← Back to Writeups
CUSTOMEasyMisc
Bookmark

Lock and Key

XESXOR9/2/20262 min read
#misc#custom#easy#dvorak_to_qwerty_conversion#keyboard_layout_recovery#physical_key_mapping

Lock and Key

Platform: bluehens_ctf_2026 | Category: Misc | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-04-17 | Status: Solved Techniques: dvorak_to_qwerty_conversion, keyboard_layout_recovery, physical_key_mapping

Summary

Task: a short ciphertext string is provided with no files, and the title hints at typing rather than classical cryptography. Solution: recognize a wrong-keyboard-layout entry, map Dvorak characters back to QWERTY by physical key position, and recover the exact flag.

Lock and Key — BlueHens CTF 2026

Description

GEJYU?<dro{Yflcbi+

The challenge gives only a short ciphertext and no supporting files or hints. The goal is to identify what kind of transformation produced the text and recover the flag.

Analysis

Short challenge summary

This is a keyboard-layout puzzle disguised as ciphertext. The string does not look like a standard encoding or substitution, but it does resemble text typed on the wrong keyboard layout.

Why the title is the key hint

The title Lock and Key is the main clue. In a misc challenge with no files and only a strange line of text, “key” is more naturally interpreted as a keyboard key than as a cryptographic secret. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

That reframes the problem immediately: instead of asking how the text was encrypted, ask whether someone typed the intended message using the wrong layout.

Keyboard-layout observation

The ciphertext is:

 text 
GEJYU?<dro{Yflcbi+

It has several suspicious properties:

  • it mixes upper- and lowercase letters with punctuation,
  • it includes characters such as { that often appear inside a flag,
  • but the overall text is still unreadable,
  • and there are no extra artifacts suggesting a deeper pipeline. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This strongly suggests layout confusion rather than actual encryption.

Dvorak -> QWERTY by physical key position

The correct interpretation is that the text was typed on a Dvorak layout, while the intended message should be read as the keys' positions on a standard QWERTY keyboard.

So the recovery method is:

  1. Take each visible Dvorak character.
  2. Find the physical key that would produce it on a Dvorak keyboard.
  3. Read the character from that same physical key position on QWERTY.

Applying that mapping to: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 text 
GEJYU?<dro{Yflcbi+

produces:

 text 
UDCTF{REDACTED}

which is a valid flag and matches the expected format exactly.

Solution

  1. Notice that the title points toward keyboard keys.
  2. Test the hypothesis that the text was typed with the wrong layout.
  3. Build a mapping from Dvorak characters to QWERTY characters using physical key positions.
  4. Convert the provided string character by character.
  5. Read the recovered flag.
 python 
#!/usr/bin/env python3

cipher = "GEJYU?<dro{Yflcbi+"

qwerty = "qwertyuiop[]\\asdfghjkl;'zxcvbnm,./"
dvorak = "',.pyfgcrl/=\\aoeuidhtns-;qjkxbmwvz"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

qwerty_shift = 'QWERTYUIOP{}|ASDFGHJKL:\"ZXCVBNM<>?'
dvorak_shift = '"<>PYFGCRL?+|AOEUIDHTNS_:QJKXBMWVZ'

mapping = {d: q for d, q in zip(dvorak, qwerty)}
mapping.update({d: q for d, q in zip(dvorak_shift, qwerty_shift)})

plain = ''.join(mapping.get(ch, ch) for ch in cipher)
print(plain)

Running the script prints:

 text 
UDCTF{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