当时感觉是蒙过的，后面看了很多wp感觉没有完全讲清楚解题逻辑，计划用几天时间研究一下。
题目源码：
from Crypto.Util.number import getPrime
import hashlib
e = 2022
m = getPrime(512)
m1 = getPrime(512)
m2 = getPrime(512)
flag = m + m1 + m2
flag = hashlib.md5(str(flag).encode('utf-8')).hexdigest()
c1 = pow(m+m1,e,m*m1)
c2 = pow(m+m2,e,m*m2)
c3 = pow(m1+m2,e,m1*m2)
x = pow(m1+2022,m,m*m1)
y = pow(m2+2022,m,m*m2)
z = pow(m+2022,m1,m*m1)
print('c1 =',c1)
print('c2 =',c2)
print('c3 =',c3)
print('x =',x)
print('y =',y)
print('z =',z)
'''
c1 = 85139434329272123519094184286276070319638471046264384499440682030525456122476228324462769126167628121006213531153927884870307999106015430909361792093581895091445829379547633304737916675926004298753674268141399550405934376072486086468186907326396270307581239055199288888816051281495009808259009684332333344687
c2 = 104554808380721645840032269336579549039995977113982697194651690041676187039363703190743891658905715473980017457465221488358016284891528960913854895940235089108270134689312161783470000803482494370322574472422461483052403826282470850666418693908817591349159407595131136843764544166774390400827241213500917391144
c3 = 94771625845449128812081345291218973301979152577131568497740476123729158619324753128517222692750900524689049078606978317742545997482763600884362992468406577524708622046033409713416026145377740182233674890063333534646927601262333672233695863286637817471270314093720827409474178917969326556939942622112511819330
x = 78237329408351955465927092805995076909826011029371783256454322166600398149132623484679723362562600068961760410039241554232588011577854168402399895992331761353772415982560522912511879304977362225597552446397868843275129027248765252784503841114291392822052506837132093960290237335686354012448414804030938873765
y = 100442166633632319633494450595418167608036668647704883492068692098914206322465717138894302011092841820156560129280901426898815274744523998613724326647935591857728931946261379997352809249780159136988674034759483947949779535134522005905257436546335376141008113285692888482442131971935583298243412131571769294029
z = 104712661985900115750011628727270934552698948001634201257337487373976943443738367683435788889160488319624447315127992641805597631347763038111352925925686965948545739394656951753648392926627442105629724634607023721715249914976189181389720790879720452348480924301370569461741945968322303130995996793764440204452
'''
已知
c
1
c_1
c1,
c
2
c_2
c2,
c
3
c_3
c3,
x
x
x,
y
y
y,
z
z
z以及：
c
1
=
(
m
+
m
1
)
e
m
o
d
m
m
1
c_1=(m+m_1)^e \mod mm_1
c1=(m+m1)emodmm1
c
2
=
(
m
+
m
2
)
e
m
o
d
m
m
2
c_2=(m+m_2)^e \mod mm_2
c2=(m+m2)emodmm2
c
3
=
(
m
1
+
m
2
)
e
m
o
d
m
1
m
2
c_3=(m_1+m_2)^e \mod m_1m_2
c3=(m1+m2)emodm1m2
x
=
(
m
1
+
e
)
m
m
o
d
m
m
1
