I am creating my own problems that people have to solve and I want to make a grader check if a user put in the right answers and then reward them with a flag.
My code for one particular problem:
from Crypto.Cipher import AES from binascii import hexlify from binascii import unhexlify password = input("What is the answer to the first question? ") passwordtwo = input("What is the answer to the second question? ") message = input("What is the answer to the third question? ") obj = AES.new(password, AES.MODE_CFB, 'This is an IV456') ciphertext = obj.encrypt(message) obj2 = AES.new(passwordtwo, AES.MODE_CFB, 'This is an IV456') answer = b'c557774c4e5bd1745319b15226e078ef30abcb50f1bd371946ddadffc39a1f56' flag = b'a2c8b65cda513befb8134c7960bc977946655d485f9ad2' if (hexlify(ciphertext) == answer): print(obj2.decrypt(unhexlify(flag))) #first question: I took a major language exam in 2018 - what did I get due to my score? The answer is two words. Format should be ans:<question 1 answer> #second question: I partook in a competition in my district in 2017 - what was the name of the competition? The answer is three words. Format should be ans: <answer to question 2> #third question: I was in a competitive club around the time I wrote a book. What did I place and for what event? The answer is four words. Format should be <place>: <event>. Write it out in words #note that the format is EXTREMELY particular - it has to be exactly the same. Also, everything is lowercase.
This code works as long as users abide exactly to the format I specify. I'm not sure, however, if a user can just find the flag without actually answering the questions. I would think that by making them figure out the passwords themselves it would be impossible to trick the grader. Is this code secure? If not, how can I make this more secure?