Data Sets

Plaintexts this year were generated from a number of different ideas and source materials, then spread across the hash types below.

Plaintexts

Each different bucket/idea/wordlist we used; the Pro and Street groups show how many hashes of each were in play and the percentage cracked across all teams in that class.

Idea	Pro Hashes		Street Hashes		Description
Idea	Total	Crack %	Total	Crack %	Description
back	2525	53.8	2522	25.5	Words and phrases about back, return, repeat; multilingual.
compliance	5002	11.4	4998	6.8	Generated 3/4 policy compliant passwords, re-mangled.
databreach	1442	13.4	1441	10.7	Words and phrases about privacy, data breaches, digital rights; multilingual.
haikus	3220	8.7	3218	2.0	Phrases from haikus in video games.
longwords	12864	12.4	12860	4.5	Long words, rotated with chaff; multilingual.
movieroman	687	0.0	685	0.0	Movie titles and their copyright year; multilingual.
oldcontests	6576	29.5	6573	16.7	Plains pulled from past CMIYC, mostly uncracked.
patentlist	15002	0.0	15002	0.0	Patent IDs spliced into phrases from their titles.
produce	4995	0.0	4992	0.0	Grocery produce codes, mutated.
snapple	823	0.1	820	0.0	Snapple Facts, mutated.
toots	1786	68.5	1785	11.6	Every public toot by CMIYC, mutated.
zipcodes	500	100.0	500	100.0	US zipcodes, first-5 and random last-4.
attractions	500	0.0	500	0.0	Sports teams, etc. from that zipcode, mutated.
patentwords	13126	0.0	13126	0.0	Words from some user-tracking patents, mutated.
jfkfiles	469	35.8	468	27.4	Names and SSNs published by the National Archives, mutated.
teamnames	17	0.0	17	0.0	Word/phrase association with registered CMIYC teams.
bonjovi	636	99.5	635	0.0	Bon Jovi song lyrics, one full line each.
DaMaGed	10568	0.0	10568	0.0	Simple all-numeric passwords, inside unsupported dmg files.

For long inputs (sentences, etc.) phrases of random length (such as 2 to 4 words, maybe removing articles first) were chosen starting at a random offset, in order, and wrapping around. Sometimes a single entry would be sampled multiple times to seed more than one password, sometimes with iterating usernames (user, user2, etc.) so they can be grouped.

Plaintext Mutations

Various mutations were then performed.

In addition to the usual suspects, we tried to brainstorm password-manipulation techniques that could be taught to a non-technical user population, that they could learn as a fairly simple rule and remember without too much difficulty, but which current tools/rules/mindsets are not optimized for.

Most ideas/wordlists had multiple mutations applied probablistically, like "40% chance of rotating a word, 20% chance of krad substitutions; 30% chance of spelling out each number as a word; max of 2 mutations". "Multilingual" means there were language-specific targets (of words, replacement characters, keyboard layouts, etc.); non-English users have stereotypical surnames for their country/language.

Here are just some of them.

Mutation	Example	Description
char_sub	`foobar` -> `f0.b4r`	Randomly replace some characters with krad/lookalike-ish characters. Language-aware - only use keys available for the language of the user.
extract_phrases	`Live mice sit on us` -> `on us Live`	Pick a variable length phrase from an input starting at a random position and wrapping if necessary.
key_shift	`password` -> `0qww294e`	Type a word-as is after moving hands one spot in any direction on the keyboard. Multilingual/keyboard-layout-aware.
pig_latin	`contest` -> `ontestcay`	I think you know what Piglatin is. Arbitrarily decided that words have to start with a letter to be eligible.
romanify	`MCMLXXXV` -> `MCMLXXXfive`	Look for roman numeral numbers and randomly spell out individual "digits" (yes the name is backwards). Multilingual.
rotate_word	`abbreviators` -> `ators2abbrevi`	Take a long word containing minimal embedded smaller words, tack 0-2 non-alpha chars on the end, pick a random offset and rotate/wrap the word around itself. Per-language wordlists (with usernames suggesting language).
spell_numbers	`867-5309` -> `eight67-V3Zero9`	Pick random digits to spell out in English, roman numerals, or a user-specific language/character set (hinted by the username).

There might be others that you will see again later...

Hash Types

Each set of mutated plains was then striped across multiple hash types of varying difficulty (usually). The Pro and Street groups show how many hashes of each type were in play and the percentage cracked by any team in that division.

Hash Type	Pro Hashes		Street Hashes		Prefix	Description
Hash Type	Total	Crack %	Total	Crack %	Prefix	Description
gost_yescrypt	4834	6.4	4833	0.3	$gy$	Combined standard yescrypt with GOST
cmiyc	636	99.5	635	0.0	$cmiyc$	Custom memory-hard scalable KDF using SHA512
yescrypt	4124	4.3	4122	1.0	$y$	Memory-hard scalable hash based on scrypt
argon2id	1626	13.3	1625	5.6	$argon2id$	Memory-hard hash built on BLAKE2b
scrypt	1880	1.3	1879	1.2	$7$	Memory-hard password hash
raw-sha256	23694	0.0	23694	0.0	[none]	Unsalted single round SHA256
bcrypt	5995	9.5	5994	1.9	$2a$	Hash built on Blowfish (lower cost than default)
sha512crypt	2192	8.0	2190	5.2	$6$	SHA512 based crypt (higher rounds than default)
sm3crypt	5063	10.4	5060	2.6	$sm3$	SM3crypt hashes used by some Linux distributions
sha1crypt	8262	3.9	8260	1.5	$sha1$	NetBSD/Juniper SHA1 crypt
md5crypt	6007	14.9	6005	6.2	$1$	FreeBSD MD5 crypt
openssha	5784	13.2	5779	6.4	{SSHA}	Salted single-round (Salted-SHA1, NSLDAPS)
raw-sha384	2968	38.9	2964	28.7	[none]	Unsalted single round SHA384
raw-md5	7673	35.1	7670	19.2	[none]	Unsalted single round MD5

You may have noticed that raw-sha256 is worth way too many points for being such a simple hash. That is because the only way to get those hashes is to crack some challenge files; the fast easy points are the reward.

Encrypted Files

As the contest progressed various encrypted challenge files were released. Unlike password hashes which were different for Pro vs Street, challenge files and contents were the same for all players... mostly.

Bundle	Time Offset	Description
cmiyc_2026_challenge_1.pgp	+7h	First challenge bundle. Two different, related hashes per user.
cmiyc_2026_challenge_2.tar.pgp	+7.5h	Second challenge bundle. 7z archives using unsupported password-protection modes, with easy hashes inside.
cmiyc_2026_challenge_3.pgp	+11h	Third challenge bundle. Executable implementing the custom $cmiyc$ hash type.
cmiyc_2026_challenge_4.tar.xz.pgp	+27.5h	Final challenge bundle. Encrypted DMG disk images, containing lots of easy hashes inside.

Test Hashes

As usual, the test hashes released during pre-registration were designed to hint at aspects of the upcoming contest.

More info coming soon...