2021天翼杯 密码官方wp

2021天翼杯

crypto

TryHash

审计题目代码，题目给出了一个feistel结构的加密算法，密钥长度为8字节。用随机生成的密钥对flag进行了加密。攻击者可以提供一段明文让服务器用同样的密钥进行加密。

密钥长度为8字节，直接爆破的复杂度为2^64,是不太现实的。

本题密码算法的设计漏洞其实在于其轮函数f的设计。具体来说其轮函数具有较差的差分性质。

def g(self,v1,v2,x):  
    value = (v1+v2+x)%256  
    value = ((value<<3) | (value>>5)) &0xff  
    return value  
  
def f(self,value):  
    v1,v2 = unpack('>2B',pack('>H',value))  
    v2 = self.g(v1,v2,1)  
    v1 = self.g(v1,v2,0)  
    value = unpack('>H',pack('>2B',v1,v2))  
    return value[0]  

具体来说，通过数学推导，我们可以发现，对于f来说，当其两个输入的差分为0x8080时，其输出差分100%是0x400。根据这一差分性质，我们可以对该加密算法进行差分分析攻击。差分分析的具体原理可以参考这个blog http://www.theamazingking.com/crypto-feal.php

我们以对最后一轮加密（即第3轮）进行攻击为例，介绍攻击的流程。

我们构造两个特殊的输入 (L0，R0)和 （L0’,R0’）其中 L0 = L0‘， R0 = R0’^0x8080,让服务器加密，得到加密结果 (L3,R3),(L3’,R3’).通过对该加密算法的推导，我们可以得到关于第3轮轮函数f的运算关系。

f(round3_key^L0)  = out1   
   f(round3_key^L0') = out2  
   out1^out2 = R0^L0^R0'^L0'^0x400  

其中，只有round3_key是未知的，其他参数都是已知的。round3_key的大小为2个字节，完全可以通过爆破来得到正确的解。这样我们就把对于整个key的求解，拆分到对于轮密钥的求解，爆破复杂度从 2^64降低到了 2^16

需要注意的是对于一组明密文对，可能有多个符合关系的解，我们可以同时对多组明密文对进行求解，来过滤掉错误的解。

依次类推，可以用相似的方法得到第1，2，3轮的轮密钥。有了这三轮的轮密钥后，可以通过逆运算很块的求解出第0轮的密钥，最终恢复出整个密钥。

完整解题脚本

from hashlib import sha256  
import random  
from pwn import *  
from pwnlib.util.iters import bruteforce  
from struct import pack, unpack  
  
def g(v1,v2,x):  
    value = (v1+v2+x)%256  
    value = ((value<<3) | (value>>5)) &0xff  
    return value  
  
def f(value):  
    v1,v2 = unpack('>2B',pack('>H',value))  
    v2 = g(v1,v2,1)  
    v1 = g(v1,v2,0)  
    value = unpack('>H',pack('>2B',v1,v2))  
    return value[0]  
  
def decrypt_ecb(cipher,key):  
    msg = ''  
    for i in range(0,len(cipher),4):  
        msg += decrypt(cipher[i:i+4],key)  
    return msg.strip('\x00')   
  
def decrypt(msg,key):  
    subkeys = unpack('>4H',key)  
    left,right = unpack('>2H',msg)  
    left = right^left  
    for i in range(3):  
        left,right = right,left  
        left = left^f(subkeys[2-i]^right)  
    right = right^subkeys[3]  
    return pack('>2H', left, right)  
  
def encrypt_ecb(msg,key):  
    l = len(msg)  
    if l%4 !=0:  
        msg = msg+'\x00'*(4-(l%4))  
    cipher = ''  
    for i in range(0,len(msg),4):  
        cipher += encrypt(msg[i:i+4],key)  
    return cipher  
  
def encrypt(msg,key):  
    subkeys = unpack('>4H',key)  
    left,right = unpack('>2H',msg)  
    right = right^subkeys[3]  
    for i in range(3):  
        tmp = left^f(subkeys[i]^right)   
        left = right  
        right = tmp  
    left = right^left  
    return pack('>2H', left, right)  
  
def dfa_f():  
    for i in range(1000):  
        input1 = random.randint(0,0xffff)  
        output1 = f(input1)  
        input2 = input1^0x8080  
        output2 = f(input2)  
  
        assert(output1^output2 == 0x400)  
  
