多次使用流密码破解范例(Many Time Pad)_html?inviteid=5dd1745789184fd38358978799e63dae-CSDN博客

本文链接：https://blog.csdn.net/Lynn_coder/article/details/101179763

Many Time Pad

Let us see what goes wrong when a stream cipher key is used more than once. Below are eleven hex-encoded ciphertexts that are the result of encrypting eleven plaintexts with a stream cipher, all with the same stream cipher key. Your goal is to decrypt the last ciphertext, and submit the secret message within it as solution.

Hint: XOR the ciphertexts together, and consider what happens when a space is XORed with a character in [a-zA-Z].

ciphertext #1:

315c4eeaa8b5f8aaf9174145bf43e1784b8fa00dc71d885a804e5ee9fa40b16349c146fb778cdf2d3aff021dfff5b403b510d0d0455468aeb98622b137dae857553ccd8883a7bc37520e06e515d22c954eba5025b8cc57ee59418ce7dc6bc41556bdb36bbca3e8774301fbcaa3b83b220809560987815f65286764703de0f3d524400a19b159610b11ef3e

ciphertext #2:

234c02ecbbfbafa3ed18510abd11fa724fcda2018a1a8342cf064bbde548b12b07df44ba7191d9606ef4081ffde5ad46a5069d9f7f543bedb9c861bf29c7e205132eda9382b0bc2c5c4b45f919cf3a9f1cb74151f6d551f4480c82b2cb24cc5b028aa76eb7b4ab24171ab3cdadb8356f

ciphertext #3:

32510ba9a7b2bba9b8005d43a304b5714cc0bb0c8a34884dd91304b8ad40b62b07df44ba6e9d8a2368e51d04e0e7b207b70b9b8261112bacb6c866a232dfe257527dc29398f5f3251a0d47e503c66e935de81230b59b7afb5f41afa8d661cb

ciphertext #4:

32510ba9aab2a8a4fd06414fb517b5605cc0aa0dc91a8908c2064ba8ad5ea06a029056f47a8ad3306ef5021eafe1ac01a81197847a5c68a1b78769a37bc8f4575432c198ccb4ef63590256e305cd3a9544ee4160ead45aef520489e7da7d835402bca670bda8eb775200b8dabbba246b130f040d8ec6447e2c767f3d30ed81ea2e4c1404e1315a1010e7229be6636aaa

ciphertext #5:

3f561ba9adb4b6ebec54424ba317b564418fac0dd35f8c08d31a1fe9e24fe56808c213f17c81d9607cee021dafe1e001b21ade877a5e68bea88d61b93ac5ee0d562e8e9582f5ef375f0a4ae20ed86e935de81230b59b73fb4302cd95d770c65b40aaa065f2a5e33a5a0bb5dcaba43722130f042f8ec85b7c2070

ciphertext #6:

32510bfbacfbb9befd54415da243e1695ecabd58c519cd4bd2061bbde24eb76a19d84aba34d8de287be84d07e7e9a30ee714979c7e1123a8bd9822a33ecaf512472e8e8f8db3f9635c1949e640c621854eba0d79eccf52ff111284b4cc61d11902aebc66f2b2e436434eacc0aba938220b084800c2ca4e693522643573b2c4ce35050b0cf774201f0fe52ac9f26d71b6cf61a711cc229f77ace7aa88a2f19983122b11be87a59c355d25f8e4

ciphertext #7:

32510bfbacfbb9befd54415da243e1695ecabd58c519cd4bd90f1fa6ea5ba47b01c909ba7696cf606ef40c04afe1ac0aa8148dd066592ded9f8774b529c7ea125d298e8883f5e9305f4b44f915cb2bd05af51373fd9b4af511039fa2d96f83414aaaf261bda2e97b170fb5cce2a53e675c154c0d9681596934777e2275b381ce2e40582afe67650b13e72287ff2270abcf73bb028932836fbdecfecee0a3b894473c1bbeb6b4913a536ce4f9b13f1efff71ea313c8661dd9a4ce

ciphertext #8:

315c4eeaa8b5f8bffd11155ea506b56041c6a00c8a08854dd21a4bbde54ce56801d943ba708b8a3574f40c00fff9e00fa1439fd0654327a3bfc860b92f89ee04132ecb9298f5fd2d5e4b45e40ecc3b9d59e9417df7c95bba410e9aa2ca24c5474da2f276baa3ac325918b2daada43d6712150441c2e04f6565517f317da9d3

ciphertext #9:

