[GKCTF 2021]RRRRsa

[GKCTF 2021]RRRRsa

题目

from Crypto.Util.number import *
from gmpy2 import gcd

flag = b'xxxxxxxxxxxxx'
p = getPrime(512)
q = getPrime(512)
m = bytes_to_long(flag)
n = p*q
e = 65537
c = pow(m,e,n)
print('c={}'.format(c))

p1 = getPrime(512)
q1 = getPrime(512)
n1 = p1*q1
e1 = 65537
assert gcd(e1,(p1-1)*(q1-1)) == 1
c1 = pow(p,e1,n1)
print('n1={}'.format(n1))
print('c1={}'.format(c1))
hint1 = pow(2020 * p1 + q1, 202020, n1)
hint2 = pow(2021 * p1 + 212121, q1, n1)
print('hint1={}'.format(hint1))
print('hint2={}'.format(hint2))

p2 = getPrime(512)
q2 = getPrime(512)
n2 = p2*q2
e2 = 65537
assert gcd(e1,(p2-1)*(q2-1)) == 1
c2 = pow(q,e2,n2)
hint3 = pow(2020 * p2 + 2021 * q2, 202020, n2)
hint4 = pow(2021 * p2 + 2020 * q2, 212121, n2)
print('n2={}'.format(n2))
print('c2={}'.format(c2))
print('hint3={}'.format(hint3))
print('hint4={}'.format(hint4))

#c=13492392717469817866883431475453770951837476241371989714683737558395769731416522300851917887957945766132864151382877462142018129852703437240533684604508379950293643294877725773675505912622208813435625177696614781601216465807569201380151669942605208425645258372134465547452376467465833013387018542999562042758
#n1=75003557379080252219517825998990183226659117019770735080523409561757225883651040882547519748107588719498261922816865626714101556207649929655822889945870341168644508079317582220034374613066751916750036253423990673764234066999306874078424803774652754587494762629397701664706287999727238636073466137405374927829
#c1=68111901092027813007099627893896838517426971082877204047110404787823279211508183783468891474661365139933325981191524511345219830693064573462115529345012970089065201176142417462299650761299758078141504126185921304526414911455395289228444974516503526507906721378965227166653195076209418852399008741560796631569
#hint1=23552090716381769484990784116875558895715552896983313406764042416318710076256166472426553520240265023978449945974218435787929202289208329156594838420190890104226497263852461928474756025539394996288951828172126419569993301524866753797584032740426259804002564701319538183190684075289055345581960776903740881951
#hint2=52723229698530767897979433914470831153268827008372307239630387100752226850798023362444499211944996778363894528759290565718266340188582253307004810850030833752132728256929572703630431232622151200855160886614350000115704689605102500273815157636476901150408355565958834764444192860513855376978491299658773170270
#n2=114535923043375970380117920548097404729043079895540320742847840364455024050473125998926311644172960176471193602850427607899191810616953021324742137492746159921284982146320175356395325890407704697018412456350862990849606200323084717352630282539156670636025924425865741196506478163922312894384285889848355244489
#c2=67054203666901691181215262587447180910225473339143260100831118313521471029889304176235434129632237116993910316978096018724911531011857469325115308802162172965564951703583450817489247675458024801774590728726471567407812572210421642171456850352167810755440990035255967091145950569246426544351461548548423025004
#hint3=25590923416756813543880554963887576960707333607377889401033718419301278802157204881039116350321872162118977797069089653428121479486603744700519830597186045931412652681572060953439655868476311798368015878628002547540835719870081007505735499581449077950263721606955524302365518362434928190394924399683131242077
#hint4=104100726926923869566862741238876132366916970864374562947844669556403268955625670105641264367038885706425427864941392601593437305258297198111819227915453081797889565662276003122901139755153002219126366611021736066016741562232998047253335141676203376521742965365133597943669838076210444485458296240951668402513

分析

题目大概意思就是 让我们通过hint1 hint2 hin3 hint4求出q1 p1 q2 p2以后，求出p q 进而求出flag

hint1 = pow(2020 * p1 + q1, 202020, n1)
hint2 = pow(2021 * p1 + 212121, q1, n1)
hint3 = pow(2020 * p2 + 2021 * q2, 202020, n2)
hint4 = pow(2021 * p2 + 2020 * q2, 212121, n2)

换成方程组的形式为:

$\{\begin{array}{l}hint1\equiv (2020\ast p1+q1{)}^{202020}(\mathrm{m}\mathrm{o}\mathrm{d}n1)①\\ hint2\equiv (2021\ast p1+212121{)}^{q1}(\mathrm{m}\mathrm{o}\mathrm{d}n1)②\\ hint3\equiv (2020\ast p2+2021\ast q2{)}^{202020}(\mathrm{m}\mathrm{o}\mathrm{d}n2)③\\ hint4\equiv (2021\ast p2+2020\ast q2{)}^{212121}(\mathrm{m}\mathrm{o}\mathrm{d}n2)④\\ n1=p1\ast q1⑤\\ n2=p2\ast q2⑥\end{array}$

