题目
from Crypto.Util.number import *
from gmpy2 import *
from secret import flag
p = getPrime(25)
e = # Hidden
q = getPrime(25)
n = p * q
m = bytes_to_long(flag.strip(b"npuctf{").strip(b"}"))
c = pow(m, e, n)
print(c)
print(pow(2, e, n))
print(pow(4, e, n))
print(pow(8, e, n))
'''
169169912654178
128509160179202
518818742414340
358553002064450
'''
解题很简单,就建立两个方程,然后求最大公因数就是 n 了;
已知条件:c1,c2,c3
未知条件:e
由 c1 = 2^e mod n,c2 = 2 ^ 2e mod n ,c3 = 2 ^ 3e mod n
所以:
c2 = c1 ^ 2 + k1 * n
c3 = c1 * c2 + k2 *n
所以 n = gcd( c1 ^ 2 - c2 , c1 * c2 -c3)
用yafu对 n 进行分解 ,得到:
P1 = 2
p = 28977097
q = 18195301
可知真正的 n是 p*q,后面就是常规RSA解题了。
from Crypto.Util.number import*
from gmpy2 import*
from sympy import*
from libnum import*
c = 169169912654178
c1 = 128509160179202
c2 = 518818742414340
c3 = 358553002064450
n = gcd(pow(c1,2)-c2,c1*c2-c3)
# print(n)
# P1 = 2
p = 28977097
q = 18195301
n = p*q
e = discrete_log(n,c1,2)
print(e)
phi = (p-1)*(q-1)
d= invert(e,phi)
m = n2s(pow(c,int(d),n))
print(m)