def genpayload1(num):  
    payload = ''  
    for i in range(num):  
        data1 = random.randint(0,0xffff)  
        data2 = random.randint(0,0xffff)  
        data2diff = data2^0x8080  
        payload += pack('>2H',data1,data2)   
        payload += pack('>2H',data1,data2diff)   
    return payload  
    
def genpayload2(num):  
    payload = ''  
    for i in range(num):  
        data1 = random.randint(0,0xffff)  
        data2 = random.randint(0,0xffff)  
        data2diff = data2^0x400  
        payload += pack('>2H',data1,data2)   
        payload += pack('>2H',data1,data2diff)   
    return payload  
  
def testkey_round3(pairs,key):  
    for pair in pairs:  
        output1 = pair[0]  
        output2 = pair[1]  
        output1_0,output1_1 = unpack('>2H',output1)  
        output2_0,output2_1 = unpack('>2H',output2)  
        f_out_diff = output1_1 ^ output2_1 ^0x400  
        f_in1 = key^output1_0^output1_1  
        f_in2  = key^output2_0^output2_1  
        if(f(f_in1)^f(f_in2)==f_out_diff):  
            continue  
        else:  
            return False  
    return True  
  
def testkey_round2(pairs,key,r3key):  
    for pair in pairs:  
        output1 = pair[0]  
        output2 = pair[1]  
        output1_0,output1_1 = unpack('>2H',output1)  
        output2_0,output2_1 = unpack('>2H',output2)  
        output1_r3_1 = output1_0^output1_1   
        output2_r3_1 = output2_0^output2_1  
        f_out_diff  = output1_r3_1^output2_r3_1^0x400  
        f_in1 = key^output1_1^f(r3key^output1_r3_1)    
        f_in2  = key^output2_1^ f(r3key^output2_r3_1)  
        if(f(f_in1)^f(f_in2)==f_out_diff):  
            continue  
        else:  
            return False  
    return True  
  
def attack_round1(msg,cipher,keys):  
    ciphers = [cipher[i:i+4] for i in range(0,len(cipher),4)]  
    msgs = [msg[i:i+4] for i in range(0,len(msg),4)]  
    c = ciphers[0]  
    m = msgs[0]  
    output0,output1 = unpack('>2H',c)  
    output0 = output0^output1  
    input0,input1 = unpack('>2H',m)  
    candkeys = []  
    for key in keys:  
        r2k,r3k = key  
        output_r2_1 = output0  
        output_r2_0 = output1^f(r3k^output0)  
        output_r1_1 = output_r2_0   
        output_r1_0 = output_r2_1^f(r2k^output_r2_0)  
        k0 = output_r1_0^input1  
        for k in range(0x10000):  
            f_in = k^output_r1_0  
            f_out = output_r1_1^input0   
            if f(f_in) == f_out:  
                candkeys.append([k,r2k,r3k,k0])  
    return candkeys  
  
def attack_round2(msg,cipher,keys):  
    ciphers = [cipher[i:i+4] for i in range(0,len(cipher),4)]  
    cipher_pairs = [(ciphers[i],ciphers[i+1]) for i in range(0,len(ciphers),2)]  
    candkeys = []  
    for r3k in keys:  
        for key in range(0x10000):  
            if testkey_round2(cipher_pairs,key,r3k):  
                candkeys.append([key,r3k])  
    return candkeys  
  
def attack_round3(msg,cipher):  
    ciphers = [cipher[i:i+4] for i in range(0,len(cipher),4)]  
    cipher_pairs = [(ciphers[i],ciphers[i+1]) for i in range(0,len(ciphers),2)]  
    candkeys = []  
    for key in range(0x10000):  
        if testkey_round3(cipher_pairs,key):  
            candkeys.append(key)  
    return candkeys      
  
def exploit():  
    con = remote('127.0.0.1',10005)  
  
