0xGame Crypto 复现（Week3）

B_D

题目：

from Crypto.Util.number import *
from random import getrandbits
from gmpy2 import iroot
from secret import flag

p = getPrime(1024)
q = getPrime(1024)
N = p * q
print(f'N = {N}')
phi = (p - 1) * (q - 1)
d = int(iroot(N, 4)[0]) ^ getrandbits(250)
e = inverse(d, phi)
print(f'e = {e}')
m = bytes_to_long(flag)
c = pow(m, e, N)
print(f'c = {c}')

'''
N = 13715167883327838365274013103811076297254519716291174626890031505049627611641807596962804506207157502045195781365630439474317484673473403986343702501452710346860882791228915615232698948400931145542432966628624716533536281875822030435151439206091534065530955853558251844179933228948946231934907101348856917824632780140302729089040084528299043022659493046663327556618853280458205340179780170389837210862308567364916986243860683903949615558074610280891213861381781319433048939289437463860265900778945092793308233742580280756443573234593229072279867130716077271555451455116619361480980560826274232688876999336924667363487
e = 1615862820938647108786482341931683353132461038363662791095097725090528207925144493492927418779285810993803186019668893476085410570338701324011680380009723017909177619155864350030705272863925396654868568018042490841315909498209546400543778057365091655159015236972999269615383129191650099946771227478019788434779769416560521875995741538043223514581448653783898100814268462500355130172367409153557166306640544650178710024155132465062731524785656554977071144060691933041728644548295325756367557081623679286709670138138897259434915699217267474125159279020820148982619570258333277071070481182133532212027568829026138356701
c = 5840501258024718864832142987890599173450298697953071330840633894213580157775134582366948009609464376347860855722853624706859551014578993970405414872475110788174945766031263741375838245446993873866074337521205610057099008802133355317057766130687125151837582629432432658067853766874748078066930025360520657828177656684371518932673114544966498967187329934293660732818645061628470501507505692848153374443370177624402249696242245782230674035636514120771392032684619892427019580836399492234567981411499400095809897517092318731307728822816363313767096033957040393013220969966377537175857321999311476688402271035503547204592
'''

利用维纳攻击脚本解出d，之后就是基础的rsa解密

blocker

from Crypto.Util.number import *
import random
from secret import flag

a = random.getrandbits(32)
b = random.getrandbits(32)


def circular_shift_left(int_value, k, bit=32):
    bin_value = bin(int_value)[2:].zfill(32)
    bin_value = bin_value[k:] + bin_value[:k]
    int_value = int(bin_value, 2)
    return int_value


def enc_block(block):
    block = bytes_to_long(block)
    block ^= a
    block = circular_shift_left(block, 11)
    block ^= b
    return block


def enc_msg(msg):
    block_length = 4
    msg = msg + ((block_length - len(msg) % block_length) % block_length) * b'\x00'
    plain_block = [msg[block_length * i: block_length * (i + 1)] for i in range(len(msg) // block_length)]
    cipher = b""
    IV = bytes_to_long(b"0xgm")
    for block in plain_block:
        c = enc_block(block) ^ IV
        IV = c
        cipher += long_to_bytes(c)
    return cipher


print("a =", a)
print("b =", b)
print("cipher =", enc_msg(flag))

'''
a = 232825750
b = 1828860569
cipher = b'\x9a]\xec\x18\xd9\x98\x1d\x85\x0b}V\xf0\xc9\x98\x8d\x85"<\xf4\x02+\xa1m\xe7\xa0\xa6dJ\x8b\x93u?\x0b\x8d\xf62'
'''

块密码，把加密的过程逆过来。知识匮乏，先把官方wp记着吧：

from Crypto.Util.number import *
a = 232825750
b = 1828860569
cipher = b'\x9a]\xec\x18\xd9\x98\x1d\x85\x0b}V\xf0\xc9\x98\x8d\x85"<\xf4\x02+\xa1m\xe7\xa0\xa6dJ\x8b\x93u?\x0b\x8d\xf62'
block_length = 4
def circular_shift_left(int_value, k, bit=32):
    bin_value = bin(int_value)[2:].zfill(32)
    bin_value = bin_value[k:] + bin_value[:k]
    int_value = int(bin_value, 2)
    return int_value
def dec_block(block):
    block ^= b
    block = circular_shift_left(block, 21)
    block ^= a
    block = long_to_bytes(block)
    return block
ff = []
flag = b""
plain_block = [cipher[block_length * i: block_length * (i + 1)] for i in range(len(cipher) // block_length)]
flag += (dec_block(bytes_to_long(b'0xgm') ^ bytes_to_long(plain_block[0])))
for i in range(8):
    flag += (dec_block(bytes_to_long(plain_block[i]) ^ bytes_to_long(plain_block[i + 1])))
print(flag)