x=(m_1+e)^m \mod mm_1
x=(m1+e)mmodmm1
y
=
(
m
2
+
e
)
m
m
o
d
m
m
2
y=(m_2+e)^m \mod mm_2
y=(m2+e)mmodmm2
z
=
(
m
+
e
)
m
1
m
o
d
m
m
1
z=(m+e)^{m1} \mod mm_1
z=(m+e)m1modmm1
推导一下：
设
n
=
m
m
1
n=mm_1
n=mm1,则
(
m
1
+
e
)
m
=
x
m
o
d
n
(1)
(m_1+e)^m=x \mod n \tag{1}
(m1+e)m=xmodn(1)
(
m
+
m
1
)
e
=
c
1
m
o
d
n
(2)
(m+m_1)^e=c_1 \mod n \tag{2}
(m+m1)e=c1modn(2)
(1)式左边展开得到：
m
1
m
+
e
m
+
∑
i
=
1
m
−
1
C
m
i
m
1
i
e
m
−
i
m_1^m+e^m+\displaystyle\sum_{i=1}^{m-1} C_m^i m_1^i e^{m-i}
m1m+em+i=1∑m−1Cmim1iem−i
显然第三部分可被
n
n
n整除所以化简为：
m
1
m
+
e
m
=
x
m
o
d
n
(3)
m_1^m+e^m=x \mod n \tag{3}
m1m+em=xmodn(3)
根据费马小定理：
m
1
m
=
m
1
m
o
d
m
m_1^m=m_1 \mod m
m1m=m1modm以及
e
m
=
e
m
o
d
m
e^m=e \mod m
em=emodm
代入(3)式可得
m
1
+
e
+
k
1
m
=
x
+
k
2
m
m
1
m_1+e+k_1m=x+k_2mm_1
m1+e+k1m=x+k2mm1
即
m
1
+
e
=
x
+
k
3
m
m_1+e=x+k_3m
m1+e=x+k3m
将上式改写成
x
−
e
=
(
m
+
m
1
)
+
k
4
m
x-e=(m+m1)+k_4m
x−e=(m+m1)+k4m
两边同时取
e
e
e次方得到
(
x
−
e
)
e
=
(
m
+
m
1
)
e
+
(
k
4
m
)
e
+
∑
i
=
1
e
−
1
C
e
i
(
m
+
m
1
)
i
k
4
m
e
−
i
(x-e)^e=(m+m_1)^e+(k_4m)^e+\displaystyle\sum_{i=1}^{e-1} C_e^i (m+m_1)^i k_4m^{e-i}
(x−e)e=(m+m1)e+(k4m)e+i=1∑e−1Cei(m+m1)ik4me−i
显然右边后两部分都含有因子
m
m
m，所以可以化简为
(
x
−
e
)
e
=
(
m
+
m
1
)
e
+
k
5
m
(x-e)^e=(m+m_1)^e+k_5m
(x−e)e=(m+m1)e+k5m
由于
(
m
+
m
1
)
e
=
c
1
+
k
6
m
m
1
(m+m_1)^e=c_1+k_6mm_1
(m+m1)e=c1+k6mm1
所以
(
x
−
e
)
e
−
c
1
=
k
7
m
(x-e)^e-c_1 = k_7m
(x−e)e−c1=k7m
同理
(
y
−
e
)
e
−
c
2
=
k
8
m
(y-e)^e-c_2 = k_8m
(y−e)e−c2=k8m
计算
(
x
−
e
)
e
−
c
1
(x-e)^e-c_1
(x−e)e−c1与
(
y
−
e
)
e
−
c
2
(y-e)^e-c_2
(y−e)e−c2最大公约数即得到
m
m
m
20221015更新：
更简单的推导方式
c
1
=
(
m
+
m
1
)
e
+
k
1
m
m
1
c_1=(m+m_1)^e+k_1mm_1
c1=(m+m1)e+k1mm1
则
c
1
=
m
e
+
m
1
e
+
∑
i
=
1
e
−
1
C
e
i
m
i
m
1
e
−
i
+
k
1
m
m
1
c_1=m^e+m_1^e+\displaystyle\sum_{i=1}^{e-1} C_e^i m^i m_1^{e-i}+k_1mm_1
c1=me+m1e+i=1∑e−1Ceimim1e−i+k1mm1
将
m
m
m的系数归并可得
c
1
=
m
1
e
+
k
2
m
c_1=m_1^e+k_2m
c1=m1e+k2m
即
c
1
=
m
1
e
m
o
d
m
(1)
c_1=m_1^e \mod m \tag{1}
c1=m1emodm(1)
另有
x
=
(
m
1
+
e
)
m
+
k
3
m
m
1
x=(m_1+e)^m + k_3mm_1
x=(m1+e)m+k3mm1
由于
m
m
m是素数，根据费马小定理:
(
m
1
+
e
)
m
=
m
1
+
e
+
k
4
m
(m_1+e)^m=m_1+e+k_4m
(m1+e)m=m1+e+k4m
则
x
=
m
1
+
e
+
k
4
m
+
k
3
m
m
1
=
m
1
+
e
+
k
5
m
x=m_1+e+k4m+k_3mm_1=m_1+e+k_5m
x=m1+e+k4m+k3mm1=m1+e+k5m
即
x
=
m
1
+
e
m
o
d
m
⟹
x
−
e
=
m
1
m
o
d
m
x=m_1+e \mod m \Longrightarrow x-e=m_1 \mod m
x=m1+emodm⟹x−e=m1modm
根据同余式性质
(
x
−
e
)
e
=
m
1
e
m
o
d
m
(2)
(x-e)^e=m_1^e \mod m \tag{2}
(x−e)e=m1emodm(2)
联合(1)(2)得
(
x
−
e
)
e
−
c
1
=
0
m
o
d
m
(x-e)^e-c_1=0 \mod m
(x−e)e−c1=0modm
同理
(
y
−
e
)
e
−
c
2
=
0
m
o
d
m
(y-e)^e-c_2=0 \mod m
(y−e)e−c2=0modm
计算
(
x
−
e
)
e
−
c
1
(x-e)^e-c_1
(x−e)e−c1与
(
y
−
e
)
e
−
c
2
(y-e)^e-c_2
(y−e)e−c2最大公约数即得到
m
m
m
再根据
m
1
=
x
−
e
+
k
6
m
m_1=x-e+k_6m
m1=x−e+k6m
和
m
2
=
y
−
e
