RSA常见攻击分析（一）

RSA常见攻击分析（一）

一、试除法

1. 所谓试除法，就是使用比n小的数一个个的去尝试除n，当尝试的数可以整除n，就说明该数是n的一个因子，即完成对n的分解。我们很容易看出试除法的本质就是一种暴力分解n的方法，所以如果n本身比较大且n的因子也十分大的时候，这个方法需要运行很长时间，所以在生成RSA公钥密码体系，要求n的两个因子都要取比较大的数

```python
例如：
import gmpy2
#试除法
def trial(n):
    for i in xrange(2,gmpy2.iroot(n,2)[0]):
        if n%i==0:
            return i

    return 0
n=920139713
e=19
c=[704796792,752211152,274704164,18414022,368270835,483295235,263072905,459788476,483295235,459788476,663551792,475206804,459788476,428313374,475206804,459788476,425392137,704796792,458265677,341524652,483295235,534149509,425392137,428313374,425392137,341524652,458265677,263072905,483295235,828509797,341524652,425392137,475206804,428313374,483295235,475206804,459788476,306220148]
p=trial(n)
q=n/p
phin=(p-1)*(q-1)
d=gmpy2.invert(e,phin)
flag=""
for i in c:
    flag=flag+chr(pow(i,d,n))
print("flag:%s"%flag)

二、Pollard rho方法

from gmpy2 import *

#pollardrho法
def g(x):
    return x*x+1
def pollardrho(n):
    x=2
    y=2
    d=1
    while (d==1) or (d==n):
        x=g(x)%n
        y=g(g(y))%n
        d=gcd(abs(x-y),n)
    return d
n=920139713
e=19
c=[704796792,752211152,274704164,18414022,368270835,483295235,263072905,459788476,483295235,459788476,663551792,475206804,459788476,428313374,475206804,459788476,425392137,704796792,458265677,341524652,483295235,534149509,425392137,428313374,425392137,341524652,458265677,263072905,483295235,828509797,341524652,425392137,475206804,428313374,483295235,475206804,459788476,306220148]
p=pollardrho(n)

q=n/p
phin=(p-1)*(q-1)
d=invert(e,phin)
flag=""
for i in c:
    flag=flag+chr(pow(i,d,n))
print("flag:%s"%flag)

三、pollard p-1方法

import base64
from gmpy2 import *
from Crypto.PublicKey import RSA
#Pollard p-1算法
def Pollard(n):
    a=2
    b=2
    while True:
        a=pow(a,b,n)
        p=gcd(a-1,n)
        if 1<p<n:
            print "p:%d"%p
            return p
        b=b+1

pubkey="""-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq+m7iHurBa9G8ujEiTpZ
71aHOVNhQXpd6jCQNhwMN3hD6JHkv0HSxmJwfGe0EnXDtjRraWmS6OYzT4+LSrXs
z9IkWGzRlJ4lC7WHS8D3NWIWYHCP4TRt2N0TlWXWm9nFCrEXqQ3IWgYQpQvKzsds
etnIZJL1tf1wQzGE6rbkbvURlUBbzBSuidkmi0kY5Qxp2Jfb6OUI647zx2dPxJpD
ffSCNffVIDUYOvrgYxIhs5HmCF3XECC3VfaKtRceL5JM8R0qz5nVU2Ns8hPvSVP+
7/i7G447cjW151si0joB7RpBplu44Vk8TXXDAk0JZdW6KwJn7ITaX04AAAAAAAAA
AQIDAQAB
-----END PUBLIC KEY-----"""
key=RSA.importKey(pubkey)
n=key.n
e=key.e
p=Pollard(n)
q=n/p
c=int(base64.b64decode('eER0JNIcZYx/t+7lnRvv8s8zyMw8dYspZlne0MQUatQNcnDL/wnHtkAoNdCalQkpcbnZeAz4qeMX5GBmsO+BXyAKDueMA4uy3fw2k/dqFSsZFiB7I9M0oEkqUja52IMpkGDJ2eXGj9WHe4mqkniIayS42o4p9b0Qlz754qqRgkuaKzPWkZPKynULAtFXF39zm6dPI/jUA2BEo5WBoPzsCzwRmdr6QmJXTsau5BAQC5qdIkmCNq7+NLY1fjOmSEF/W+mdQvcwYPbe2zezroCiLiPNZnoABfmPbWAcASVU6M0YxvnXsh2YjkyLFf4cJSgroM3Aw4fVz3PPSsAQyCFKBA==').encode('hex'),16)
phin=(p-1)*(q-1)
d=invert(e,phin)
for i in xrange(30):
    c=pow(c,d,n)
    print '%d-----------------------------------------'%i
    print (['','0'][len(hex(c))%2]+hex(c)[2:]).decode('hex')

四、 费马分解

from gmpy2 import *
#fermat分解
def fermat(n):
    t=iroot(n,2)[0]+1
    while True:
        ss=t**2-n
        if iroot(ss,2)[1]:
            return t,iroot(ss,2)[0]
        t=t+1
