[Lain]

So over the Valentines Day weekend, my GF visited and we messed around for the three days from Saturday from Sunday. Saturday was spent in my tiny outskirts-of-town area (Canadian outskirts means 30min to 1hr drive outside of the immediate city), Sunday was spent in the big city (still small by American/European standards,) and the third day was spent at a board game cafe killing time until she had to catch her bus and go home.

Some backstory:
Before she came over, we were planning out how to organize all our 'dates,' like which general areas we would spend time in, try to put everything in similar areas together, and just in general find stuff to do. My town has almost nothing fun to offer and the 'big city' has a total of two clubs. Not that I club at all, but just to give you an idea of how boring this place is for anyone 18-25. After a while, she suggested an escape room and then I remembered an article I read a while back.

Code:

If you're unfamiliar with the concept of an escape room, here's a quick rundown.
You pay 20$ or whatever to get locked in a room for about an hour, and in that one hour, you and your friends/party have to solve a series of puzzles to get a key that will unlock the exit.

In some cases, if you have a small group, you may be matched with another small group to all join in together (usually a limit of 6 people) depending on how busy the night is, if you have reservations, etc.

If you escape, you can get your photo put up online, and in some cases you can win a small prize or at the very least a discount on booking a different escape room at the venue.

Turns out, there's an escape room in the city that's sponsored by our Communications Security Establishment (CSE.) The CSE is responsible for code-breaking, mostly, and is essentially the cryptography department of CSIS (Canadian CIA). If you beat this escape room, apparently you can possibly get an interview with the CSE because they're looking for people that can solve all sorts of logic puzzles.

So we booked that one.
And we beat it. 
We were matched with another group of four (me + GF + 4 = 6 people) and because we did the room later at night, we got lucky and the group was also a little more mature than a 15yo's birthday party, so they also knew what they were doing and we synergized really well.
The room wasn't set for an hour, either, like they typically are. This one was set to 45min, and we still beat it with 5min to spare. Got our photo taken and put online so I have the proof that I completed it.

But no interview, like the rumours say.

Instead, if you beat it, you are given the option to solve another challenge within 30min (you can solve it alone or with the group) and if you can solve that challenge, then you're guaranteed an interview with the CSE. Allegedly only one person has been confirmed to get an interview through this method, so it's a pretty tough puzzle.

And since I didn't sign an NDA (the waiver for the escape room is just confirming that they're not responsible for injury if you decide to be an idiot) so I think it's safe for me to post the puzzle here. As follows:

USE THE BADGE OF HONOUR UNTIL GNOME KEYS FIRST READING

Your task is to find a ten letter Latin word hidden in this message. 
Use it as a password to your host after the experience.

Now, of course we failed, and the host did not tell us what the answer was, but he was kind enough to at least let us know if we were on the right track.
So what I do know for sure is that there is a substitution cipher, and I believe it is fully rotationally dynamic.
Let me explain a few things and get to some things I've tried.

---

---

The Badge of Honour refers to the CSE logo, and particularly the crest, not the text beside it.
First Reading likely refers to the fact that only one iteration of the algorithm would be necessary to find the message, just to let people know not to waste their time doing all kinds of iterations.
Gnome Keys is what stumps me the most. When originally doing the puzzle, our group made the assumption that Gnome Keys was just an arbitrary phrase that meant nothing, but the more I think about it, the more I believe that it was another hint.

Only one person has officially solved this puzzle. They got their interview, but cannot confirm whether they got hired or not (top secret and whatnot.) You're only given 30min to solve this puzzle.
I've spent almost 20hrs probably, since the time I got back from the room, sleep, hung out with GF, went back home after she left to go back to her town, then worked on it until 2AM again, and this morning I took another crack at it.
I've been brute-forcing like crazy, doing every kind of Vigenere substitution, or arithmetic, using word lengths, playing with offsets, and my notebook is actually getting kinda full of this shit. Like I said, I've been at it for hours, and likely almost a day, and I haven't gotten far. If the puzzle was solved by one person in 30 minutes, that means that if they did what I did, they must have simply just gotten insanely lucky. And I doubt the Canadian CIA wants to base their applicants off the luck of the draw.

So, I think that Gnome Keys very likely refers to a specific type of cipher to use, not just a simple ROT1-25, or Vigenere, or Caesar shift, or anything like that.
I've tried endlessly googling for 'gnome cipher' or 'gk cipher' or 'gnome cryptography' and haven't found any specific ciphers to use, but came up across one result about the faithful and forgetful gnome model, but that's more related to hashing rather than a cipher, so I doubt that's relevant.