其中①式可以通过二项式展开成

$hint1\equiv (2020\ast p1{)}^{202020}+(2020\ast p1{)}^{202019}\ast q1+....+q{1}^{202020}(\mathrm{m}\mathrm{o}\mathrm{d}n1)$

通过①和⑤，可以将中间含有$p1\ast q1$的项mod掉，即①变为:

$hint1\equiv (2020\ast p1{)}^{202020}+q{1}^{202020}(\mathrm{m}\mathrm{o}\mathrm{d}n1)$

同理③和④也可以通过该方法化简。

而②式就不能通过这种方法去化简，看一看能不能根据同余式相关的定理把他化简。

同样先展开看看

$hint2\equiv (2021\ast p1{)}^{q1}+(2021\ast p1{)}^{q1-1}\ast 212121+...+(2021\ast p1)\ast 212121^{q1-1}+212121^{q1}(\mathrm{m}\mathrm{o}\mathrm{d}n1)$

可以通过CRT中国剩余定理化为：

$\{\begin{array}{l}hint2\equiv (2021\ast p1{)}^{q1}+(2021\ast p1{)}^{q1-1}\ast 212121+...+(2021\ast p1)\ast 212121^{q1-1}+212121^{q1}(\mathrm{m}\mathrm{o}\mathrm{d}p1)I\\ hint2\equiv (2021\ast p1{)}^{q1}+(2021\ast p1{)}^{q1-1}\ast 212121+...+(2021\ast p1)\ast 212121^{q1-1}+212121^{q1}(\mathrm{m}\mathrm{o}\mathrm{d}q1)II\end{array}$

在II发现有两项可以用费马小定理化简，然后突然反应过来，如果不用二项式展开，他们的次方就都是q1次

即将②用CRT中国剩余定理化为：

$\{\begin{array}{l}hint2\equiv (2021\ast p1+212121{)}^{q1}(\mathrm{m}\mathrm{o}\mathrm{d}q1)I\\ hint2\equiv (2021\ast p1+212121{)}^{q1}(\mathrm{m}\mathrm{o}\mathrm{d}p1)II\end{array}$

即通过I化简为：

$hint2\equiv (2021\ast p1)+212121(\mathrm{m}\mathrm{o}\mathrm{d}q1)$

所以可以将条件分为两组（求p（p1 q1）&&求q(p2,q2)）：

$\{\begin{array}{l}hint1\equiv (2020\ast p1{)}^{202020}+q{1}^{202020}(\mathrm{m}\mathrm{o}\mathrm{d}n1)\\ hint2\equiv (2021\ast p1)+212121(\mathrm{m}\mathrm{o}\mathrm{d}q1)\end{array}\&\&\{\begin{array}{l}hint3\equiv (2020\ast p2{)}^{202020}+(2021\ast q2{)}^{202020}(\mathrm{m}\mathrm{o}\mathrm{d}n2)\\ hint4\equiv (2021\ast p2{)}^{212121}+(2020\ast q2{)}^{212121}(\mathrm{m}\mathrm{o}\mathrm{d}n2)\end{array}$

先求p(p1 q1)

$$\begin{gathered} hint1=(2020\ast p1{)}^{202020}+q{1}^{202020}+k1\ast n1\ast q1 \\ hint1=(2020\ast p1{)}^{202020}+q{1}^{202019}\ast q1+k1\ast n1\ast q1 \\ hint1=(2020\ast p1{)}^{202020}+(q{1}^{202019}+k1\ast n1)\ast q1 \\ hint1=(2020\ast p1{)}^{202020}+k1\ast q1I \\ hint2-212121=(2021\ast p1)+k2\ast q1 \\ (hint2-212121{)}^{202020}=(2021\ast p1{)}^{202020}+(k2\ast q1{)}^{202020}II \\ 2021^{202020}\ast I，2020^{202020}\ast II \end{gathered}$$

$\{\begin{array}{l}2021^{202020}\ast hint1=(2020\ast 2021\ast p1{)}^{202020}+2021^{202020}\ast k1\ast q1\\ 2020^{202020}\ast (hint2-212121{)}^{202020}=(2020\ast 2021\ast p1{)}^{202020}+(2020\ast k2\ast q1{)}^{202020}\end{array}$

$\{\begin{array}{l}2021^{202020}\ast hint1=(2020\ast 2021\ast p1{)}^{202020}+kk1\ast q1I\\ 2020^{202020}\ast (hint2-212121{)}^{202020}=(2020\ast 2021\ast p1{)}^{202020}+kk2\ast q1II\end{array}$