+
k
7
m
m_2=y-e+k_7m
m2=y−e+k7m
求出
m
1
,
m
2
m_1,m_2
m1,m2
最终exp为：
from Crypto.Util.number import getPrime
import hashlib
from gmpy2 import *
e = 2022
c1 = 85139434329272123519094184286276070319638471046264384499440682030525456122476228324462769126167628121006213531153927884870307999106015430909361792093581895091445829379547633304737916675926004298753674268141399550405934376072486086468186907326396270307581239055199288888816051281495009808259009684332333344687
c2 = 104554808380721645840032269336579549039995977113982697194651690041676187039363703190743891658905715473980017457465221488358016284891528960913854895940235089108270134689312161783470000803482494370322574472422461483052403826282470850666418693908817591349159407595131136843764544166774390400827241213500917391144
c3 = 94771625845449128812081345291218973301979152577131568497740476123729158619324753128517222692750900524689049078606978317742545997482763600884362992468406577524708622046033409713416026145377740182233674890063333534646927601262333672233695863286637817471270314093720827409474178917969326556939942622112511819330
x = 78237329408351955465927092805995076909826011029371783256454322166600398149132623484679723362562600068961760410039241554232588011577854168402399895992331761353772415982560522912511879304977362225597552446397868843275129027248765252784503841114291392822052506837132093960290237335686354012448414804030938873765
y = 100442166633632319633494450595418167608036668647704883492068692098914206322465717138894302011092841820156560129280901426898815274744523998613724326647935591857728931946261379997352809249780159136988674034759483947949779535134522005905257436546335376141008113285692888482442131971935583298243412131571769294029
z = 104712661985900115750011628727270934552698948001634201257337487373976943443738367683435788889160488319624447315127992641805597631347763038111352925925686965948545739394656951753648392926627442105629724634607023721715249914976189181389720790879720452348480924301370569461741945968322303130995996793764440204452
print("solve m=");
m = gcd(pow(x-2022,e)-c1,pow(y-2022,e)-c2)
print(m);
om1=(x-2022)%m
om2=(y-2022)%m
for i in range (0,10):
m1=om1+i*m
for j in range (0,10):
m2=om2+j*m
tmpc1 = pow(m+m1,e,m*m1)
tmpc2 = pow(m+m2,e,m*m2)
tmpc3 = pow(m1+m2,e,m1*m2)
tmpx = pow(m1+2022,m,m*m1)
tmpy = pow(m2+2022,m,m*m2)
tmpz = pow(m+2022,m1,m*m1)
if(tmpc1==c1 and tmpc2==c2 and tmpc3==c3 and tmpx==x and tmpy==y and tmpz==z):
print(str(i)+":"+str(j)+"correct!")
cm1=m1
cm2=m2
break
else:
continue
flag = m + cm1 + cm2
#print(str(flag))
print("solve flag=");
print(hashlib.md5(str(flag).encode('utf-8')).hexdigest())
扫一扫
3963
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