---

---

Now, onto the actual cryptography part:

The Clue/Message:

Code:

USE THE BADGE OF HONOUR UNTIL GNOME KEYS FIRST READING
Word Lengths: 3 3 5 2 6 5 5 4 5 7
Summed up: 45 (Also 1+2+3+4+5+6+7+8+9)
We shall denote the set of word lengths as L (L[1] = 3, L[10]=7) 

First letters: UTBOHUGKFR
Total: 10 letters 
Likely the hidden message encrypted (looking for a ten-letter latin word)
We shall denote the set of first-letters as the set M (M[1] = U, M[10] = R)

The Crest/Badge:

Code:

NUNTIUM COMPARAT ET CUSTODIT
No spaces: NUNTIUMCOMPARATETCUSTODIT
Meaning: To Compare & Preserve the Message

Number of Letters: 25
We shall denote this set (no spaces) as K (K[1] = N, K[25] = T)

Other notes:

Code:

The instructions segment is irrelevant to the puzzle, according to the host. No need to waste time there.
Although Comparat is the top of the crest and where you would think to start, this is the assumption we made at the official puzzle, and turns out it was wrong, confirmed by host.
Because of the last note, I highly doubt that NUNTIUM...CUSTODIT must be reversed or used in reverse.

To make life easier, I've also made a couple lookup tables.
1 is the most likely, but I made an interesting result with 2.
They are both organized as the following:
Alphabet : Number : K[Number] : Alphabet[(Number(Alphabet) + Number(K[Number])) mod 26]

To explain that last column, take the first letter for instance in the message: M[1] = U
U is the 21st letter of the alphabet. Find the letter at the 21st position in set K, K[21] = T.
T is the 20th letter of the alphabet. Add 21 + 20 = 41.
41 mod 26 (41 % 26) = 15
The 15th letter in the alphabet is O
So the last column in position 21 is O

Lookup Table (1):

Code:

A 01 N O
B 02 U W
C 03 N Q
D 04 T X
E 05 I N
F 06 U A
G 07 M T
H 08 C K
I 09 O X
J 10 M W
K 11 P A
L 12 A M
M 13 R E
N 14 A O
O 15 T I
P 16 E U
Q 17 T K
R 18 C U
S 19 U N
T 20 S M
U 21 T O
V 22 O K
W 23 D A
X 24 I G
Y 25 T S
Z 26 - -

So let's try a few.
K[M[1-10]]:

Code:

U T B O H U G K F R
T S U T C T M P U C

Lookup[1] to Lookup[4]:

Code:

U T B O H U G K F R
O M W I K O T A A U

Note: No permutation of ROT1-25 made this a legible word.
Once I saw OMWI, I though maybe I would have found something, or maybe I made an error and it was actually OMNI (prefix for 'all') but no luck.

After trying all sorts of permutations similar to this one, and playing with the mod26 to mod25 or changing offsets, I tried two things.
First, the host mentioned something else about how it might be dynamically rotational. Instead of looking up each offset in the table starting from 0, I should perhaps start from the last offset. Observe.

Code:

First letter in set M is U. Offset 21.
Offset 21 in set K is T, letter 20.
21+20=41 mod 26 = 15, O
(Lookup column 4, O)
Second letter is T, Offset 20.
Start from last offset, 21, and add 20 (mod 25 [25 is length of set K]) = 41 % 25, 16
At offset 16, column 4 = U
[...]
Result:
O U U T I W K W K -

I tried a few variants on this idea, and still nothing worth noting. So, I modified my assumptions a little bit:

Code:

The set K has a length of 25 while the alphabet is length 26.
I operate under the assumption that A = 1, Z = 26 meaning that Z does not have a corresponding value. There is no Z in set M, so this assumption should be fine.
There is also no A in set M, therefore I can also align set K with the alphabet using the conversion of A=0 to Z = 25 (offset 1 down) without collision

Thus, I generate the following:
Lookup Table (2):

Code:

A 00 - - 
B 01 N P
C 02 U X
D 03 N R
E 04 T Y
F 05 I O
G 06 U B
H 07 M U
I 08 C L
J 09 O Y
K 10 M X
L 11 P B
M 12 A N
N 13 R F
O 14 A P
P 15 T J
Q 16 E V
R 17 T L
S 18 C V
T 19 U O
U 20 S N
V 21 T P
W 22 O L
X 23 D B
Y 24 I H
Z 25 T T

