每日刷题 7.13

warm up

from Crypto.Util.number import getStrongPrime, GCD
from random import randint
from flag import flag
import os

def pad(m: int, n: int):
  # PKCS#1 v1.5 maybe
  ms = m.to_bytes((m.bit_length() + 7) // 8, "big")
  ns = n.to_bytes((n.bit_length() + 7) // 8, "big")
  assert len(ms) <= len(ns) - 11

  ps = b""
  while len(ps) < len(ns) - len(ms) - 3:
    p = os.urandom(1)
    if p != b"\x00":
      ps += p
  return int.from_bytes(b"\x00\x02" + ps + b"\x00" + ms, "big")


while True:
  p = getStrongPrime(512)
  q = getStrongPrime(512)
  n = p * q
  phi = (p-1)*(q-1)
  e = 1337
  if GCD(phi, e) == 1:
    break

m = pad(int.from_bytes(flag, "big"), n)
c1 = pow(m, e, n)
c2 = pow(m // 2, e, n)

print("n =", n)
print("e =", e)
print("c1=", c1)
print("c2=", c2)

直接看主函数

c1=m^e mod n
c2=(m//2)^e mod n

可以构造c3=c2*2^e mod n
这样子感觉c3也等于m^e mod n 了
但是c3!=c1
m是奇数

c3=(m-1)^e mod n

这样就构成了related_message_attack

def related_message_attack(c1, c2, diff, e, n):
    PRx.< x > = PolynomialRing(Zmod(n))
    g1 = x ^ e - c1
    g2 = (x + diff) ^ e - c2

    def gcd(g1, g2):
        while g2:
            g1, g2 = g2, g1 % g2
        return g1.monic()

    return -gcd(g1, g2)[0]


if __name__ == '__main__':
    n = 113135121314210337963205879392132245927891839184264376753001919135175107917692925687745642532400388405294058068119159052072165971868084999879938794441059047830758789602416617241611903275905693635535414333219575299357763227902178212895661490423647330568988131820052060534245914478223222846644042189866538583089
    e = 1337
    c1= 89077537464844217317838714274752275745737299140754457809311043026310485657525465380612019060271624958745477080123105341040804682893638929826256518881725504468857309066477953222053834586118046524148078925441309323863670353080908506037906892365564379678072687516738199061826782744188465569562164042809701387515
    c2= 18316499600532548540200088385321489533551929653850367414045951501351666430044325649693237350325761799191454032916563398349042002392547617043109953849020374952672554986583214658990393359680155263435896743098100256476711085394564818470798155739552647869415576747325109152123993105242982918456613831667423815762
    c2_ = c2 * pow(2,e,n)%n

    m1 = related_message_attack(c1, c2_, -1, e, n)
    
	ms = int(m1).to_bytes((m1.bit_length() + 7) // 8, "big")
	print(ms)
#zer0pts{y0u_g07_47_13457_0v3r_1_p0in7}

rsa

浙师的一道rsa题

得到的是p相邻质数与q相邻质数的乘积
n和c

设p_=p+a
q_=q+b
n_=p_*q_=pq+aq+bp+ab
n=p*q
设s=n_-n=aq+bp+ab
而我们要求p
(s-ab)^2-4n*ab=(aq-bp)^2
s-a*b-(aq-bp)=2bp/2b=p
只要爆破a，b就好了

from gmpy2 import *
from Crypto.Util.number import long_to_bytes
n_=14233785218017561523427549764129133888410801937405042543608384794638882231260026439768940913248241994813040365019261590207671015021863775460551508126683685707521450333104917548908667903767306793964795289409659685209396396597227554445322460584023558730012055075833060764745007466432401928021336117897704730887670416768927672337677964290714550597600568429298221699648716921633068901353883948998903599058659542070118947492576518928418186712932926792789779394655691866868123443570557245730548669118968910472481699594289886611870716330210847358794021118096694062505555989342966084729820172623438268306776062004746756005827    
n=14233785218017561523427549764129133888410801937405042543608384794638882231260026439768940913248241994813040365019261590207671015021863775460551508126683685707521450333104917548908667903767306793964795289409659685209396396597227554445322460584023558730012055075833060764745007466432401928021336117897704730807001526796418874459262653269010050805445478077947359375104859206527750763562742113548953267910553466464257144910076016464319670824458715011248550028233525149999568175523132599184229580518635264332963606814447158506677704508111890282939569371852505020871097477121110247604848059496171967876089968129112279691787    
c=6909971391235120426969929645159492694245180553493170688384455395528880026264095781528449983208737981366859280710505606312242226424493215677583657170631510569997194553878866069533443896325051765975176119838518862738911330711618395941024704526641020596853651020122118936781031517870336553964625043083191787006414798451913618025949091586821489624371752964104686443066484925896291615405649389508964693993423607826989107021323425570133994104193066158297289023028007258400114180433143896560235193492515971098965506699893119979781920883228266956815844473828142781253269238329637022081737391678217749601980114153927801508703 
e=65537
s=n_-n
f=0
def hi(a,b):
    a=(s-a*b)^2-4*n*a*b
    return a
for i in range(1,3000):
    if f==1:
        break
    for j in range(1,3000):
        d=hi(i,j)
        if(d>0):
            b,g=iroot(d,2)
            if(g):
                p=(s-i*j-b)//(2*j)
                if(is_prime(p)):
                    f=1
                    break
q=n//p
d=invert(e,(p-1)*(q-1))
print(long_to_bytes(pow(c,d,n)))