PASS.NEW PASSWORD RECOVERY: A PROMPT FOR AN AI ASSISTANT

Read this first (for the person holding the blocks)
Anything you paste into an online AI can be seen by the company that runs it. If
this password protects money (such as a Bitcoin key) or anything important, try
the offline options first: pass.new/split, the offline recovery page (recover.html),
or recover.py on your own computer. If you do use an AI, move the funds or change
the password as soon as you have it back. The full kit, free and public domain, is
at https://github.com/pass-new/recovery-kit

How to use this prompt: copy everything below the dashed line into an AI assistant
that can run Python code. Replace the three "My block" lines at the end with your
own blocks, exactly as printed.
--------------------------------------------------------------------------------
I have 3 "blocks" made by pass.new. Any 3 of the 5 blocks in a set rebuild a
password exactly. Please write and run a Python 3 program (standard library only)
that follows this specification precisely. Don't guess or skip checks. If a check
fails, tell me which block has the problem.

1. Reading a block. Blocks are Crockford Base32 text. Alphabet:
   0123456789ABCDEFGHJKMNPQRSTVWXYZ
   Make the text uppercase. Ignore spaces, dashes, dots and line breaks. Read the
   letter O as 0, and I or L as 1. If the text contains "r=", use only the part
   after "r=". Turn each character into 5 bits (most significant bit first), join
   them, and cut them into 8-bit bytes. Throw away leftover bits at the end.

2. Checking a block. The last 4 bytes are a checksum: they must equal the first
   4 bytes of SHA-256 of all the bytes before them. Then:
   byte 0 = version, must be 1
   byte 1 = 0x35 (any 3 of 5)
   byte 2 = the block number x, from 1 to 5
   bytes 3 to 6 = set ID, which must be the same on all 3 blocks
   bytes 7 up to (but not including) the checksum = the block data y

3. Combining. Use Shamir's method over GF(256) with the AES polynomial 0x11B
   (x^8 + x^4 + x^3 + x + 1). In this field, adding is XOR. For each byte
   position k, the result is the XOR over the 3 blocks i of  y_i[k] * L_i,
   where L_i is the product over the other two blocks j of  x_j / (x_j XOR x_i),
   using GF(256) multiplication and division.

4. Unpacking. The combined bytes are: 2 bytes big-endian length n, then n bytes of
   UTF-8 text (the password), then 4 bytes that must equal the first 4 bytes of
   SHA-256 of those n password bytes, then zero padding. If the 4 bytes match,
   the password is exactly those n bytes decoded as UTF-8, including any spaces
   at the start or end. If they don't match, something is wrong: don't return a
   result.

5. First test your program on these blocks, which must give back exactly
   "correct horse battery staple" (28 characters):
   Test block 1:
     04TG 30ZE P24M 075Y T4RJ PV13 ANND RTHW ZB54 0RKP KHG5 R08E
     B110 57AQ GWQD GZB9 FXWY XY27 02TZ F1P6 ZRAD GYCG WAYT 8QG
   Test block 3:
     04TG 70ZE P24W 6HC1 FKMG G4QD MSXK GTYE TP7S GNAY 6J1T H61T
     3TJS ADNF CNZK JKBC F6T7 XSQG 53WT QCPS TJ9R J174 TBB2 VZ0
   Test block 5:
     04TG B0ZE P24N 3MCE JQWH YEW7 B9N6 AH30 7H08 QM1Y 82Y8 3KS3
     7ATW 1TTJ WJYM HDRG 8R29 4FEP Y3CX TRQE PE5V Z2AZ J742 RSR

6. Then run it on my blocks below, and show me the password on its own line,
   exactly, with its length in characters.

My block 1: (type your first block here)
My block 2: (type your second block here)
My block 3: (type your third block here)