271946f9bbb2aeadec111841a81abc300ecaa01bd8069d5cc91005e9fe4aad6e04d513e96d99de2569bc5e50eeeca709b50a8a987f4264edb6896fb537d0a716132ddc938fb0f836480e06ed0fcd6e9759f40462f9cf57f4564186a2c1778f1543efa270bda5e933421cbe88a4a52222190f471e9bd15f652b653b7071aec59a2705081ffe72651d08f822c9ed6d76e48b63ab15d0208573a7eef027

ciphertext #10:

466d06ece998b7a2fb1d464fed2ced7641ddaa3cc31c9941cf110abbf409ed39598005b3399ccfafb61d0315fca0a314be138a9f32503bedac8067f03adbf3575c3b8edc9ba7f537530541ab0f9f3cd04ff50d66f1d559ba520e89a2cb2a83

target ciphertext (decrypt this one):

32510ba9babebbbefd001547a810e67149caee11d945cd7fc81a05e9f85aac650e9052ba6a8cd8257bf14d13e6f0a803b54fde9e77472dbff89d71b57bddef121336cb85ccb8f3315f4b52e301d16e9f52f904

问题分析

根据提示，一个小写字母的ascii码值和一个空格的ascii异或，结果会得到这个字母的大写。

比如，a（01100001）^ space(001000000) = A

又因为，每一个ciphertext都是用相同的key加密的。因此，假设明文分别为m1、m2，那么c1 = m1 ^ k， c2 = m2 ^ k，于是c1 ^ c2= m1 ^ k ^ m2 ^ k = m1 ^ m2。这样我们就把k消去，只剩下了m1和m2。

目前我们拥有10段密文，如果我们能知道这10段明文中，每一段的哪几个位置代表着空格，再把这个位置与目标密文进行异或，就可以得到目标密文的明文了。

举个例子：

给出一段密文32510ba9babe。已知了第三第四位，即51，代表着一个空格。

那么给一段用相同key加密的密文466d06ece998b，用51和这段密文的第三第四位6d进行异或，就可以得到一个明文了。

于是问题就变成了，如何找到这十段密文中，哪些位置是空格。找到再把它们与目标密文的相同位置进行异或，问题迎刃而解。

算法分析

如何找到这十段密文中，哪些位置是空格？首先我们要知道，这里每两个16进制字符代表明文的一个字符。我们把10段密文的每一段进行两个两个划分，然后与剩余9个密文的相同位置进行异或，如果异或出来结果大部分都是字母，则说明了这个位置极有可能是个空格。在我的算法中，规定了每个位置与剩余9个位置异或，如果异或结果为字母的个数大于5个，则标记为这个位置是空格。最后把标记的位置，与目标密文中相同的位置进行异或，就可以得到目标密文这个位置的明文了。

代码java版

这个代码有些暴力，没有进行后续优化。但是由于数据量小，还是很快就能出结果的。

package com.ccnu;

import java.math.BigInteger;
import java.util.HashMap;
import java.util.Map;

public class Week1Q5 {
    static String[] cts = new String[10];
    //判断是否为a-z,A-Z
    static boolean isAlphabet(char c){
        if (c>=65&&c<=90)
            return true;
        if (c>=97&&c<=122)
            return true;
        return false;
    }

    public static void main( String[] args ){
        cts[0] = "315c4eeaa8b5f8aaf9174145bf43e1784b8fa00dc71d885a804e5ee9fa40b1" +
                "6349c146fb778cdf2d3aff021dfff5b403b510d0d0455468aeb98622b137dae857553ccd8883a7bc37520e06e515d22c954eba50";
        cts[1] = "234c02ecbbfbafa3ed18510abd11fa724fcda2018a1a8342cf064bbde548b12b07df" +
                "44ba7191d9606ef4081ffde5ad46a5069d9f7f543bedb9c861bf29c7e205132eda9382b0bc2c5c4b45f919cf3a9f1cb741";

        cts[2] = "32510ba9a7b2bba9b8005d43a304b5714cc0bb0c8a34884dd91304b8ad40b62b07df" +
                "44ba6e9d8a2368e51d04e0e7b207b70b9b8261112bacb6c866a232dfe257527dc29398f5f3251a0d47e503c66e935de812";

