WACONCTF2023 Crypto Cry

WACONCTF2023 Crypto Cry

I participated in the WaconCTF competition last week, did the password part, and recorded the crypto question

Cry

---

• Descrpition:😭
• Solves:3

Task.py

from Crypto.Util.number import bytes_to_long, getStrongPrime, isPrime

SIZE = 512
e = 65537

with open("flag.txt", "rb") as f:
    m = bytes_to_long(f.read())


def encrypt(m):
    while True:
        p = getStrongPrime(SIZE)
        if p % 4 != 3:
            continue
        q = p**2 + 1
        assert q % 2 == 0
        if isPrime(q // 2):
            break

    r = getStrongPrime(SIZE * 3)
    n = p * q * r
    c = pow(m, e, n)
    return n, c

if __name__ == "__main__":
    n0, c0 = encrypt(m)
    n1, c1 = encrypt(c0)
    n2, c  = encrypt(c1)

    assert m < n0 and c0 < n1 and c1 < n2

    print(f"{n0 = }")
    print(f"{n1 = }")
    print(f"{n2 = }")
    print(f"{c = }")

Solution

---

In general,the question is factoring $n=p\ast (p^2+1)\ast r$,which p is 512bits and r is 512*3 bits.At first glance, it looks very similar to the Sus by maple3142 in the ictf a few weeks ago.

Refer to last thought about Sus,I want to construct a random_element k in ${\mathbb{F}}_{p^4}$,so k^n has the order $p^2-1$,just like ax+b in ${\mathbb{F}}_{p^2}$.How to constrain the element to two degrees of freedom not still four degrees.

Originally,I random choice the $f(x)$ to construct the quotient ring ${\mathbb{Z}}_n[x]/f(x)$,and random choice a element k,expect k^n has type $a\ast x+b$ since it’s order is p^2-1.

After I consult maple3142 and find the discuss on the discard.

Just Choice $f(x)$ as the type:
$$\begin{gathered} f(x)=(x+a{)}^{k}modm \\ thismaple3142^{\prime }sideaIhavenotgetit \end{gathered}$$
$$\begin{gathered} f(x)=x^4+a{x}^2+b \\ thiscanlettheelementorder{p}^2-1as0x^3+a{x}^2+0x+b \end{gathered}$$
$$\begin{gathered} f(x)=g^2+a,g^{\prime }sdegree=2 \\ thiscanlettheelementorder{p}^2-1ask\ast g+bequalto0x^3+a{x}^2+bx+c \end{gathered}$$

solve.sage

def fac(n):
    R = Zmod(n)["x"]
    while True:
        Q = R.quo(x ^ 4 + randint(0,n) * x ^ 2 + randint(0,n))
        t = Q.random_element() ^ n
        g = gcd(ZZ(t[3]), n) #or t[1]
        if 1 < g < n and g != 2:
            if g % 2 == 0:
                g = g // 2
            return g