Euler 

from Crypto.Util.number import *
import random
from secret import flag

n = 1
phi = 1
for i in range(20):
    tmp = getPrime(50)
    n *= tmp
m = bytes_to_long(flag)
e = random.getrandbits(32)
l = pow(3, pow(3, e), n)
c = l ^ m

print(e)
print(n)
print(c)
'''
231259269673028
29929378538095242599885557965311297229924523708488195903349782032363055913634371143193552305707368798772150932190898234995143081146304332830718576568862215833419088712212229994786373886002933885241338295986566059232256985357837569354103718470254246398122059607732272010616255443856829833332931407591
14115545351007949046897492137862741044898077109960419446496565606468622772683580281638816799144770994249828910260693306203880085794955034747476060153997656323523503375955659777681988740544687254199590802537529515579620119333945661254265030658518256358717772703818654480106524239143719389868004689600
'''

wp： 

from functools import reduce
from Crypto.Util.number import *

n = 29929378538095242599885557965311297229924523708488195903349782032363055913634371143193552305707368798772150932190898234995143081146304332830718576568862215833419088712212229994786373886002933885241338295986566059232256985357837569354103718470254246398122059607732272010616255443856829833332931407591
factors = [1031597280836669, 831763169751037, 1047241102139227,1121166222643673, 1106502088074143, 724280506692727,564473023238051, 722283223420861, 712230248080397, 995107014561889,755979891579641, 1108754952183367,1002598179716267, 627339010540087, 681606630260771, 986358416636413,771609538687643, 729341978292667,585469394406137, 1098486200089483]
phi = 1
for i in factors:
    phi *= i-1
c = 14115545351007949046897492137862741044898077109960419446496565606468622772683580281638816799144770994249828910260693306203880085794955034747476060153997656323523503375955659777681988740544687254199590802537529515579620119333945661254265030658518256358717772703818654480106524239143719389868004689600
e = 231259269673028
p = pow(3, e, phi)
l = pow(3, p, n)
m = l ^ c
print(long_to_bytes(m))

签个名吧 

from Crypto.Util.number import *
from hashlib import *
from secret import secretkey, flag

assert flag == '0xGame{' + md5(str(secretkey).encode()).hexdigest() + '}'


class DigitalSignatureAlgorithm:
    def __init__(self):
        self.p = 11165563731567620813280603348108480503936143873639953843877402138097093301295650519258404426227037499368315956021156867415800042556171179986919811355886447
        self.q = 1427665647738374763020227949129429759446792665193
        self.g = 8385242253270806088154521306824584871033482078620830257754618478173828281256533554013845296082505886967783284208873604051466162625518031631615203713726934
        self.k = getRandomRange(1, self.q)

    def sign(self, m, x):
        z = bytes_to_long(sha256(m).digest())
        r = int(pow(self.g, self.k, self.p)) % self.q
        s = (int(inverse(self.k, self.q)) * (z + x * r)) % self.q
        return r, s


DSA = DigitalSignatureAlgorithm()
x = secretkey
y = pow(DSA.g, x, DSA.p)
print(y)

m0 = b'0xGame'
m1 = b'hack_fun'

r0, s0 = DSA.sign(m0, x)
r1, s1 = DSA.sign(m1, x)
print(r0, s0)
print(r1, s1)

'''
629561663141556350240195805457452624173044316397843833361377725186629298877124510669391999570948536274320600603150740845095742614597958058723489543231707
9569108440001628337054549116871993930089020799 1155391566683353144613828381835889947132557976718
9569108440001628337054549116871993930089020799 182166581822791423481695372664923137176789829383
'''

DSA 签名的相关攻击，注意到本题两次签名使用了相同的k ，针对该点进行攻击，知识匮乏，先把官方wp记着吧：

from hashlib import *
from Crypto.Util.number import *

s0 = 1155391566683353144613828381835889947132557976718
s1 = 182166581822791423481695372664923137176789829383
q = 1427665647738374763020227949129429759446792665193
m0 = b'0xGame'
m1 = b'hack_fun'
hm0 = bytes_to_long(sha256(m0).digest())
hm1 = bytes_to_long(sha256(m1).digest())
k = (inverse(s1 - s0, q) * (hm1 - hm0)) % q
# print(k)
r0 = 9569108440001628337054549116871993930089020799
x = inverse(r0, q) * (s0 * k - hm0) % q
# print(x)
flag = '0xGame{' + md5(str(x).encode()).hexdigest() + '}'
print(flag)