Now, you can see that our first letter in set M is U, this isn't 21 anymore, it's 20. So everything gets offset by one, and as a result column 4 also changes by bumping everything up by an offset of 1 (O in lookup1 column 4 becomes P in lookup2 column 4, X becomes Y, A becomes B, K becomes L, etc.)
And using this table, I then perform the following:

K[M[1-10]]:

Code:

U T B O H U G K F R
S U N A M S U M I T

Well, it at least looks like a word, but not Latin. Maybe Hindi or something? Maybe I'm just being reminded of TunakTunak.
But flip it around, and what do you get?
Timusmanus
Or as two words, Timus Manus, which is in fact Latin
Meaning: Concentrated Hands

Unfortunately, although this worked and gave me some Latin, it gave me two words in those ten letters instead of one word, and Google Translate returns nothing for 'timusmanus' as one word, so I guess it's another defeat.

So yeah. It's still bothering me because I've solved tons of crypto challenges online before, and done all the RE and stuff, but this one problem with a basic cipher that you can solve with pen and paper is really screwing with me and making me feel stupid, so I'm pretty pissed off and I'm gonna keep swinging at it until it breaks.

Give me suggestions on where I should look, or maybe what other kinds of algos I should try.
I've done pretty much every possible algo that has to do with the lookup tables/mod26/mod25 in one iteration, and I've established that First Reading means one iteration, so I'm not going to go overboard. 
If it's one iteration, that likely also means it's a symmetric cryptographic system so I shouldn't need to use multiple rounds.
Anything that would take longer than 30min to do by hand should not be considered, since that's the time limit they gave us in-person and we were not allowed to use computers, only a single sheet of paper and a pen.

[Darth Makestation]

I'm glad you use it.

[Darth-Apple]

I swear, I read your posts and I'm like... d***, me too.

I've done escape rooms multiple times. Always loved them. I'm going to look through this with a little more time when I have a moment!

[Guardian]

You've got me man. You've gone way further than I ever could. I'm already stumped. Wow...

[Lain]

I just can't for the life of me think of what 'Gnome Keys' could mean.
Google only returns stuff about GNOME's Keyring (linux thing) which is more or less useless given that's all modern cryptographically secure tech like RSA/AES and this should be able to be done by hand without me needing to run XOR's on the whole string after I get done converting it to ASCII numbers smh.

My next best guess would be GNome as in viGeNere cipher, but I have a ten letter ciphertext and a bunch of text that's either longer or shorter, and even if I were to run everything through Vigenere against the ciphertext, there's no guarantee I'd find anything. And given that, like I mentioned, CSE likely doesn't want to hire based off luck, there must be some sort of way to interpret the clue and come up with the proper key.
And yes, I've tried 'gnome/gnome keys' as a key with Vigenere. No, it did not work. I've also tried using the Badge text as a key, and that doesn't do much especially given how much longer it is than the ciphertext, making it another unlikely candidate for a key.

It probably does have something to do with the Badge text as a key, given they mentioned it in the clue and how the badge itself also has a key in the middle. But how the hell I interpret that is completely beyond me.

EDIT: Came up with something cool:

Code:

G = 7
N = 14
O = 15
M = 13
E = 5

Correspond those to positions in the Badge text and you get MATRI (Latin word for Mother)
Unfortunately, doing the same thing with KEYS gives you 'PITU' which is not a Latin word, nor is MATRIPITU or anything like that. But it's a new key that I can use with previous algos I've tried.

EDIT 2:
MATRI does not work as a key for anything, whether it be anything I tried above, or Vigenere.
None of the other words in the hint, when looked up in the table, have any sense or significance, just GNOME (and arguably KEYS).
Perhaps it refers to "matri"ces, using something like a hill cipher or some other polygrammic.
I really hope it doesn't, because I have no idea how I'm going to find the matrix needed in this puzzle.

EDIT 3:
I gave the hill cipher a shot. No luck.
Since typically hill ciphers use 2x2 matrices (or four values, in other words,) I found the only place in the whole puzzle that had four numerical values: the lengths of the words in the crest (7 8 2 8.)
Since I didn't know how to arrange them, I tried both:
[7 8]
[2 8]
and
[7 2]
[8 8]

Which both respectively ended up with the bigrams [G, K] and [W, A] for the first two letters of the ciphertext UT (using the alphabet of a=0, z=25)
If a=1, z=26 is used, you get [F, J] and [V, Z] which both wouldn't make a word, so I figured the second matrix would work.
But alas, for the next bigram of BO, I got [J, Q], so WAJQ was going to be my message, which again doesn't make a word.
Tragic.