用下减上可以得到

$II-I=(kk2-kk1)\ast q1$

所以可以用$gcd(n1,II-I)=q1得到q1$

从而求得p1求得p

再求q(p2 q2)

可以利用相同的方法得到

$\{\begin{array}{l}2021^{202020}\ast hint3=(2020\ast 2021\ast p2{)}^{202020}+(2021^2\ast q2{)}^{202020}(\mathrm{m}\mathrm{o}\mathrm{d}n2)\\ 2020^{212121}\ast hint4=(2020\ast 2021\ast p2{)}^{212121}+(2020^2\ast q2{)}^{212121}(\mathrm{m}\mathrm{o}\mathrm{d}n2)\end{array}$

$\{\begin{array}{l}(2021^{202020}\ast hint3{)}^{212121}=(2020\ast 2021\ast p2{)}^{202020\ast 212121}+(2021^2\ast q2{)}^{202020\ast 212121}(\mathrm{m}\mathrm{o}\mathrm{d}n2)I\\ (2020^{212121}\ast hint4{)}^{202020}=(2020\ast 2021\ast p2{)}^{202020\ast 212121}+(2020^2\ast q2{)}^{202020\ast 212121}(\mathrm{m}\mathrm{o}\mathrm{d}n2)II\end{array}$

$II-I=(kk4-kk3)\ast q2$

所以可以用$gcd(n2,II-I)=q2得到q2$

从而求得p2求得q

解出p，q以后就可以解出flag了。

Solve

from Crypto.Util.number import *
from gmpy2 import gcd,invert
e = 65537
c=13492392717469817866883431475453770951837476241371989714683737558395769731416522300851917887957945766132864151382877462142018129852703437240533684604508379950293643294877725773675505912622208813435625177696614781601216465807569201380151669942605208425645258372134465547452376467465833013387018542999562042758
n1=75003557379080252219517825998990183226659117019770735080523409561757225883651040882547519748107588719498261922816865626714101556207649929655822889945870341168644508079317582220034374613066751916750036253423990673764234066999306874078424803774652754587494762629397701664706287999727238636073466137405374927829
c1=68111901092027813007099627893896838517426971082877204047110404787823279211508183783468891474661365139933325981191524511345219830693064573462115529345012970089065201176142417462299650761299758078141504126185921304526414911455395289228444974516503526507906721378965227166653195076209418852399008741560796631569
hint1=23552090716381769484990784116875558895715552896983313406764042416318710076256166472426553520240265023978449945974218435787929202289208329156594838420190890104226497263852461928474756025539394996288951828172126419569993301524866753797584032740426259804002564701319538183190684075289055345581960776903740881951
hint2=52723229698530767897979433914470831153268827008372307239630387100752226850798023362444499211944996778363894528759290565718266340188582253307004810850030833752132728256929572703630431232622151200855160886614350000115704689605102500273815157636476901150408355565958834764444192860513855376978491299658773170270
n2=114535923043375970380117920548097404729043079895540320742847840364455024050473125998926311644172960176471193602850427607899191810616953021324742137492746159921284982146320175356395325890407704697018412456350862990849606200323084717352630282539156670636025924425865741196506478163922312894384285889848355244489
c2=67054203666901691181215262587447180910225473339143260100831118313521471029889304176235434129632237116993910316978096018724911531011857469325115308802162172965564951703583450817489247675458024801774590728726471567407812572210421642171456850352167810755440990035255967091145950569246426544351461548548423025004
hint3=25590923416756813543880554963887576960707333607377889401033718419301278802157204881039116350321872162118977797069089653428121479486603744700519830597186045931412652681572060953439655868476311798368015878628002547540835719870081007505735499581449077950263721606955524302365518362434928190394924399683131242077
hint4=104100726926923869566862741238876132366916970864374562947844669556403268955625670105641264367038885706425427864941392601593437305258297198111819227915453081797889565662276003122901139755153002219126366611021736066016741562232998047253335141676203376521742965365133597943669838076210444485458296240951668402513

part1=(pow(2020,202020,n1)*(pow((hint2-212121),202020,n1)))%n1-((pow(2021,202020,n1)*hint1)%n1)
part1%=n1
q1=gcd(n1,part1)
p1=n1//q1
d1=invert(e,(q1-1)*(p1-1))
p=pow(c1,d1,n1)

part2=(pow((pow(2020,212121,n2)*hint4),202020,n2))-(pow((pow(2021,202020,n2)*hint3),212121,n2))
part2%=n2
q2=gcd(n2,part2)
p2=n2//q2
d2=invert(e,(q2-1)*(p2-1))
q=pow(c2,d2,n2)

d=invert(e,(q-1)*(p-1))
flag=pow(c,d,p*q)
print(long_to_bytes(flag))
b'GKCTF{f64310b5-d5e6-45cb-ae69-c86600cdf8d8}'

参考：https://blog.csdn.net/weixin_51867782/article/details/118573717