    context.log_level = 'debug'  
    con.recvuntil("XXXX+")  
    d = con.recvuntil(")")[:-1]  
    con.recvuntil(" == ")  
    target = con.recvline().strip()  
    ans = bruteforce(lambda x: sha256(x+d).hexdigest() == target,string.letters+string.digits,4)  
    con.sendlineafter("Give me XXXX",ans)  
    con.recvuntil('is:')  
    flag = con.recvline().strip()  
    payload = genpayload1(6)+genpayload2(6)  
    con.sendlineafter(':',payload)  
    cipher = con.recv(len(payload))  
    cipher_round3 = cipher[:48]  
    msg_round3 = payload[:48]  
    possible_keys = attack_round3(msg_round3,cipher_round3)  
    print 'round3 keys maybe:', possible_keys  
    cipher_round2 = cipher[48:96]  
    msg_round2 = payload[48:96]  
    possible_keys = attack_round2(msg_round2,cipher_round2,possible_keys)  
    print 'round2 keys maybe:', possible_keys  
    possible_keys = attack_round1(msg_round2,cipher_round2,possible_keys)  
    print 'round1&0 keys maybe:',possible_keys  
    for key in possible_keys:  
        real_key = pack('>4H',*key)  
        print 'decrypt with key ',repr(real_key)  
        print repr(decrypt_ecb(flag,real_key))  
    con.close()  
  
def exploit_local():  
    key = os.urandom(8)  
    print repr(key)  
    payload = genpayload1(6)+genpayload2(6)  
    cipher = encrypt_ecb(payload,key)  
    cipher_round3 = cipher[:48]  
    msg_round3 = payload[:48]  
    possible_keys = attack_round3(msg_round3,cipher_round3)  
    print 'round3 keys maybe:', possible_keys  
    cipher_round2 = cipher[48:96]  
    msg_round2 = payload[48:96]  
    possible_keys = attack_round2(msg_round2,cipher_round2,possible_keys)  
    print 'round2 keys maybe:', possible_keys  
    possible_keys = attack_round1(msg_round2,cipher_round2,possible_keys)  
    print 'round1&0 keys maybe:',possible_keys  
    flag = 'flag{test}'  
    flag = encrypt_ecb(flag,key)  
    print decrypt_ecb(flag,key)  
    for key in possible_keys:  
        real_key = pack('>4H',*key)  
        print 'decrypt with key ',repr(real_key)  
        print repr(decrypt_ecb(flag,real_key))  
  
exploit()  

babypack

由于题目中方案设计的缺陷，导致在公钥中

$$

2*A[i+1]-A[i]\approx n

$$

这其中插值于pq的乘积在高位比特上大多数是相等的，因此需要通过check功能拿到部分的低位比特。但仍然无法拿到完整的n，且就算拿到完整的n也无法通过分解来解出p,q。

这是注意发现，公钥A是通过UV和中国剩余定理来生成的，因此可以通过解二元一次方程得到uv值。再用公钥与uv的差值与n的最大公因数来确定n和得到p，q。

具体详见exp

from netcat import *  
from copy import deepcopy  
from gmpy2 import iroot, gcd  
import time  
  
start = time.time()  
r = remote("47.100.138.126", 10002)  
r.recv_until(b"your pubkey:\n")  
s = r.recv_until(b"\n").strip().decode()  
pub = eval(s)  
add = int(r.recv_until(b"\n").strip().decode())  
mult = int(r.recv_until(b"\n").strip().decode())  
#print(add)  
#print(mult)  
M = max(2 * pub[2] - pub[1], 2 * pub[3] - pub[2])  
Mbin = bin(M)[2:532]  
n = ["0"] * M.bit_length()  
for i in range(530):  
    n[i] = Mbin[i]  
  
r.recv_until(b">")  
r.sendline(b"1")  
r.recv_until(b">")  
tmp = int("".join(n), 2)  
r.sendline(str(tmp).encode())  
count = int(r.recv_until(b"\n").strip())  
#print(count)  
  
for i in range(498):  
    r.recv_until(b">")  
    r.sendline(b"1")  
    r.recv_until(b">")  
    n2 = deepcopy(n)  
    n2[530 + i] = str(int(n2[530 + i]) ^ 1)  
    tmp = int("".join(n2), 2)  
    r.sendline(str(tmp).encode())  
    count2 = int(r.recv_until(b"\n").strip())  
    if count2 > count:  
        n[530 + i] = str(int(n[530 + i]) ^ 1)  
        count = count2  
    #print(count)  
  
M = int("".join(n), 2)  
u = (add + iroot(add**2-4*mult, 2)[0]) // 2  
v = (add - iroot(add**2-4*mult, 2)[0]) // 2  
count = 0  
while True:  
    tmp1 = gcd(pub[0] - u, M)  
    tmp2 = gcd(pub[0] - v, M)  
    if tmp1.bit_length() > 100 or tmp2.bit_length() > 100:  
        p = max(tmp1, tmp2)  
        break  
    else:  
        M += 1  
        count += 1  
    #print(count)  
  
q = M // p  
if p < q:  
    p, q = q, p  
  
r.recv_until(b">")  
r.sendline(b"2")  
r.recv_until(b"\n")  
s = r.recv_until(b"\n").strip().decode()  
ct = int(s)  
c1 = ct % p  
c2 = ct % q  
pt = abs(c1 - c2)  
r.recv_until(b">")  
r.sendline(str(pt).encode())  
#print(pt)  
print(r.recv(1024))  
r.close()  
end = time.time()  
#print(end - start)  

