一.前言
中国剩余定理,又称中国余数定理,是数论中的一個关于一元线性同余方程组的定理,说明了一元线性同余方程组有解的准则以及求解方法。也称为孙子定理,古有「韩信点兵」、「孙子定理」、「求一术」(宋 沈括)、「鬼谷算」(宋 周密)、「隔墙算」(宋 周密)、「剪管术」(宋 杨辉)、「秦王暗点兵」、「物不知数」之名。目前在大数据、云计算、RSA密码等邻域也发挥着重大作用。
二.例子
物不知数
在《孙子算经》中有这样一个问题:“今有物不知其数,三三数之剩二(除以3 余2),
五五数之剩三(除以5 余3),七七数之剩二(除以7 余2),问物几何?”这个问题称为“孙
子问题”,该问题的一般解法国际上称为“中国剩余定理”。
《孙子算经》中给出了解法,术曰:三三数之剩二,置一百四十;五五数之剩三,置六十三;七七数之剩二,置三十,并之,得二百三十三。以二百一十减之,即得。翻译过来就是:三个三个数还剩下两个,那么算出一百四十;五个五个书还剩下三个,那么算出六十三;七个七个数还剩下两个,那么算出三十,把这三个数加起来,得到二百三十三。最后用二百三十三减去二百一十,就是算出来的答案。
其中一百四十、六十三、二十三、二百一十这几个数却不知道是怎么得出的。要算出这几个数,我们首先需要知道两个定理:
定理1:几个数相加,如果只有一个加数,不能被数a整除,而其他加数均能被数a整除,那么它们的和,就不能被整数a整除。如果有a % b = c,则有(a + kb)%b = c(k为非零整数)或者写成a≡ca≡c (mod b),则有a+kb≡ca+kb≡c(mod b)(k为非零整数)
定理2:二数不能整除,若被除数扩大(或缩小)了几倍,而除数不变,则其余数也同时扩大(或缩小)相同的倍数(余数必小于除数)。如果a%b=c,那么(a*k)%b = (a%b+a%b+…a%b)%b = (c+c+c+…+c)%b = k*c%b(k>0)
我们先把一百四十、六十三、二十三分解成几个质数相乘的形式。
140=2*2*5*7=b₁ * M₁' * m₂ * m₃(可以被5和7整除,但是除以3却余2,下同)
63=3*1*3*7=b₂ * M₂' * m₁ * m₃
30=2*1*3*5=b₃ * M₃' * m₁ * m₂
140+63+30=233(根据定理1,233满足题目条件,但还不是最小的那个数)
bᵢ为余数,mᵢ为模,m=m₁ * m₂ * m₃,,Mᵢ'=
mod m₁
为M₁的乘法逆元,下面将用R表示
,即MᵢR≡1(mod mᵢ)
这里提一嘴如何求乘法逆元。运用到扩展欧几里得算法:
MᵢR+mᵢy=1,MᵢR+mᵢy=1,变量是R和y,调用ex_gcd(Mᵢ,mᵢ,R,y)
//扩展欧几里得模板
int ex_gcd(int a,int b,int &x,int &y){
int d;
if(b == 0){
x = 1;
y = 0;
return a;
}
d = ex_gcd(b,a%b,y,x);
y -= a / b * x;
return d;
}
210=2*3*5*7,其中3*5*7表示的是模的最小公约数,而2并没有具体含义,是可以根据题意自由变动的数,利用上面求出的233减去210的实际作用是求出符合题目要求的最小数,即23。
下面是中国剩余定理的c代码:
//扩展欧几里得模板
int ex_gcd(int a,int b,int &x,int &y){
int d;
if(b == 0){
x = 1;
y = 0;
return a;
}
d = ex_gcd(b,a%b,y,x);
y -= a / b * x;
return d;
}
int Chinese_Remainder(int a[],int prime[],int len){
int i,d,R,y,M,m = 1,sum = 0;
//计算所有除数的积,也就是所有除数的最小公倍数m
for(i = 0; i < len; i++)
m *= prime[i];
//计算符合所有条件的数
for(i = 0; i < len; i++){
M = m / prime[i];//计算除去本身的所有除数的积M
d = ex_gcd(M,prime[i],R,y);
sum = (sum + R * M * a[i]) % m;
}
return (m + sum % m) % m;//满足所有方程的最小解
}
三、例题
1.
#a = flag mod m
a1=2891369521230520600
m1=5539166121540472709
a2=5485400237604727152
m2=9993590208169240051
a3=10305113992248275270
m3=23524210813213316809
a4=15126620242797492888
m4=38726457607077802967
a5=63558232650391605454
m5=134070550878039878083
从题目中可以明显看出,flag≡(mod
)
所以用中国剩余定理可以轻易求出flag的值,python代码如下:
import gmpy2
a1=2891369521230520600
d1=5539166121540472709
a2=5485400237604727152
d2=9993590208169240051
a3=10305113992248275270
d3=23524210813213316809
a4=15126620242797492888
d4=38726457607077802967
a5=63558232650391605454
d5=134070550878039878083
aa = [a1,a2,a3,a4,a5]
dd = [d1,d2,d3,d4,d5]
def GCRT(mi, ai):
assert (isinstance(mi, list) and isinstance(ai, list))
curm, cura = mi[0], ai[0]
for (m, a) in zip(mi[1:], ai[1:]):
d = gmpy2.gcd(curm, m)
c = a - cura
assert (c % d == 0)
K = c // d * gmpy2.invert(curm // d, m // d)
cura += curm * K
curm = curm * m // d
cura %= curm
return (cura % curm, curm) #
s,dd = GCRT(dd,aa)
import libnum
print(libnum.n2s(int(s)))
结果为actf{wow_are_you_my_CONFIDANT?}
2.