n = 966808932627497190635859236054960349099463975227350564265384373280336699853387254070662881265937565163000758606154308757944030571837175048514574473061401566330836334647176655282619268592560172726526643074499534129878217409046045533656897050117438496357231575999185527675071002803951800635220029015932007465117818739948903750200830856115668691007706836952244842719419452946259275251773298338162389930518838272704908887016474007051397194588396039111216708866214614779627566959335170676055025850932631053641576566165694121420546081043285806783239296799795655191121966377590175780618944910532816988143056757054052679968538901460893571204904394975714081055455240523895653305315517745729334114549756695334171142876080477105070409544777981602152762154610738540163796164295222810243309051503090866674634440359226192530724635477051576515179864461174911975667162597286769079380660782647952944808596310476973939156187472076952935728249061137481887589103973591082872988641958270285169650803792395556363304056290077801453980822097583574309682935697260204862756923865556397686696854239564541407185709940107806536773160263764483443859425726953142964148216209968437587044617613518058779287167853349364533716458676066734216877566181514607693882375533
e = 65537
c = 168502910088858295634315070244377409556567637139736308082186369003227771936407321783557795624279162162305200436446903976385948677897665466290852769877562167487142385308027341639816401055081820497002018908896202860342391029082581621987305533097386652183849657065952062433988387640990383623264405525144003500286531262674315900537001845043225363148359766771033899680111076181672797077410584747509581932045540801777738548872747597899965366950827505529432483779821158152928899947837196391555666165486441878183288008753561108995715961920472927844877569855940505148843530998878113722830427807926679324241141182238903567682042410145345551889442158895157875798990903715105782682083886461661307063583447696168828687126956147955886493383805513557604179029050981678755054945607866353195793654108403939242723861651919152369923904002966873994811826391080318146260416978499377182540684409790357257490816203138499369634490897553227763563553981246891677613446390134477832143175248992161641698011195968792105201847976082322786623390242470226740685822218140263182024226228692159380557661591633072091945077334191987860262448385123599459647228562137369178069072804498049463136233856337817385977990145571042231795332995523988174895432819872832170029690848
t,s=fermat(n)
p=t-s
q=t+s
assert p*q==n
phin=(p-1)*(q-1)
d=invert(e,phin)
m=pow(c,d,n)
print hex(m)[2:].decode("hex")

五、 二次筛法

from gmpy2 import *
from Crypto.PublicKey import RSA
def shuchu(mingwenstr):
    if mingwenstr[len(mingwenstr)-1]=='L':
        mingwenstr=mingwenstr[2:len(mingwenstr)-1]
    else:
        mingwenstr=mingwenstr[2:len(mingwenstr)]
    if not len(mingwenstr)%2==0:
            mingwenstr='0'+mingwenstr
    i=len(mingwenstr)
    mingwen=""
    while i>=1:
        str1=mingwenstr[i-2:i]
        if int(str1,16)>33 and int(str1,16)<126:
            mingwen=chr(int(str1,16))+mingwen
        else :
            mingwen=" "+mingwen
        i=i-2
    print mingwen
pubkey="""-----BEGIN PUBLIC KEY-----
MDwwDQYJKoZIhvcNAQEBBQADKwAwKAIhANmelSKWptlg38JQSrpUW5RC1gp7npMK
/0UceOxV1VXrAgMBAAE=
-----END PUBLIC KEY-----
"""
key=RSA.importKey(pubkey)
n=key.n
e=key.e
print "n=",hex(n)
print "e=",e
p = 302825536744096741518546212761194311477
q = 325045504186436346209877301320131277983
phin=(p-1)*(q-1)
d=invert(e,phin)
fi=open("encrypted.message1","r")
cstr=fi.read()
fi.close()
fi=open("encrypted.message2","r")
cstr1=fi.read()
fi.close()
fi=open("encrypted.message3","r")
cstr2=fi.read()
fi.close()
cint=int(cstr.encode("hex"),16)
m=pow(cint,d,n)
shuchu(hex(m))
cint=int(cstr1.encode("hex"),16)
m=pow(cint,d,n)
shuchu(hex(m))
cint=int(cstr2.encode("hex"),16)
m=pow(cint,d,n)
shuchu(hex(m))

我们会发现有一些乱码，我们需要将后面正常的字符组合即是答案。