        cts[3] = "32510ba9aab2a8a4fd06414fb517b5605cc0aa0dc91a8908c2064ba8ad5ea06a0290" +
                "56f47a8ad3306ef5021eafe1ac01a81197847a5c68a1b78769a37bc8f4575432c198ccb4ef63590256e305cd3a9544ee41";

        cts[4] = "3f561ba9adb4b6ebec54424ba317b564418fac0dd35f8c08d31a1fe9e24fe56808c2" +
                "13f17c81d9607cee021dafe1e001b21ade877a5e68bea88d61b93ac5ee0d562e8e9582f5ef375f0a4ae20ed86e935de812";

        cts[5] = "32510bfbacfbb9befd54415da243e1695ecabd58c519cd4bd2061bbde24eb76a19d8" +
                "4aba34d8de287be84d07e7e9a30ee714979c7e1123a8bd9822a33ecaf512472e8e8f8db3f9635c1949e640c621854eba0d";

        cts[6] = "32510bfbacfbb9befd54415da243e1695ecabd58c519cd4bd90f1fa6ea5ba47b01c9" +
                "09ba7696cf606ef40c04afe1ac0aa8148dd066592ded9f8774b529c7ea125d298e8883f5e9305f4b44f915cb2bd05af513";

        cts[7] = "315c4eeaa8b5f8bffd11155ea506b56041c6a00c8a08854dd21a4bbde54ce56801d9" +
                "43ba708b8a3574f40c00fff9e00fa1439fd0654327a3bfc860b92f89ee04132ecb9298f5fd2d5e4b45e40ecc3b9d59e941";

        cts[8] = "271946f9bbb2aeadec111841a81abc300ecaa01bd8069d5cc91005e9fe4aad6e04d5" +
                "13e96d99de2569bc5e50eeeca709b50a8a987f4264edb6896fb537d0a716132ddc938fb0f836480e06ed0fcd6e9759f404";

        cts[9] = "466d06ece998b7a2fb1d464fed2ced7641ddaa3cc31c9941cf110abbf409ed395980" +
                "05b3399ccfafb61d0315fca0a314be138a9f32503bedac8067f03adbf3575c3b8edc9ba7f537530541ab0f9f3cd04ff50d";

        String targetText = "32510ba9babebbbefd001547a810e67149caee11d945cd7fc81a05e9f85aac650e90" +
                "52ba6a8cd8257bf14d13e6f0a803b54fde9e77472dbff89d71b57bddef121336cb85ccb8f3315f4b52e301d16e9f52f904";
        //截短
        for (int i=0;i<cts.length;i++){
            cts[i] = cts[i].substring(0,targetText.length());
        }
        Map<Integer,Character> resultMap = new HashMap<Integer, Character>();
        for (int i=0;i<cts.length;i++){//遍历10个密文
            for (int j=0;j<cts[0].length();j=j+2){//对于每个密文，遍历每个字符
                BigInteger tmpIndex = new BigInteger(cts[i].substring(j,j+2),16);//得到当前的每个字符的16进制
                //接下来用得到的字符和其他九个密文的同位置的字符进行异或，如果得到字母频率很高，说明此字符极有可能为空格
                int count = 0;//记录可能为空格的个数
                for (int k = 0;k<cts.length;k++){
                    BigInteger tmp = new BigInteger(cts[k].substring(j,j+2),16);
                    if (isAlphabet((char) tmpIndex.xor(tmp).intValue()))
                        count++;
                    if (count>5){//说明当前字符极有可能是空格，去和密文进行异或
                        BigInteger targetIndex = new BigInteger(targetText.substring(j,j+2),16);
                        //resultMap.put(j/2, (char) targetIndex.xor(tmpIndex).intValue());
                        char resultTmp = (char) targetIndex.xor(tmpIndex).intValue();
                        if (isAlphabet(resultTmp)){
                            resultMap.put(j,resultTmp);
                            break;
                        }else{
                            continue;
                        }
                    }
                }
            }
        }
        for (int i = 0;i<cts[0].length();i++){
            if (resultMap.get(i)!=null)
                System.out.print(resultMap.get(i).toString().toLowerCase());

        }

    }

}