Crypto_mycipher

from hashlib import sha256  
import random  
from pwn import *  
from pwnlib.util.iters import bruteforce  
from struct import pack, unpack  
  
def g(v1,v2,x):  
    value = (v1+v2+x)%256  
    value = ((value<<3) | (value>>5)) &0xff  
    return value  
  
def f(value):  
    v1,v2 = unpack('>2B',pack('>H',value))  
    v2 = g(v1,v2,1)  
    v1 = g(v1,v2,0)  
    value = unpack('>H',pack('>2B',v1,v2))  
    return value[0]  
  
def decrypt_ecb(cipher,key):  
    msg = ''  
    for i in range(0,len(cipher),4):  
        msg += decrypt(cipher[i:i+4],key)  
    return msg.strip('\x00')    
  
def decrypt(msg,key):  
    subkeys = unpack('>4H',key)  
    left,right = unpack('>2H',msg)  
    left = right^left  
    for i in range(3):  
        left,right = right,left  
        left = left^f(subkeys[2-i]^right)  
    right = right^subkeys[3]  
    return pack('>2H', left, right)  
  
def encrypt_ecb(msg,key):  
    l = len(msg)  
    if l%4 !=0:  
        msg = msg+'\x00'*(4-(l%4))  
    cipher = ''  
    for i in range(0,len(msg),4):  
        cipher += encrypt(msg[i:i+4],key)  
    return cipher  
  
def encrypt(msg,key):  
    subkeys = unpack('>4H',key)  
    left,right = unpack('>2H',msg)  
    right = right^subkeys[3]  
    for i in range(3):  
        tmp = left^f(subkeys[i]^right)   
        left = right  
        right = tmp  
    left = right^left  
    return pack('>2H', left, right)  
  
def dfa_f():  
    for i in range(1000):  
        input1 = random.randint(0,0xffff)  
        output1 = f(input1)  
        input2 = input1^0x8080  
        output2 = f(input2)  
  
        assert(output1^output2 == 0x400)  
  
def genpayload1(num):  
    payload = ''  
    for i in range(num):  
        data1 = random.randint(0,0xffff)  
        data2 = random.randint(0,0xffff)  
        data2diff = data2^0x8080  
        payload += pack('>2H',data1,data2)   
        payload += pack('>2H',data1,data2diff)   
    return payload  
    
def genpayload2(num):  
    payload = ''  
    for i in range(num):  
        data1 = random.randint(0,0xffff)  
        data2 = random.randint(0,0xffff)  
        data2diff = data2^0x400  
        payload += pack('>2H',data1,data2)   
        payload += pack('>2H',data1,data2diff)   
    return payload   
  
def testkey_round3(pairs,key):  
    for pair in pairs:  
        output1 = pair[0]  
        output2 = pair[1]  
        output1_0,output1_1 = unpack('>2H',output1)  
        output2_0,output2_1 = unpack('>2H',output2)  
        f_out_diff = output1_1 ^ output2_1 ^0x400  
        f_in1 = key^output1_0^output1_1  
        f_in2  = key^output2_0^output2_1  
        if(f(f_in1)^f(f_in2)==f_out_diff):  
            continue  
        else:  
            return False  
    return True  
  
def testkey_round2(pairs,key,r3key):  
    for pair in pairs:  
        output1 = pair[0]  
        output2 = pair[1]  
        output1_0,output1_1 = unpack('>2H',output1)  
        output2_0,output2_1 = unpack('>2H',output2)  
        output1_r3_1 = output1_0^output1_1   
        output2_r3_1 = output2_0^output2_1  
        f_out_diff  = output1_r3_1^output2_r3_1^0x400  
        f_in1 = key^output1_1^f(r3key^output1_r3_1)    
        f_in2  = key^output2_1^ f(r3key^output2_r3_1)  
        if(f(f_in1)^f(f_in2)==f_out_diff):  
            continue  
        else:  
            return False  
    return True  
  
