely dark, as if they had disappeared from the internet.

Nobody knew how deep the rabbit hole went, but all the solvers could agree: it was the deepest they'd ever seen.

What happened after this is mostly still not known, apart for few slips when some people told a bit more about what was going on later. Logs of those testimonies can be found on Unfiction. Legitimacy of those is not confirmed, it might be just trolling. After all, 3301 might not exist at all.

The Final Message[]

After a whole month without any word from 3301, the following message was posted on the subreddit from the start (r/a2e7j6ic78h0j), in a post entitled Valēte! (meaning goodbye, farewell).

Valete

A PGP-signed version of the message was embedded in the image using Outguess. A noteworthy observation is the presence of space sequences of prime length, similarly to what could be found in other 3301 messages. These have yet to be explained.

PGP-Signed Message
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello.
  
We have now found the individuals we sought.   
Thus our month-long journey ends.     
       
For now.           
             
Thank you for your dedication and effort.  If you 
were unable to complete the test, or did not receive 
an email, do not despair.  
           
There will be more opportunities like this one.
       
Thank you all.
     
3301
   
  
P.S. 1041279065891998535982789873959431895640\
442510695567564373922695237268242385295908173\
9834390370374475764863415203423499357108713631

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJPMFtcAAoJEBgfAeV6NQkPiyIQAMBkZSKkzNqkRiiw4OeEDiRE
eMOHNOOpy+r4+p898RmS4+QlrpyDjyRxeto5RVYqYuzqgZHBMF9EMSfSLqE3PKIG
Jta4mIggG1Xte+zwVzXBdVBk/4vWqqdMPBtZ4kQjfoc2n3/pUK+eGqmtxWLIzyUL
iug0zmWFN1ZOOMfXcWOfXsiRD9neSxxLwGDY91vxJSTUH7yfC21Mot2eom1PAki8
cwJqt2H56hUmJ339edHcXqLnUxvIbEa/so6hgSrA3U/A0EiTjzJ2YWuPqc4N866D
a9tgz0euQsZtl0XqtJZ48DWPja3bLDJYeRed1Qr+bAdXEgPBNgJQgT8kjcAhdqj/
TPvoYTXMQwvbT5IDiuYum4Vn2h4Z7BX8l7VdZBLNdgjapNohgOy+00DJFp8bG7em
mPlheAl7aLyHzbKPrpINCdgJhe4KfhPDhdsWFYJA99S61wwHPKlOrCgLGEcvH1YC
pOZKFZfCO+BMu2rz3JCfrSuGvyDwq54F8/Jc5zlHYCGNcTsvU0JO8F/ykNetl1qY
AIDNR9VHVwdR9/XiVTGXj0iOUKp1pzJlUY1Zi95vxNMC/WpiUu/AepEOLVIy/nsz
iAU8Xhke5xJPjKHb6pJOgH8gfe0QjuRacvg2oJL2YAKR/MT95kJmW7Wl+m68fcED
Cvvt7a3uW/YLSOL/S4/6
=HMPw
-----END PGP SIGNATURE-----


Excepted for The Leaked Email or the "Necrome" message, this was the last known PGP-signed message received from 3301 in 2012.

In programming or mathematics, backslashes are commonly used to signify that a number continues on the next line. The P.S. message has not been used to date despite its factorization into 99554414790940424414351515490472769096534141749790794321708050837 and 104593961812606247801193807142122161186583731774511103180935025763.

Mentions of 3301 popped up throughout the rest of the year, and by December everyone had forgotten about the puzzle... Until 2013.

Note: For any of the fake messages/speculations, please visit the appropriate pages.

Other links[]

Nox Populi has a multi-part series on what happened in 2012 (parts one, two, and three) that we recommend you watch.

To better understand how the puzzle unfolded, you might find our timeline tool useful.

Here are other links that explain these steps of the puzzle in different ways that you may find helpful:

Chart

Diagram of 2012 puzzle

References and notes[]

  1. Nowadays, the image's Imgur page contains a Portuguese title. It describes how this image is part of the 2012 Cicada 3301 puzzle.
    Archive of the image without the title
    It's thought to be the result of the image getting cross-posted on Reddit.
  2. The post entitled Valēte! marked the end of the 2012 puzzle. It wasn't available when solvers first discovered this subreddit and is not yet relevant.
  3. All posts excepted Problems?, Welcome, Valēte! and the first two ciphered posts end with a carriage return (\n) character.
  4. The deleted posts are :
    • A first version of the "Problems?" post. The image posted did not embed any stenographically hidden data, which may explain why it was removed and replaced by the well-known post. This post was made by a deleted account.
    • The second and third encrypted posts were reposted soon after posted by a deleted account. These newer posts were removed to keep the ones from u/CageThrottleUs.

    There also exists a deleted "Welcome" post from 2015, however it is believed to be unrelated.

  5. We only have a partial archive of 845145127.com ; the cicada image with the correct outguess message is long lost. For more information, read our archival repository.
  6. tekknolagi's blog doesn't mention it
  7. [2013-01-13 18:19:21] <Lurker69> http://pastebin.com/HcLcAeYW
    [2013-01-13 18:19:31] <Lurker69> this is part of last years puzzle and it is legit
    [2013-01-13 18:19:36] <Lurker69> was never solved
    [2013-01-13 18:19:52] <Lurker69> book is ptobably encyclopedia brittanica...
    [2013-01-13 18:20:04] <Lurker69> but nobody knew which version
    [2013-01-13 18:20:10] <soulseekah> interesting...
    [2013-01-13 18:20:28] <soulseekah> yet people finished the game without solving it right?
    [2013-01-13 18:21:23] <soulseekah> "You've shared too much to this point.  We want the best, not the followers." yet this year they encouraged teams right/
    
  8. See https://clevcode.org/cicada-3301/, the last 5 paragraphs
  9. This pastebin is believed to contain an another instance of such message. However, it was censored and the original message has yet to be found. The first censored field is eJwBzQAy, and n is 7467492769579356967270197440403790283193525917787433197231759008957255433116469460882489015469125000179524189783.
    Similarly, this pastebin and a n0v4 wiki archive are another instances of (censored) RSA messages.
  10. In these IRC logs, a solvers leaks what he claims to be legitimate numbers from this step: 33407224003429952528, 07088751691164076086
Advertisement