也可以运用于RSA密码中,例如:buuctf中的RSA4
N = 331310324212000030020214312244232222400142410423413104441140203003243002104333214202031202212403400220031202142322434104143104244241214204444443323000244130122022422310201104411044030113302323014101331214303223312402430402404413033243132101010422240133122211400434023222214231402403403200012221023341333340042343122302113410210110221233241303024431330001303404020104442443120130000334110042432010203401440404010003442001223042211442001413004
c = 310020004234033304244200421414413320341301002123030311202340222410301423440312412440240244110200112141140201224032402232131204213012303204422003300004011434102141321223311243242010014140422411342304322201241112402132203101131221223004022003120002110230023341143201404311340311134230140231412201333333142402423134333211302102413111111424430032440123340034044314223400401224111323000242234420441240411021023100222003123214343030122032301042243
N = 302240000040421410144422133334143140011011044322223144412002220243001141141114123223331331304421113021231204322233120121444434210041232214144413244434424302311222143224402302432102242132244032010020113224011121043232143221203424243134044314022212024343100042342002432331144300214212414033414120004344211330224020301223033334324244031204240122301242232011303211220044222411134403012132420311110302442344021122101224411230002203344140143044114
c = 112200203404013430330214124004404423210041321043000303233141423344144222343401042200334033203124030011440014210112103234440312134032123400444344144233020130110134042102220302002413321102022414130443041144240310121020100310104334204234412411424420321211112232031121330310333414423433343322024400121200333330432223421433344122023012440013041401423202210124024431040013414313121123433424113113414422043330422002314144111134142044333404112240344
N = 332200324410041111434222123043121331442103233332422341041340412034230003314420311333101344231212130200312041044324431141033004333110021013020140020011222012300020041342040004002220210223122111314112124333211132230332124022423141214031303144444134403024420111423244424030030003340213032121303213343020401304243330001314023030121034113334404440421242240113103203013341231330004332040302440011324004130324034323430143102401440130242321424020323
c = 10013444120141130322433204124002242224332334011124210012440241402342100410331131441303242011002101323040403311120421304422222200324402244243322422444414043342130111111330022213203030324422101133032212042042243101434342203204121042113212104212423330331134311311114143200011240002111312122234340003403312040401043021433112031334324322123304112340014030132021432101130211241134422413442312013042141212003102211300321404043012124332013240431242
由于题目中的数都是由5进制表示的,所以脚本中要先把5进制转换为10进制,又有
≡
mod
≡
mod
≡
mod
所以可以通过中国剩余定理求解,python代码如下:
import gmpy2
from functools import reduce
import sympy
def chinese_remainder(n, a):
sum = 0
prod = reduce(lambda a, b: a * b, n)
for n_i, a_i in zip(n, a):
p = prod // n_i
sum += a_i * sympy.invert(p, n_i) * p
return int(sum % prod)
def wu_shi(n):
strlen=len(n)
s=0
for i in range(0,strlen):
s+=int(n[i])*pow(5,strlen-i-1)
return s
n1 = int(str(331310324212000030020214312244232222400142410423413104441140203003243002104333214202031202212403400220031202142322434104143104244241214204444443323000244130122022422310201104411044030113302323014101331214303223312402430402404413033243132101010422240133122211400434023222214231402403403200012221023341333340042343122302113410210110221233241303024431330001303404020104442443120130000334110042432010203401440404010003442001223042211442001413004),5)
c1 = int(str(310020004234033304244200421414413320341301002123030311202340222410301423440312412440240244110200112141140201224032402232131204213012303204422003300004011434102141321223311243242010014140422411342304322201241112402132203101131221223004022003120002110230023341143201404311340311134230140231412201333333142402423134333211302102413111111424430032440123340034044314223400401224111323000242234420441240411021023100222003123214343030122032301042243),5)
n2 = int(str(302240000040421410144422133334143140011011044322223144412002220243001141141114123223331331304421113021231204322233120121444434210041232214144413244434424302311222143224402302432102242132244032010020113224011121043232143221203424243134044314022212024343100042342002432331144300214212414033414120004344211330224020301223033334324244031204240122301242232011303211220044222411134403012132420311110302442344021122101224411230002203344140143044114),5)
c2 = int(str(112200203404013430330214124004404423210041321043000303233141423344144222343401042200334033203124030011440014210112103234440312134032123400444344144233020130110134042102220302002413321102022414130443041144240310121020100310104334204234412411424420321211112232031121330310333414423433343322024400121200333330432223421433344122023012440013041401423202210124024431040013414313121123433424113113414422043330422002314144111134142044333404112240344),5)
n3 = int(str(332200324410041111434222123043121331442103233332422341041340412034230003314420311333101344231212130200312041044324431141033004333110021013020140020011222012300020041342040004002220210223122111314112124333211132230332124022423141214031303144444134403024420111423244424030030003340213032121303213343020401304243330001314023030121034113334404440421242240113103203013341231330004332040302440011324004130324034323430143102401440130242321424020323),5)
c3 = int(str(10013444120141130322433204124002242224332334011124210012440241402342100410331131441303242011002101323040403311120421304422222200324402244243322422444414043342130111111330022213203030324422101133032212042042243101434342203204121042113212104212423330331134311311114143200011240002111312122234340003403312040401043021433112031334324322123304112340014030132021432101130211241134422413442312013042141212003102211300321404043012124332013240431242),5)
n=[n1,n2,n3]
c=[c1,c2,c3]
ans=chinese_remainder(n, c)
ans=gmpy2.iroot(ans,3)[0]
print(bytes.fromhex(hex(ans)[2:]))
#noxCTF{D4mn_y0u_h4s74d_wh47_4_b100dy_b4s74rd!}