This puzzle is giving me an aneurysm so I'm gonna get some actual schoolwork in and head to bed soon.
Spies are something else, man.

EDIT 4: One more before the Eternal Worm Devours Connecticut
Since I kept thinking about matrices and some linear algebra practice, I went ahead and tried using NUNTIUMCOMPARATETCUSTODIT as a 5x5 matrix to multiply a 5x2 matrix containing my presumed ciphertext UTBOHUGKFR, as so:

Code:

ALPHABET: A=0, B=1, [...], Z = 25

[13 20 13 19 08]    [20 20]    [975 741]          [13 13]   [N N]
[20 12 02 14 12]    [19 06]    [910 766]          [00 12]   [A M]
[15 00 17 00 19]  X [01 10]  = [450 793]  % 26  = [08 13] = [I N]
[04 19 02 20 18]    [14 05]    [849 620]          [17 22]   [R W]
[19 14 03 08 19]    [07 17]    [894 857]          [10 25]   [K Z]

So nothing useful.
Glad I can at least get the practice in for matrix multiplication.
I'm using pen+paper for all this still because I want to adhere close to the rules of the challenge instead of cheating, because if I cheat I'll finally be free of this curse but I won't be satisfied with how I arrived at the answer. I know there are calculators online for this kind of stuff, but I'm not gonna have that privilege on my exams either.

I'm starting to think that another one of my assumptions may have been wrong, presumably the one where I assume that it's all about the first letters. There are ten words, yes, but that doesn't mean that I need to pull every first letter out of them. Perhaps the last, or the second. Probably not the last either, because the first three characters would be "EEE" in that case, and no English (Latin-derived) word has three of the same letter in a row (but that could reinforce the idea of using that rotational cipher thing to get the answer.)

Perhaps gnome keys could refer to gnome characters, i.e. characters that when lowercase would be short. If that was the case, then writing the clue as a normal sentence would be:

Use the badge of honour until gnome keys first reading.

Removing capitalization would change the first character to a U instead of S.
Highlighted in red would be the letters I'd choose, but the ones highlighted in green could also fall under the definition of a 'short' letter, noting how G goes below the 'floor' and I only has a little dot that goes over, and doesn't go all the way up.
In this case, FIRST READING would be interpreted to the first occurrence of such letters. Which also makes sense, because OF only has one such occurence, so I cannot find the 'second' occurrence there, or anything beyond the first.

But, alas, the clue was given in all-caps (in a pretty font which is also irrelevant according to host) so I doubt this would be the answer either.
Also note how many double-letters there are (you get even more when you use the lookup table(s)). ROT ciphers/Caesar ciphers aren't of much help either.
I'm just throwing ideas around like crazy.

[Jenner85]

So I attempted this puzzle as well, my group thought that since it was a 10 word sentence, one letter would come from each word. Our host confirmed that we were on the right track, except it would be one letter from each word that would then need to be decyphered. Not sure if that's helpful or not but that's what we were told! Hope you can crack it ...

[Darth-Apple]

So I attempted this puzzle as well, my group thought that since it was a 10 word sentence, one letter would come from each word. Our host confirmed that we were on the right track, except it would be one letter from each word that would then need to be decyphered. Not sure if that's helpful or not but that's what we were told! Hope you can crack it ...

They are always so much harder than they they seem at first glance...   

Oh, also I see that this is your first post. May I extend a warm welcome to the forums!

[Lain]

So I attempted this puzzle as well, my group thought that since it was a 10 word sentence, one letter would come from each word. Our host confirmed that we were on the right track, except it would be one letter from each word that would then need to be decyphered. Not sure if that's helpful or not but that's what we were told! Hope you can crack it ...

Yeah we actually got pretty far according to the host, but everything I could possibly try with lookup tables, offsets, algorithms, and other ciphers just can't seem to work sadly.
It might not be the first letter of every word, could be any of them quite frankly, but determining which one it is is a whole other game. Then to actually decipher the code, well, I'm familiar with enough 'common' ciphers to come up with something, and it should be relatively simple (albeit creative) so likely no linear algebra involved for stuff like hill ciphers :/