Use standard openssl tool for Premium Paywall challenge

The Premium Paywall challenge currently uses a third party web service to encrypt/decrypt the flag.

I suggest to use standard openssl instead. This way, users can better understand what algorithm including the mode of operation is actually used, without relying on the third party web service.

I will start working on a PR.

[bkimminich]

On the other hand, exposing the IV along with the key is bad practice enough, I suppose… 😉

So, @ingben, feel free to send that PR! One idea for that one: Maybe instead of making it trivial with the current

key = EA99A61D92D2955B1E9285B55BF2AD42
iv = 1337

you could do it slightly more obscured, like {iv}.{key} or {iv}#{key}, so the file contains

1234567890123456.EA99A61D92D2955B1E9285B55BF2AD42

or

1234567890123456#EA99A61D92D2955B1E9285B55BF2AD42

[ingben]

@irbian: You mean from the original challenge? The PHP source code on the page mentions it.

protected function getIV() {
        return '1234567890123456';
         //return mcrypt_create_iv(mcrypt_get_iv_size($this->cipher, $this->mode), MCRYPT_RAND);
         return openssl_random_pseudo_bytes(openssl_cipher_iv_length($this->method));
     }