def attack_round1(msg,cipher,keys):  
    ciphers = [cipher[i:i+4] for i in range(0,len(cipher),4)]  
    msgs = [msg[i:i+4] for i in range(0,len(msg),4)]  
    c = ciphers[0]  
    m = msgs[0]  
    output0,output1 = unpack('>2H',c)  
    output0 = output0^output1  
    input0,input1 = unpack('>2H',m)  
    candkeys = []  
    for key in keys:  
        r2k,r3k = key  
        output_r2_1 = output0  
        output_r2_0 = output1^f(r3k^output0)  
        output_r1_1 = output_r2_0   
        output_r1_0 = output_r2_1^f(r2k^output_r2_0)  
        k0 = output_r1_0^input1  
        for k in range(0x10000):  
            f_in = k^output_r1_0  
            f_out = output_r1_1^input0   
            if f(f_in) == f_out:  
                candkeys.append([k,r2k,r3k,k0])  
    return candkeys  
 
def attack_round2(msg,cipher,keys):  
    ciphers = [cipher[i:i+4] for i in range(0,len(cipher),4)]  
    cipher_pairs = [(ciphers[i],ciphers[i+1]) for i in range(0,len(ciphers),2)]  
    candkeys = []  
    for r3k in keys:  
        for key in range(0x10000):  
            if testkey_round2(cipher_pairs,key,r3k):  
                candkeys.append([key,r3k])  
    return candkeys  
  
def attack_round3(msg,cipher):  
    ciphers = [cipher[i:i+4] for i in range(0,len(cipher),4)]  
    cipher_pairs = [(ciphers[i],ciphers[i+1]) for i in range(0,len(ciphers),2)]  
    candkeys = []  
    for key in range(0x10000):  
        if testkey_round3(cipher_pairs,key):  
            candkeys.append(key)  
    return candkeys      
  
def exploit():  
    con = remote('127.0.0.1',10005)  
  
    context.log_level = 'debug'  
    con.recvuntil("XXXX+")  
    d = con.recvuntil(")")[:-1]  
    con.recvuntil(" == ")  
    target = con.recvline().strip()  
    ans = bruteforce(lambda x: sha256(x+d).hexdigest() == target,string.letters+string.digits,4)  
    con.sendlineafter("Give me XXXX",ans)  
    con.recvuntil('is:')  
    flag = con.recvline().strip()  
    payload = genpayload1(6)+genpayload2(6)  
    con.sendlineafter(':',payload)  
    cipher = con.recv(len(payload))  
    cipher_round3 = cipher[:48]  
    msg_round3 = payload[:48]  
    possible_keys = attack_round3(msg_round3,cipher_round3)  
    print 'round3 keys maybe:', possible_keys  
    cipher_round2 = cipher[48:96]  
    msg_round2 = payload[48:96]  
    possible_keys = attack_round2(msg_round2,cipher_round2,possible_keys)  
    print 'round2 keys maybe:', possible_keys  
    possible_keys = attack_round1(msg_round2,cipher_round2,possible_keys)  
    print 'round1&0 keys maybe:',possible_keys  
    for key in possible_keys:  
        real_key = pack('>4H',*key)  
        print 'decrypt with key ',repr(real_key)  
        print repr(decrypt_ecb(flag,real_key))  
    con.close()  
  
def exploit_local():  
    key = os.urandom(8)  
    print repr(key)  
    payload = genpayload1(6)+genpayload2(6)  
    cipher = encrypt_ecb(payload,key)  
    cipher_round3 = cipher[:48]  
    msg_round3 = payload[:48]  
    possible_keys = attack_round3(msg_round3,cipher_round3)  
    print 'round3 keys maybe:', possible_keys  
    cipher_round2 = cipher[48:96]  
    msg_round2 = payload[48:96]  
    possible_keys = attack_round2(msg_round2,cipher_round2,possible_keys)  
    print 'round2 keys maybe:', possible_keys  
    possible_keys = attack_round1(msg_round2,cipher_round2,possible_keys)  
    print 'round1&0 keys maybe:',possible_keys  
    flag = 'flag{test}'  
    flag = encrypt_ecb(flag,key)  
    print decrypt_ecb(flag,key)  
    for key in possible_keys:  
        real_key = pack('>4H',*key)  
        print 'decrypt with key ',repr(real_key)  
        print repr(decrypt_ecb(flag,real_key))  
  
exploit()