Carrier
A 20-layer cryptographic CTF where each answer decrypts the next. Built for fun.
A hand-authored puzzle season: 20 layers chained by cryptography, where every layer's answer both addresses and derives the AES key to the next, so you can't read ahead. You decrypt your way forward. Completion is verified server-side so the roster can't be forged.
Each layer's plaintext answer both routes to and derives the AES-GCM key for the next (PBKDF2-SHA256, 310K iterations, all WebCrypto). You can't skip: the content stays ciphertext until you've solved the layer before it. Underneath the whole thing runs a hidden zero-width-Unicode second channel, XOR-masked with each layer's answer so it's only readable once you've solved that layer.
The layers run the whole genre: morse, classic ciphers and Vigenère, zero-width steganography, image EXIF-GPS, audio spectrograms, binwalk file-carving, LSB stego, DNS-TXT records, a forgeable JWT, WebGL/GPU fingerprinting, PGP, and a live finale over a Cloudflare Durable Object. A 'twist-string' assembled across acts through the zero-width channel is load-bearing three separate times (as a JWT signing secret, as part of an assembly key, and as the finale gate), and it's designed to resist walkthroughs.
It runs on Cloudflare Workers / Pages / KV / Durable Objects. Everything client-side is bypassable by design: confidentiality comes from the AES chain, integrity from the Worker (the only thing that can grant you completion), and finishers land on a public, PGP-signed roster. Go solve it at carrier.harsh.md.
metrics
- layers: 20
- chain: AES-GCM, answer-derived keys
- play: carrier.harsh.md