adworld-crypto-onetimepad

有限域GF，本原多项式P

• GF上的加法为异或运算
• GF上的减法为异或运算
• GF上的乘法为移位异或，且乘法群为循环群
• GF上的除法即为乘上逆元

有限域上的运算实现

拿到题目，给了三段密文和一段加密代码

af3fcc28377e7e983355096fd4f635856df82bbab61d2c50892d9ee5d913a07f
630eb4dce274d29a16f86940f2f35253477665949170ed9e8c9e828794b5543c
e913db07cbe4f433c7cdeaac549757d23651ebdccf69d7fbdfd5dc2829334d1b

#!/usr/bin/env python
# coding=utf-8

from os import urandom

def process(m, k):
    tmp = m ^ k		# 这里相当于 GF上的 m + k
    res = 0
    for i in bin(tmp)[2:]:
        res = res << 1
        if (int(i)):
            res = res ^ tmp
        if (res >> 256):
            res = res ^ P
    return res

def keygen(seed):
    key = str2num(urandom(32))
    while True:
        yield key
        key = process(key, seed)

def str2num(s):
    return int(s.encode('hex'), 16)

P = 0x10000000000000000000000000000000000000000000000000000000000000425

true_secret = open('flag.txt').read()[:32]
assert len(true_secret) == 32
print 'flag{%s}' % true_secret
fake_secret1 = "I_am_not_a_secret_so_you_know_me"
fake_secret2 = "feeddeadbeefcafefeeddeadbeefcafe"
secret = str2num(urandom(32))

generator = keygen(secret)
ctxt1 = hex(str2num(true_secret) ^ generator.next())[2:-1]
ctxt2 = hex(str2num(fake_secret1) ^ generator.next())[2:-1]
ctxt3 = hex(str2num(fake_secret2) ^ generator.next())[2:-1]
f = open('ciphertext', 'w')
f.write(ctxt1+'\n')
f.write(ctxt2+'\n')
f.write(ctxt3+'\n')
f.close()

在给定代码的process函数中，看到下面这样一段结构

res = 0
for i in bin(tmp)[2:]:
    res = res << 1
    if (int(i)):
        res = res ^ tmp
    if (res >> 256):
        res = res ^ P

很明显，这是在有限域GF上做一个平方运算，且该域为$GF(2^{256})$

jarvisoj上的bbencode题也就是这个结构

通过代码发现

P=0x10000000000000000000000000000000000000000000000000000000000000425

代码中还给了两个secr