有限域GF,本原多项式P
- GF上的加法为异或运算
- GF上的减法为异或运算
- GF上的乘法为移位异或,且乘法群为循环群
- GF上的除法即为乘上逆元
拿到题目,给了三段密文和一段加密代码
af3fcc28377e7e983355096fd4f635856df82bbab61d2c50892d9ee5d913a07f
630eb4dce274d29a16f86940f2f35253477665949170ed9e8c9e828794b5543c
e913db07cbe4f433c7cdeaac549757d23651ebdccf69d7fbdfd5dc2829334d1b
#!/usr/bin/env python
# coding=utf-8
from os import urandom
def process(m, k):
tmp = m ^ k # 这里相当于 GF上的 m + k
res = 0
for i in bin(tmp)[2:]:
res = res << 1
if (int(i)):
res = res ^ tmp
if (res >> 256):
res = res ^ P
return res
def keygen(seed):
key = str2num(urandom(32))
while True:
yield key
key = process(key, seed)
def str2num(s):
return int(s.encode('hex'), 16)
P = 0x10000000000000000000000000000000000000000000000000000000000000425
true_secret = open('flag.txt').read()[:32]
assert len(true_secret) == 32
print 'flag{%s}' % true_secret
fake_secret1 = "I_am_not_a_secret_so_you_know_me"
fake_secret2 = "feeddeadbeefcafefeeddeadbeefcafe"
secret = str2num(urandom(32))
generator = keygen(secret)
ctxt1 = hex(str2num(true_secret) ^ generator.next())[2:-1]
ctxt2 = hex(str2num(fake_secret1) ^ generator.next())[2:-1]
ctxt3 = hex(str2num(fake_secret2) ^ generator.next())[2:-1]
f = open('ciphertext', 'w')
f.write(ctxt1+'\n')
f.write(ctxt2+'\n')
f.write(ctxt3+'\n')
f.close()
在给定代码的process
函数中,看到下面这样一段结构
res = 0
for i in bin(tmp)[2:]:
res = res << 1
if (int(i)):
res = res ^ tmp
if (res >> 256):
res = res ^ P
很明显,这是在有限域GF上做一个平方运算,且该域为 G F ( 2 256 ) GF(2^{256}) GF(2256)
jarvisoj上的bbencode题也就是这个结构
通过代码发现
P=0x10000000000000000000000000000000000000000000000000000000000000425
代码中还给了两个secr